December 2003 - cypherpunks-legacy

mailing list.
by David.Y＠freedomnet.com 17 Dec '03

17 Dec '03

Please put me on your mailing list, thanks.

1 0

Re: DejaNews all over again
by rah＠shipwright.com 17 Dec '03

17 Dec '03

> Jeff, I think it's in your best interest to not waste your time >responding to this moron (who bears many features in common with >Detweiler) Except for his esteemed "credentials", of course... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

This is for YOU...
by tony266＠vabeach.email.net 17 Dec '03

17 Dec '03

Yvette... Didn't LL Cool J make a song about you..."Dear yvette"...

1 0

Re: Java insecurity - long - argumentative - you are warned.
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 7 Nov 1995, Dietrich J. Kappe wrote: > >>> While all this checking appears excruciatingly detailed, by the time > >>> the byte code verifier has done its work, the Java interpreter can > >>> proceed knowing that the code will run securely. Knowing these > >>> properties makes the Java interpreter much faster, because it doesn't > >>> have to check anything. > > > >Yikes!! I'll leave this for someone else to address. This sounds to me > >like a variation on virus scanning. I think that there are far more > >reputable virus experts than I who can comment and expand on *flaws* with > >that approach. > > This "checking," as any comp-sci undergrad will tell you, amounts to solving > the halting problem for the java interpreter. While this is possible for a > finite state automata like the java interpreter (made more difficult by the > fact that it can use the "net" for additional state), it is not even > remotely feasable. OK, so by saying that it is not "even remotely feasable", you're saying that any comp-sci undergraduate will say that it can't be done? That is what "not even remotely feasable" means, doesn't it?? I mean, even if Marketing wants this problem solved, that won't be enough? > If you can write a checker that works in a reasonable amount of time, I'll > write a turing machine simulator that'll do something nasty if the input > machine halts. Then we'll split the fame and fortune for solving the 5 state > Busy Beaver problem. Deal? I'm sorry, I only work for T-shirt and mug contests. <grin> That fifteen minutes of fame thingy, just isn't my cup of tea. > Dietrich Kappe | Red Planet http://www.redweb.com > Red Planet, LLC| "Chess Space" | "MS Access Products" | PGP Public Key > 1-800-RED 0 WEB| /chess | /cobre | /goedel/key.txt > Web Publishing | Key fingerprint: 8C2983E66AB723F9 A014A0417D268B84 Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

SPAM:E-CA$H Conference SF 11/16-17
by Kawika Daguio 17 Dec '03

17 Dec '03

COMMERCIAL - SPAM ALERT - I will be speaking at a conference on Electronic Money that might interest some of you sitting on some extra rEeal Money who also suffer from the burning desire to find out what ideas and technology other folks are flogging on the talk-circuit. The brochure is too long to type in but some excerpts follow: 10 key questions to be answered at this critical industry event: 10. What are the biggest avenues to entry into the world of electronic commerce? 9. Who will be the biggest users of electronic money? 8. Who should be allowed to issue E-cash? 7. How will debit and checking fit in with the electronic money future? 6. How do you balance privacy, security, and efficiency in E-cash systems? 5. How can electronic commerce be used for a business advantage? 4. How will the government regulate E-cash? 3. How will electronic payment systems protect against fraud? 2. What infrastructure is needed to provide security on open networks? 1. What are the leading technologies that will be used for E-cash? Speakers: Ernest Brickell Bankers Trust Electronic Commerce Richard K. Crone Center for Electronic Banking, KPMG Peat Marwick ME John Doggett Bank of Boston Peter Gemmel Sandia National Laboratories Gail Grant Open Market Edward Hogan MasterCard International Randy Kahn First Interstate of California Michael Killen Killen and Associates Steve Kimmey Tandem Computers Paul Lambert Barnett Banks Ron Laurie McCutchen, Doyle, Brown and Enersen Scott Loftesness First Data Corporation Greg McKenzie Canadian Imperial Bank of Commerce B. Clifford Neuman University of Southern California Deborah Owen Arent Fox Kinter Plotkin and Kahn Daniel Schutzer Citibank Financial Services Technology Consortium Bill Washburn Mecklermedia Magdalena Yesil CyberCash Sponsor: IBC USA Conferences Date: November 16 - 17 Venue: Pan Pacific Hotel 500 Post Street San Francisco EMAIL: questions or registrations skeyles(a)ibcusa.com Phone: 508.481.6400 ext 282 (Sherry)

1 0

Re: coding and nnet's
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:17 PM 11/10/95 -0500, Atp3000(a)aol.com wrote: >I just resently got interested in coding and cryptography, and I was >wondering if you could suggest 3 or 4 papers that adresses the aplication of >neural networks in cryptography. Schneier's 2nd edition says "Neural nets aren't terribly useful for cryptography, primarily because of the shape of the solution space. Neural nets work best for problems that have a continuity of solutions, some better than others. This allows a neural net to learn, proposing better and better solutions as it does. Breaking an algorithm provides for very little in the way of learning opportunities: You either recover the key or you don't. (At least this is true if the algorithm is any good.) Neural nets work well in structured environments when there is something to learn, but not in the high-entropy, seemingly random world of cryptography." And he doesn't give any references. That's been my opinion of the issue as well; I looked into it a bit when I was doing a project with the neural net folks back at Bell Labs, partly because neural net chips typically have lots and lots of parallel bit-sized horsepower. Unfortunately, the horsepower isn't arranged in ways that are very useful for crypto; adding together a large bunch of short chunks of data (maybe using floating point addition) and thresholding the sum isn't the right thing to do with highly discontinuous functions. You could take a similar chip design and connect the pieces together differently to make a brute-force searcher, i.e. take a gate array and wire it to do crypto-like calculations, but the neural net stuff doesn't do that very efficiently. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Re: Lotus Notes RSA Implementation Question
by eli＠GS160.SP.CS.CMU.EDU 17 Dec '03

17 Dec '03

In article <+cmu.andrew.internet.cypherpunks+kkcsTXG00UfAE0ynIq(a)andrew.cmu.edu> Charlie Kaufman writes: >Notes V3 (the one currently deployed) uses 512 bit RSA keys in both >the USA and exportable versions. 512-bit RSA is exportable? I'm surprised. It would be interesting to CJR a known-secure binary for 512-bit RSA, attempting a little differential cryptanalysis on the NSA's practices. A fair test would require that you have the political clout of Lotus/IBM, though. -- Eli Brandt eli+(a)cs.cmu.edu

1 0

Online ITAR and AECA; Bibliography of export control books
by John Gilmore 17 Dec '03

17 Dec '03

> > Where can one get a copy of ITAR ? Secondly , has anyone written any > > books on the subject and if so who and what? The ITAR is a regulation, not a law. You can find it via my crypto export control page at http://www.cygnus.com/~gnu/export.html under "State Department export guidance". Or at ftp://ftp.cygnus.com/pub/export/itar.in.full. It's 380 kbytes (but ignorance of it is no excuse!). That regulation is authorized by the Arms Export Control Act (AECA), a law (22 USC Sec. 2778). The law is also available in the same places. It's only 40 Kbytes. I own and can recommend several books on export controls. Layman's books on general export controls and technology policy issues: 90-26801: Finding common ground : U.S. export controls in a changed global environment / Washington, D.C. : National Academy Press, 1991. xviii, 390 p. : ill. ; 24 cm. LC CALL NUMBER: HF1414.5 .F56 1991 87-34877: Technology transfer : a policy model / Philip A. Roberts. Washington, DC : National Defense University Press, 1988. xiii, 86 p. ; 21 cm. LC CALL NUMBER: HC110.T4 R62 1988 SERIES TITLE: A National security essay DEWEY DEC: 338.973/06 dc19 93-50697: Silencing science : national security controls and scientific communication / Harold C. Relyea. Norwood, NJ : Ablex Pub., c1994. xvii, 248 p. ; 23 cm. LC CALL NUMBER: Q223 .R45 1994. SERIES TITLE: Information management, policy, and services. DEWEY DEC: 338.97306 dc20. ISBN: 156750096X; 1567500978 (pbk.) Lawyer's Tome on export controls, with detailed case citations and such: 91-37498: Root, William A. United States export controls / 3rd ed. Englewood Cliffs, NJ : Prentice Hall Law & Business, c1991- 1 v. (loose-leaf) : ill. ; 26 cm. ISBN: 0139529381 LC CALL NUMBER: KF1987 .L54 1990. DEWEY DEC: 353.0082/76 dc20 [This one is loose-leaf and gets annual updates at $80/year. I forget how much it cost originally.] By the way, if you're trying to find general references on export controls or crypto, or anything else, I recommend `telnet://locis.loc.gov' and searching the Library of Congress card catalog or the copyright records. The user interface is IBM mainframe oriented, but the information is without peer. John Gilmore

1 0

Re: coding and nnet's
by John Young 17 Dec '03

17 Dec '03

Bruce Schneier comments: Neural Networks Neural nets aren't terribly useful for cryptanalysis, primarily because of the shape of the solution space. Neural nets work best with problems that have a continuity of solutions, some better than others. This allows a neural net to learn, proposing better and better solutions as it does. Breaking an algorithm provides for very little in the way of learning opportunities: You either recover the key or you don't. (At least this is true if the algorithm is any good.) Neural nets work well in structured environments where there is something to learn, but not in the high-entropy, seemingly random world of cryptography. "Applied Cryptography," second edition, 1996, p. 155.

1 0

Re: Exporting software doesn't mean exporting (was: Re: lp ?)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 10 Nov 1995, Peter D. Junger wrote: > In any case, I want to thank him for doing so, because it brought home > to me the important fact that it is possible that the ITAR provisions > relating to cryptographic software could be struck down, not because > they violate the first amendment, or would violate it if passed by > congress, and not because the court is trying to dodge the difficult > first amendment issue, but simply because the provisions are not > authorized by any legislation. Hmmm, Peter actually has me worried. I actually _understood_ what he was talking about. And that has me worried. I guess that reviewing all that LIBOR financing documentation over ten years ago, when I was extending a helping hand to the CIBC helped. No one should ever attempt to figure out what happens when you have an American highrise owned by a private Canadian citizen, go into receivership with a syndicated Euro-financing while attempting a head lease to AT&T. An experience like that leaves you scarred for life. You actually learn to grok "lawyer speak". I guess that an interesting follow up occurs, if I perhaps muddy the chrystal clear waters of Peter's analysis. It relates to another thread on this list, the thread on time-release crypto and the economics of information. A hypothetical which might clarify by making things murky. If I ... as a foreign citizen ... a Canadian ... were to release an algorithm for time-release crypto to another Canadian ... another foreigner, could I actually be hauled down by the scruff of my neck to face US style "justice". Could I be deprived of our Canadian traditions of Napoleonic Code and of British Common Law, to face Americanism's. Does anyone from State have any clarification of this policy-shift?? I find it ridiculous to hear that if I load a series of messages into a fax machine, and instruct that machine to send out a series of documents at some set point in time -- and that if I were to *communicate* this method of time delay cryptographically secure communication to another Canadian citizen, that I could actually be hauled out of my own country and dragged across an international border to face charges of treason against a state to which I have no allegiance. This would be laughable, if it weren't so sinister. I mean, it's only a FAX machine ... for goodness sake's. Here I am as a Canadian citizen, a citizen of a sovereign State, a state which has historically been a friend of the American people. A State which has actually sacrificed its own international stature and the security of its citizens, to benefit Americans. (Most notably, when Canada rescued the hostages in Iran) and America repays the citizens of Ambassador Ken Taylor's home town how?? With an implied threat of making them subject to US law because its administratively convenient? Indeed. Can't anyone find acts of treason, a little closer to home?? Domestically maybe ... possibly even right under your nose ... > It's too far off topic to pursue any further, but I must take > exception to the suggestion that we are well served by separation of > powers intruding into other legal domains. Bowsher tells us that > causation principles go out the window in SOP cases. That alone > makes it radioactive. You ain't whistling Dixie. > I must admit that I don't know what it is that he is refering to. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0