December 2003 - cypherpunks-legacy

Can't touch this, ugly Americans! (PGP License file)
by Adam Shostack 17 Dec '03

17 Dec '03

First off, congratulations and thanks to Stale and everyone else for scanning in the source to PGP5.0i (http://www.ifi.uio.no/pgp/) However, theres an ugly problem with the license. (http://www.ifi.uio.no/pgp/pgp50i-license.txt) In Section 1.c.(d), permission is given to port PGP to other platforms. However, permission to distribute those ports is explicitly denied. Could the license be modified to allow people who port the software to redisctribute ports? There is enough FUD about using PGP without PGP, Inc contributing to that by overly tight licensing. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

3 3

Re: North American Crypto Archive status
by Ariel Glenn 17 Dec '03

17 Dec '03

Okay, I have a list of files which I couldn't get off the North American Crypto Archive site before it closed, and couldn't find anywhere else; see http://www.columbia.edu/~ariel/news/mpj-missing.html Get out all your old floppies and see if you or your friends or even your enemies downloaded any of these. I've listed the original file names and the byte counts; I'd like to get the original files all in place before worring about newer/different versions of them. Ariel Glenn / AcIS R&D / Columbia University ariel(a)columbia.edu blah blah blah blah...

1 0

No Subject
by Alex de Joode 17 Dec '03

17 Dec '03

Subject: Re: Can't touch this, ugly Americans! (PGP License file) Newsgroups: list.cypherpunks Organization: Replay and Company UnLimited. Adam Shostack sez: : First off, congratulations and thanks to Stale and everyone else for : scanning in the source to PGP5.0i (http://www.ifi.uio.no/pgp/) It was mostly an Brit effort (with some dutch and german help). They did sweat labour for two days, so a thank you guys is certainly in order. T H A N K Y O U A L L ! ! -aj-

1 0

List of crypto-related courses
by Avi Rubin 17 Dec '03

17 Dec '03

For the last year or so, I have built and maintained a list of graduate level courses on cryptography and security. The current list can be found at http:/www.cs.ny.edu/~rubin/courses.html I would like to keep this list as current as possible, so if you have any additions/corrections, etc, please let me know. I am only interested in full-semester courses at universities. Thank you, Avi ********************************************************************* Aviel D. Rubin rubin(a)research.att.com Secure Systems Research Dept. Adjunct Professor at NYU AT&T Labs - Research 180 Park Avenue http://www.research.att.com/~rubin/ Florham Park, NJ 07932-0971 Voice: +1 973 360-8356 USA FAX: +1 973 360-8809 --> Check out http://www.clark.net/pub/mjr/websec/ for a new book on web security (The Web Security Sourcebook). *********************************************************************

1 0

[Fwd: fwd: Digital Signature Amendment in US House Today]
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text MIME-Version: 1.0 Date: Thu, 7 Aug 1997 14:03:23 -0400 Reply-To: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> Sender: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> From: Dan Greenwood <dan(a)CIVICS.COM> Subject: [Fwd: fwd: Digital Signature Amendment in US House Today] To: DIGSIG(a)VM.TEMPLE.EDU FYI Received: from mailhub.state.ma.us (mailhub.state.ma.us [146.243.12.156]) by maildeliver0.tiac.net (8.8.0/8.8) with ESMTP id NAA19610 for <dan(a)civics.com>; Thu, 7 Aug 1997 13:51:57 -0400 (EDT) Received: from vinesgw1.state.ma.us by mailhub.state.ma.us; Thu, 7 Aug 1997 13:57:05 -0400 Received: by vinesgw1.state.ma.us; Thu, 7 Aug 97 13:51:10 EDT Date: Thu, 7 Aug 97 12:44:41 EDT Message-ID: <vines.KW59+shTunA(a)vinesgw1.state.ma.us> X-Priority: 3 (Normal) To: <digsig(a)lists.state.tx.us> Cc: "Gutierrez-ANF, Louis" <Louis.Gutierrez(a)state.ma.us> (louis gutierrez) From: "Greenwood-ITD, Dan" <Dan.Greenwood(a)state.ma.us> (dan greenwood) Subject: fwd: Digital Signature Amendment in US House Today MIME-Version: 1.0 Content-type: text/plain; charset=US-ASCII Hello, Below, please find a NIST legislative effort to set national PKI standards - including CA and digital signature standards ("The Panel shall develop . . standards to ensure consistency among jurisdictions that license certification authorities"). To the credit of the drafters of this amendment, they do seek some participation by state gov. and other stockholders to inform the process. Also to their credit, they are seeking ways to develop national uniformity in this area generally. Questions: why is this focused on the license of CAs and not on the more desirable "accreditation" standards that must be developed? Perhaps it is for the good that accreditation of CAs remain primarily a private sector activity (outside the scope of Federal government direct control and regulation) - but this NIST language seems to assume multi-jurisdictional license of CAs (what other requirements will the federal government seek to impose through license - key escrow? pricing? particular technological implementations? pre-conceived business models?) What will be the market impacts of such license requirements? This raises some interesting questions about where to strike the optimal balance between top-down federal government's national consistent standards versus working with private sector leadership/self-governance organizations to develop national standards (hence allowing more innovation, responsiveness to change and (I believe) better standards for this very dynamic and young area). Can this be done through "license" - perhaps so. Assuming we create the right license criteria - such as: "you are deemed to be licensed if you have been accredited by XXX") - then we just need to make sure that accreditation (or some level of accred) is minimally adequate for the interests that would have been served by license. For that matter, the question should be asked "licensed to do what?" If the federal government has a particular federal agency that needs to accept outside certificates to authenticate a citizen or business, then I can see them requiring that the issuing CA be licensed. Beyond such a scenario, why should the federal government require CAs to be licensed just to do business? If license is voluntary and not mandatory - what government benefits or harms would follow from being licensed or not? Will export control be used to force compliance with license requirements? The federal government can lend a helpful hand in the process of designing appropriate license criteria for federal programs, and that criteria could be useful at the state gov. and private sector levels as well. However, it seems to me that it would be unwelcome and unwise at this point in time for the federal government to arrogate to itself the power and jurisdiction to regulate this industry in a complete way through license (it has been said that the power to tax is the power to destroy - that goes double for the power to license). In the future, if there develops a demonstrable problem with consistent CA practices evolved by market based solutions (as facilitated by accreditation), then I think a credible case could be made at that time for the federal government to step in with some standards in the interests of inter-state commerce. At that time, any standards should be narrowly tailored to actual market failures and specific non-uniformity issues. Until then, we should use the considerable resources envisioned by the amendment (see below) to encourage private sector leadership and innovation in this area. Of course, through purchase power, the public sector has the right and the obligation to apply pressure through aggregation of demand as a way to get interoperable products. Any such pressure should be exerted in a manner that is consistent with current private sector electronic commerce practices and needs. It is relevant to point to the NASIRE CA accreditation initiative in this regard, is an important effort to work with the private sector to create voluntary standards for the use of digital signature technology. Regards, Dan ------------- Original Text From: Adam White Scoville <adville(a)cdt.org>, on 7/28/97 5:56 PM: To: ""Greenwood-ITD Hello - I'm glad we touched base at the NIST conference - I still would like to ask you a couple questions on the pre-emption issue. But first, the point of _this_ message is that I though you would be interested to know that the Technology Subcommittee of the House Committee on Science added about an hour ago this amendment (among others) to HR 1903, the NIST "Computer Security Enhancement Act of 1997." (a) National Policy Panel - The Under Secretary of Commerce for Technology shall establish a National Policy Panel for Digital Signatures, composed of nongovernment and government technical and legal experts on the implementation of digital signature technologies, individuals from companies offerring digital signature products and services, State officials, including officials from States which have enacted statutes establishing digital signature infrastructures, and representative individuals from the interested public. (b) Responsibilities - The Panel shall serve as a forum for exploring all relevant factors associated with the development of a national digital signature infrastructure based on uniform standards that will enable the widespread availability and use of digital signature systems. The Panel shall develop - (1) Model practices and procedures for certification authorities to ensure accuracy, reliability, and security of operations associated with issuing and managing certificates; (2) standards to ensure consistency among jurisdictions that license certification authorities; and (3) audit standards for certification authorities. Adam White Scoville Center for Democracy & Technology Adam White Scoville adville(a)cdt.org adam.scoville(a)bc.edu If you wish to send me a secure message, encrypt it with PGP, using my public key available at <http://www2.bc.edu/~scovilad/pgp.txt>. For more information about PGP and encryption, visit <http://www.pgp.com>. A free version of PGP (for MacOS and Windows) is available at <http://web.mit.edu/network/pgp.html>. A free version of the popular Eudora mail program (also for both MacOS and Windows) which incorporates PGP is available at <http://www.eudora.com/export>. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Encrypting same data with many keys...
by Ray Arachelian 17 Dec '03

17 Dec '03

What are the dangers of taking a small block of data - say upto 1K in size, then producing many files, each being the same data encrypted by other keys? i.e.: Plain data: 1K in size or smaller File 1: Data encrypted with Key1 File 2: Data encrypted with Key2 File 3: Data encrypted with Key3 File 4: Data encrypted with Key4 File 5: Data encrypted with Key5 File 6: Data encrypted with Key6 File 8: Data encrypted with Key8 .... File N: Data encrypted with KeyN A known plaintext attack won't help you to break the keys unless you have one of the eight keys, but will having many keys that encrypt the same data significanltly weaken the security of that tiny chunk of data? And no, I don't mean, there's N keys so the odds of brute forcing the data is now N times easier. Assume we're using 128 bit Blowfish/Idea or better, and discarding weak keys. Are there any differential or other cryptanalysis methods to use the eight resulting cyphertexts to get at the data other than brute forcing it if you don't know any of the keys? What if instead of using a private key cypher, we used a public key cypher? Would that make any difference in attack methods? The data won't contain any text, or identifiers (i.e "GIF89" in GIF files, "MZ" in wintel executables, etc...) known or guessable to the attacker... =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder(a)sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ==========================

7 14

DCSB: Elliptic Curve Cryptography and Digital Commerce
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: rah(a)mail.shipwright.com Mime-Version: 1.0 Date: Mon, 11 Aug 1997 11:13:20 -0400 To: dcsb(a)ai.mit.edu, dcsb-announce(a)ai.mit.edu From: Robert Hettinga <rah(a)shipwright.com> Subject: DCSB: Elliptic Curve Cryptography and Digital Commerce Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Robert Hettinga <rah(a)shipwright.com> -----BEGIN PGP SIGNED MESSAGE----- <My mistake. The correct payment deadline for this event is August 30, as noted below... --RAH> The Digital Commerce Society of Boston Presents Dr. Christof Paar Cryptography and Data Security Group, Worcester Polytechnic Institute Elliptic Curve Cryptography and Digital Commerce Tuesday, September 2, 1997 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Elliptic Curve (EC) public-key cryptosystems have matured from an area of mainly theoretical interest to a highly practical security tool. EC are a general-purpose public-key scheme which can provide tasks such as digital signature, key establishment, and encryption. EC are extremely attractive because the required operand length is dramatically reduced compared to RSA and DSA-type algorithms: The security of an RSA system with 1024 bits corresponds to the security of an EC system with only 160 bits. This can result in considerably faster processing times, e.g., for digital signature verification, and shorter certificates. One application area of special interest are smart cards. This talk will give a brief, non-technical introduction to EC system. Current security estimations relatively to RSA will be provided. We will talk about performance and the adoption of EC systems in standard bodies. Christof Paar leads the Cryptography and Data Security group in the ECE department of Worcester Polytechnic Institute. Dr. Paar's research interests include security issues in wireless and ATM networks, smart cards, efficient implementation of elliptic and hyperelliptic curve public-key algorithms, and hardware implementation of cryptosystems. Dr. Christof Paar received a BSEE degree from the Technical College of Cologne, Germany. He obtained an MSEE degree from the University of Siegen, Germany, and did graduate research at Michigan Technological University. From 1991-1994 he worked as research fellow at the Institute for Experimental Mathematics in Essen, Germany, from where he received a Ph.D. in Electrical Engineering. In 1993 and '94 he spent time as a visiting researcher at the University of Massachusetts at Amherst. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, September 2, 1997, from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, on One Federal Street. The price for lunch is $30.00. This price includes lunch, room rental, various A/V hardware, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men (and no sneakers or jeans), and "appropriate business attire" (whatever that means), for women. Fair warning: since we purchase these luncheons in advance, we will be unable to refund the price of your lunch if the Club finds you in violation of the dress code. We will attempt to record this meeting and put it on the web in RealAudio format at some future date We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, August 30, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston", in the amount of $30.00. If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Upcoming speakers for DCSB are: October Peter Cassidy Military Fiat and Digital Commerce November Carl Ellison Identity and Certification for Electronic Commerce We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, <mailto: rah(a)shipwright.com> . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . We look forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston - ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQEVAwUBM+85YMUCGwxmWcHhAQFJFQf+IzAfWbsqMhHNE0dmBeIhj5li2NE9l5VH GwEnorE/FZ9iyg+ZMX4MvsYNwh0LjswIZBe1tCPIoRHqSJ+DDL8BqPzMdjYUONBz aJVz1x15AgJNVgw4Ub2FzNes6nj2uYt6OyYoemPdmUAefew7+nnwGJAO8vmBxUjI Ww44e+MM8dzYaCPu123Tk1gNInFtFJQC+Usw2ExgZdVU7bgciWjt5WEE8V4tR5QW I/RYIm4GYADbAY6U8M7vJ0eK5dcqRhbOLxGh48pmaK24nO3WAN2OS3c4ZKXWIZf+ vch4P8C3nfXLnC3NsbPIG1aa/FrWy3msg6WbQP/v3e5AfMUrFixWnw== =kKJN -----END PGP SIGNATURE----- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb-announce Or, to subscribe, write: subscribe dcsb-announce If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

HIP hip hooray
by Zooko Journeyman 17 Dec '03

17 Dec '03

HIP rocked. I'm still trying to adjust to the mundanity of everyday life. I loved meeting some cpunks in Real Life. Here are a couple of relevant URLs. --Z http://magazine.dds.nl/english/XArtikel.phtml?ArtID=179&KatID=7 http://magazine.dds.nl/english/XArtikel.phtml?ArtID=156&KatID=7 http://magazine.dds.nl/english/XArtikel.phtml?ArtID=172&KatID=7 http://magazine.dds.nl/english/XArtikel.phtml?ArtID=174&KatID=7 http://magazine.dds.nl/english/XArtikel.phtml?ArtID=187&KatID=7

1 0

Partner Program Pays $9.00 Now!
by partner＠adultclubs.com 17 Dec '03

17 Dec '03

_____________________________________________________________ This is a webmaster mailing from a qualified list of subscribers. If you wish to be removed from our future mailings, you MUST reply with the word "Remove" in the Subject line and we will automatically block you from our future mailings. ______________________________________________________________ Hello Adult Webmaster, Make real $$MONEY$$ with Adult Clubs International. We pay you $9.00 for each $14.95 subscriber you send us. No Questions asked, send us a subscriber from your site and you you will receive $9.00 Are you sending your traffic to a site that only pay $0.03 - $0.05 per click and at the end of the month find out that the 2,500 clicks only registered 1,400. Now is the time to join the Partner Plus+ Program. You need only place 2 lines of code on your page and we do the rest. We serve the banners from our site so there is no cost for bandwidth to you. WE OFFER THE HIGHEST PARTNER PROGRAM PAY OUT IN THE INDUSTRY!!!!! Register Today! http://www.adultclubs.com/partner.htm

1 0

Feds Seek PKI Bids
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

>USG published a solicitation today in the CBD for a >Public Key Infrastructure which outlines the system >requirements: > http://jya.com/pkicbd.htm Interesting from what is *not* there - any mention of key recovery/key escow. Looks like they may finally understand what a Certificate Authority is (not holding breath). Do not think much of appelations (Classic & Gold) and suspect they may need more than two but sounds like a good start. Warmly, Padgett

2 1