December 2003 - cypherpunks-legacy

Re: netscape's response (source code review)
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > It is becoming gradually clearer in cryptanalysis that you can't test > security of pieces in isolation. Their interaction with the > surrounding code and protocols is key to their security. Ross I don't think this is a new realization, attacks on crpyto systems have always considered the whole system. _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Persistent Services Needed
by tcmay＠got.net 17 Dec '03

17 Dec '03

One of the problems we're facing with "Cypherpunks" services is that they are catch-as-catch-can, or, bluntly, "flaky." Archive sites stop being archives, remailers vanish overnight (*), and other experiments pop up and then vanish with regularity. (My favorite example, and one which always makes me smile, is the example of a remailer in Europe a couple of years ago which became inoperative with the message: "The foo remailer will stop operating tonight because I have to take my laptop with me for the summer to Portugal.") I'm not criticizing these folks. Rather, I'm just saying something pretty obvious, that _persistence_ is important. This probably means commercialization, or formalized business relationships. With such persistent business set-ups, "the show must go on." Another reason for digital money. --Tim May Notice: With 1000 people on the Cypherpunks list, and many on other lists I am on, nearly every article I write generates at least one question, request for more information, dispute with my choice of words, etc. I have been trying to respond to these, usually privately, but the burden has become too much, and I no longer plan to respond to trivial or ephemeral points. If you don't hear from me, this is why. Some requests for pointers to information will still be handled, but I advise people to learn how to use the archives and/or search tools. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Has anyone seen the CatMan (catburgler)?
by Anarchist 17 Dec '03

17 Dec '03

I am trying to find someone who calls himself catman or catburgler. In nov. 94 He was serving in Albany County Jail in NY. If anyone has any information that may help like his E-mail address, Id really like to hear from you... My address is below. ********************************************** Email: rr251070(a)academ.hvcc.edu Email alias: Anarchist At: Hudsen Valley Community College 80 Vandenburgh Ave Troy, NY 12180 ---------------------------------------------- Anarchy- A movement to rid society of structured government, and to create a system based on co-operation and non-violence! **********************************************

1 0

Re: EMP & Cars (fwd)
by Brian B. Riley 17 Dec '03

17 Dec '03

On 9/8/97 7:00 AM, Peter Trei (trei(a)process.com) passed this wisdom: >Ham radio operators have been dealing with this issue for years. >There's a lot of (mostly anectodotal) stories of mobile operators >keying up their rigs and having either their own or neighbouring >cars misfiring or dieing. Shielded ignition cables seem to fix >things (though they are actually bought to prevent ignition noise >from getting into the radio, not the other way around). My 1988 Bronco II used to drop out of Cruise Control if I used 25 watts or more on 440 MHz FM. On the 50 watt setting at 440 MHz the engine would start running rough, though it never died. de ka2bqe Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys - Send Email Subject "Get PGP Key" -- of Steve Jobs (1997) "He gazed up at the enormous face. But it was all right. Everything was all right, the struggle was finished. He had won the victory against himself. " "He loved Big Brother." -- George Orwell, "1984"

1 0

US Govt., Hackers, & security - Cable TV
by Jim Choate 17 Dec '03

17 Dec '03

Hi, There is some show on TDC about the Internet and how it can be used as a threat to national security. It is 9:41pm Ctl. so check your schedule. Looks like good advertising... ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

FREE Trial offer for Computer Magazine Archives
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

---------------------------------------------------------------- ZDNET ANNOUNCEMENT 9/10/97 ---------------------------------------------------------------- Two-week FREE trial offer on Computer Magazine Archive. ============================================================ http://www4.zdnet.com/chkpt/zdna970910001/cma.zdnet.com ============================================================ Make your Web research more productive with ZDNet's Computer Magazine Archive--an extensive collection of computing articles online. CMA is a powerful database of over 100,000 full-text articles and abstracts from the industry's leading publications. Find articles related to product reviews, your competitors, the latest IPO, acquisition, or merger and just about anything else related to high-tech. With informative articles from over 80 of the industry's leading publications, everything you need for researching the computer industry can be found in Computer Magazine Archive. Now your research on the Web can be quicker, easier, and more focused. Now you can try Computer Magazine Archive FREE for two weeks. Simply point your Web browser to: http://www4.zdnet.com/chkpt/zdna970910001/cma.zdnet.com to start your search right now. ============================================================ http://www4.zdnet.com/chkpt/zdna970910001/cma.zdnet.com ============================================================ _______________________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: announce-off(a)lists.zdnet.com You can leave the subject and body blank. _______________________________________________________________ Powered by InfoBeat: http://www.infobeat.com ===============================================================

1 0

Re: NSA and Netscape Crack
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:46 PM 9/19/95, Jim Ray wrote: >In the relatively short time I've been on this list, Cypherpunks >have bruted, and then found a weakness in, two kinds of Netscape >software. >[A fine public service, IMO. Congrats to all involved.] > >I don't expect to know NSA's specific brute-force capability, but >does anyone know if the NSA has *ever* found a glaring weakness in >software and then told its author(s) or owner(s) about it? Do "we" >perform the "COMSEC" role Tim was speaking of better than the NSA? Indeed, Jim is underscoring the point I was making, facetiously, that the NSA has abandoned all pretense of helping to actually secure commercial transactions (and no, I wasn't referring to Clipper...rather, I was facetiously referring to the short-lived Commercial COMSEC Endorsement Program, circa 1988-89). As I said in my message, I don't _want_ the NSA or NIST (the same, really) to be vetting commercial encryption. But I also don't want them claiming a role in securing commercial encryption when they clearly are not even doing as much as the Cypherpunks are doing. By the way, if we count our own Matt Blaze's work on exposing weaknesses of the Tessera/Skipjack/Clipper (they blur together) card as a "Cypherpunks achievement," then the Cypherpunks have actually played a dominant role in cracking these recent standards. (Not to mention the RC4 code postings, the various Cypherpunks involved in the RSA-129 and "BlackNet" factorizations, etc.) Well done, of course! --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Please send me SSL prob
by Joe Tardo 17 Dec '03

17 Dec '03

Reply to: RE>>Please send me SSL problems... Jeff: The name chosen for SSL was, perhaps, unfortunate and misleading, but should not get in the way of the kind of service it provides. I keep combing the spec looking for socket-like api's, and so far have not found any :-). > I've looked at >what it takes to make some existing protocols work with SSL, and I'm not >convinced that its always appropriate. For example FTP and RCMD use >multiple connections, which is a royal pain. Doesn't HTTP use a new connection for every GET? > If a secure IP standard emerges that is widely deployed and provides >similar services, I don't see why SSL couldn't just go away (this is my >opinion, not an official position of netscape). The ipsec people are currently debating what it means to do replay detection on an unreliable datagram service, what it means to authenticate individual users in a layer that only knows how to name host endpoints, how a protocol specification deals with how policy would be set for mixed encryption service requirements, etc. This is not the first time these points have been debated in the history of the universe, nor the first attempt at a 'one size fits all' security protocol. I, personally, would not be too quick to expect IP security to solve all of your problems, but it will do a better job on, say, host-to-host disclosure protection. It will, however, require new kernel code or low-level driver or hardware hacks, which simultaneously provide the better protection and a barrier to security deployment for a product like Netscape's. Now, how about fixing SSL's keying so it has perfect forward secrecy? -Joe

1 0

Re: Patents and trade secrets was: Encryption algorithms used in PrivaSoft
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

> But don't they have to put something on the patent application? Can they > claim trade secret status for something that was on a patent application, > but rejected? That seems like they're getting it both ways. At this point, in this country, a patent is secret until it is issued. It is interesting to note that the process of issuing a patent can take an indefinite period, and to some extent it is in the control of the person seeking the patent. The typical slimy thing to do is to file for a patent, and keep it a trade secret too. Delay the issuance until somebody discovers your secret, then allow the patent to be issued. This is called a "submarine" patent. It allows the best of both worlds, and extends the patent as far in to the future as possible (17 years from issue date, in this country, regardless of filing date). You can delay the patent's issuance by continuing to file amendments to it. Gilbert Hyatt's recent patent on microprocessors is the classic example. Now, this is all expected to change, to become more harmonious with the rest of the world. The changes that I've heard are 1) Go to first-to-file instead of first-to-invent 2) Life is 20 years from filing date, instead of 17 years from issue date 3) Publicize patents some fixed time from filing date, say 1 year As you can imagine there are armies of lawyers on both sides of the issue, so I don't think that you'll see any changes in the law any time soon, but you never know. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-8624

2 1

Re: GAK patents, anyone?
by Sean Roach 17 Dec '03

17 Dec '03

At 01:34 AM 9/9/97 +0200, Anonymous wrote: ... >----- >http://www.uspto.gov/web/offices/com/sol/notices/terrog.txt >----- > >Petitioning to Make Special Patent Applications Relating to >Inventions For Countering Terrorism > >New patent applications are normally taken up for >examination in the order of their effective United States >filing date. However, the Commissioner may provide that a >patent application will be advanced out of turn for >examination if a petition to make the patent application >special under 37 CFR 1.102(c) or (d) is granted. > >On July 31, 1996, Vice President Gore stated that "[i]t is >imperative that those seeking to prevent terrorist >activities have all of the tools necessary to accomplish >their task." In view of the importance of developing >technologies for countering terrorism and the desirability >of prompt disclosure of advances made in these fields, the >Patent and Trademark Office is establishing a new category >for petitions to accord "special" status to patent >applications relating to counter-terrorism inventions. >International terrorism as defined in 18 U.S.C. 2331 is >"activities that >(A) involve violent acts or acts dangerous to human life >that are a violation of the criminal laws of the United >States or of any State, or that would be a criminal >violation if committed within the jurisdiction of the United >States or of any State; (B) appear to be intended (i) to >intimidate or coerce a civilian population; (ii) to >influence the policy of a government by intimidation or >coercion; or (iii) to affect the conduct of a government by >assassination or kidnaping." ... Back up just a minute. Aren't inventions protected if the patent is pending? If not, why do such well known companies who undoubtly have savvy legal council produce products stamped "patent pending"? Is this just a way of forcing those who take this special treatment to bow to additional government restrictions? An action which they would have to do as if they didn't, a competitor might get the inventors idea patented before the inventor? Sounds more like a manner to place certain inventions that are crucial to "national security" under tighter regulations. How long before they expand the definition? Because, if they impose additional contractual conditions upon the advanced patent, this could mean that crypto could be regulated constitutionally in the future by regulating who the inventor could share it with.

1 0