December 2003 - cypherpunks-legacy

Re: Exporting software doesn't mean exporting (was: Re: lp ?)
by Peter D. Junger 17 Dec '03

17 Dec '03

I did say that I would discuss the apparent disagreement between Mr. Froomkin and myself on the issue of the seperation of powers and the validity of the ITAR. But, since I think that we were rather at cross-purposes and not in any real disagreement--and since the subject is a fair distance from the core concerns of this list--I will keep this response short. The first place where Mr. Froomkin and I got at cross-purposes was when I said: I would admit that a court might do this in an effort to hold the statute constitutional, but a court might also hold the regulations unconstitutional because they are overbroad. And Mr. Froomkin replied: Technically, this is holding the regulations ultra vires, not unconsitutional; the difference matters. which, at first, rather confused me, until I realized that in my haste I had been assuming--since I automatically think of constitutional challenges to the ITAR in terms of the first amendment--that the ``unconstitutionality'' in question was that of violating the first amendment and was applying the first amendment doctrine of ``overbreadth'' to a constitutional challenge that might have been based on some other ground, like ``lack of jurisdiction'', and yet Mr. Froomkin's response seemed to relate to my separation of powers argument, which can, of course, be quite properly be called an ``ultra vires'' argument. I think that it was my failure to keep the different strands of my various arguments separate that is responsible for our apparent disagreement here, and for that I apologize. But I do think that Mr. Froomkin is wrong in claiming that holding the regulations ultra vires is not the same as holding them unconstitutional. (I agree, however, that if one were to challenge the regulations in a proceeding in the nature of quo warranto brought under the Administrative Procedure Act, one would probably not talk about the regulations being ``unconstitutional''; on the other hand, I also have my doubts about whether one would use the phrase ``ultra vires'' in such a proceeding.) When a defendant in a criminal case raises the defense that the regulations he is charged with violating are ``ultra vires'' because Congress did not authorize them, that most certainly is a constitutional issue, involving the supremacy clause, the due process clause, the ninth-amendment, and the doctrine of separation of powers. But perhaps I still misunderstand what argument of mine--or that I appeared to make--was the one to which Mr. Froomkin attached the ``ultra vires'' label. In any case, I want to thank him for doing so, because it brought home to me the important fact that it is possible that the ITAR provisions relating to cryptographic software could be struck down, not because they violate the first amendment, or would violate it if passed by congress, and not because the court is trying to dodge the difficult first amendment issue, but simply because the provisions are not authorized by any legislation. In any case, my separation of powers argument appears in Junger, Down Memory Lane: The Case of the Pentagon Papers, 23 CWRU L. Rev. 3 (1971). After counting noses in the Pentagon Papers case I concluded that the the only position that arguably was agreed to by a majority of the justices in the case was that the injunction that the government sought was not authorized by Congress, and that therefore the government was not entitled to the relief that it sought. And I suggested that this meant that the court never determined whether Congress could have passed a valid law authorizing the ``prior restraint'' in such a case. And finally I suggested that that was not a bad way of avoiding a difficult constitutional question under the first amendment. (Or at least that is a thumb-nail sketch of how I read the article now.) With this explanation, I don't know whether Mr. Froomkin would persist in his statement that: It's too far off topic to pursue any further, but I must take exception to the suggestion that we are well served by separation of powers intruding into other legal domains. Bowsher tells us that causation principles go out the window in SOP cases. That alone makes it radioactive. I must admit that I don't know what it is that he is refering to. -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu

1 0

Re: Lotus Notes RSA Implementation Question
by Charlie Kaufman/Iris 17 Dec '03

17 Dec '03

>If anyone on the list has knowledge of the following items, I would be >very gratefull. > >1) What is the key size used by the USA licensed version? > Notes V3 (the one currently deployed) uses 512 bit RSA keys in both the USA and exportable versions. Notes V4 (currently in Beta) uses 512 bit RSA keys for encryption in the exportable version and bigger keys for signatures in all versions and for encryption in the USA version. I'm not sure I'm allowed to say what the key size will be ahead of the product shipping. >2) Considering RC4 is a proprietary scheme, have there been any >concerted efforts to validate it's strength or lack of? If so, could >you give a pointer to any documents I could review. > There has been considerable discussion of the security of RC4 on this list, and some subtle (i.e. worrisome but not disasterous) weaknesses have been found. Lotus Notes' use of RC4 is not subject to the weaknesses disclosed to date because it does not encrypt recognizable plaintext with the first few bytes of the RC4 stream. >...Bob Glassley > --Charlie Kaufman (charlie_kaufman(a)iris.com)

3 2

Re: the revolution of microcurrency
by Thomas Junker 17 Dec '03

17 Dec '03

On 9 Nov 95 at 15:47, Vladimir Z. Nuri <vznuri(a)netcom.com> wrote: > Subject: the revolution of microcurrency > the topic of "microcurrency" has come up on this list > ...<snip> > touting it as a revolutionary change in the economy. I > ...<snip> > agree with this wholeheartedly. the possibility that > people can > ...<snip> > will all contribute to a REVOLUTIONARY effect on culture. > my key idea on all of this is that the whole idea of > copyright is going to melt when you introduce cash, not > be strengthened. I don't think so. > there are a lot of people out there who > think that one has to try to put a lock and chain on web > pages or whatever that one is "selling", and the > horrible problem of the net is that anything can be > copied. and these people are feverishly working on > specious "solutions" to this "problem" right now. What's happening is that while some people try to impose book and magazine notions onto the Web, others gleefully splatter the landscape with everything from the interesting to the awful but are generally stopped short of making a living at it by the absence of workable means of asking for and receiving nominal sums. Meanwhile, some other people are realizing that today's $30/yr newsletter of 20,000 circulation will become tomorrow's 25-cent-per-copy newsletter of 2 or 3 hundred thousand "circulation," making more total money and reaching and influencing far more people. A much larger volume of information will be worth a penny or less for a peek. When those transactions become close to transparent and of unnoticeable latency, *then* we will see the explosion that will put present Web growth into perspective as the baby crawl that it is. This doesn't amount to putting locks and chains on Web pages any more than newsstands put locks and chains on newspapers or magazines. When it's cheap enough and the transaction is a no-brainer, the buyer gets easy access while the publisher has reason to be there publishing, and neither worries too much about the value of the single copy. > says, "you have to protect what you are selling from > other people or you won't make any money". this theme No, the point is that you have to have a way of making something or you won't have any incentive to generate the information or make it available to others. The news for today is that the way of making something on small amounts of low-value information is almost at hand. > I submit that things like the release of public domain > standards and products like Java and Netscape for free > are not merely blips at this moment but increasingly are > going to be the marketing plan of the future. the idea is > that you give away your product for FREE, Standards are not the product. Standards are what help make a market possible for products that must interface with other products. The closed-system people may have seen this in the momentary light of their extinction. > and then people pay you if they like it. Don't hold your breath. > this new ideology will be relevant to products that are > not "things" but in fact are more in the realm of > intellectual property, i.e. writing, software, > cyberspace web pages, etc. Intellectual property is not new. What's new are distribution and fee collection systems with the potential for incremental costs approaching zero. Most of the infrastructure for that is in place, in fact has been in place for quite a few years. What has been missing has been the critical mass of users actually participating, and near-zero cost payment mechanisms. I'm spectacularly disappointed by the initial ecash and payment offerings, since they seem to miss the whole point and be aimed at web-transacted business no different that the high-overhead transactions that take place face-to-face in retail stores and by phone and mail. > the beauty of this system is that NO LONGER is > "unauthorized" distribution" the "enemy". it is your > FRIEND, a key aspect of profit!! Freely-distributable shareware has been around for 10-15 years, and has grown from being the computer field's butt for bad jokes to a maturing distribution methodology that supports an increasing number of author/publishers offering some quite substantial and solid products. It did this, by the way, without substantial benefit or contribution from the Internet or the Web. > product to "authorized users". (i.e. those who pay in > advance). our entire society thinks within this paradigm, A big part of what is happening with microtransaction evolution is that the buyer will be able to consider, decide, and pay, all in the space of a second. You can forget about anything based on paying in "advance," and all those draconian mechanisms -- they won't exist because they won't need to exist. Instant payment at very low prices collapses whole ranges of problems that no longer need be addressed. > a rather extraordinary new economy can replace this, > that of voluntary payment. We have "voluntary payment" now in most transactions not involving the government. > you DISDAIN things like copyright, because they prevent > your "product" from reaching the eyes of potential > customers. your goal is actually to distribute the > product as far as possible, in a sort of pyramid-like > scheme. you want your "customers" to distribute your > product to their friends, so that those "friends" > potentially become customers in an endless cycle. You don't actually collect anything, though. I guess you make it up in volume, right? > this approach works amazingly with writing. imagine that > if John Markoff suddenly QUIT the NYT and just wrote > articles on his own. and imagine that at the bottom, you > see a message, "for more of the same, send .5c or more to > markoff(a)liberated.com". I submit that in the future, > Markoff will probably be able to make more money than he > does at NYT, because he is eliminating the middleman. the > newspaper company is primarily built as a *distribution* > channel. suddenly he doesn't have to pay anything out of > his own salary, so to speak, for distribution. > distribution is *free*. he doesn't require anyone else > to do it for him. he puts his article in an apropriate > place on the net and it circulates like a VIRUS if it is > well received. the more people that see the article, the > more people that pay him money. You've got *part* of an idea here, but it's mixed up with another idea. It is already common for people with service or product to sell to offer "free" information in the form of articles, papers, small utilities, demos that may actually have some use, and occasionally, fully functional products. In the field of intellectual property in the electronic age, the incremental cost of a copy approaches zero, so there is no great investment in doing this. There is, however, always something larger FOR SALE, something that is being promoted by the favorable exposure. What is being given away is not the final product one hopes to sell -- it is a loss leader, something that in the field of information costs precious little to run off. > in an information system, individual objects have no > value. what has value is the FLOW of quality information. > if Markoff continues to flow with that good information, > people will continue to pay for it. they will perceive > that "by paying him, the quality information flow from > him to me continues or increases". People as marketplace players do not think like that. > this same idea works with software. you don't see > software as an end product. you see it as something that > is evolving over time. and whenever you send money to a > company for software, in this new system the idea is that > "I like this software, and I want to see it grow. here > is my contribution to that". People as marketplace players do not think like that. The way some of them *may* think is, "I like this product; it will evolve; my payment for a $1 license today entitles me to new versions for a year; so this is a Smart Move." <click!> Also: "I like this digest article. I like the way this author thinks and expresses himself. It's a no-brainer to pay 20 cents for a copy of his full newsletter." <click!> > another interesting area is that of patents, and I see > this dissolving in the same way. a patent is like trying > to put a lock on an idea. but gradually people will > realize, only ideas that are implemented have any value. > you can't profit and lock an idea at the same time. "Lock" and "no value" are not how patent is generally viewed. Xerox, Polaroid, IBM, Dow, duPont, et al would be amused at your view. > *dissemination* of ideas is what leads to profit, not > locking them up. You first. Dissemination of *something* leads to exposure, establishment of credibility, *reputation*, in a word. That, in turn, gets you in the door for actual sales, whether of yourself, your funding proposal, or your actual product or service. *That*, in turn, *may* lead to profits, assuming you have a whole bunch of other ducks in a row and manage your business well. > hence there will be an economic incentive to an inventor > to give away his ideas for free, at first. Yep, yep, I'm sold, just show me where to dump all these great ideas so I can get rich, quick. > in the old system, where one thinks of an idea as a > "thing", this sounds preposterous. Uh, um, in a word, "Yes." > but in a new culture where ideas are seen as things that > need to be cultivated and grown to work, it will seem > eminently sensible. the inventor is releasing his idea to > the world, saying "I can expand on this idea, even turn > it into a reality, if you send me money". It was late, right? You'd been up for a long time, right? You were getting the aching-back, numb-fingered madrugada sillies, right? You mailed this in the afternoon because you'd slept it off by then and forgotten what you'd written, right? > other people can of course steal the idea, but > there is no value in the idea itself: No, of course not! > the value is in the development of it Which only the originator can do, of course. > into evolved new states, or the intellectual expertise of > the inventor. Yeah, history really shows this to be an effective principle on which to peg the survival of inventors. > in short, microcurrency could have quite a liberating > and revolutionary effect on economics as we know it. Yep. Liberating it clear away from planet Earth. Revolutionary, as in, "orbital." > in the current system, people are not paid for tiny > contributions to the whole. the contributions have to be > "packaged up" into something like a magazine before > individuals can get any profit. a new system may allow > people to be compensated directly for things that are > hard to quantify. This *is* part of the point, V. Physical manufacture and distribution of printed magazines have inherent floor costs and necessary economies of scale that are blown away in electronic media on the Web. Just plug in a way for quick and easy micropayment and the real revolution will be off and running. > how much was Markoff's last article worth in the NYT? > that's impossible to figure out. but if you had a > microcurrency, you can calculate exactly how much money > people sent to Markoff for his last article. say, across > the world, it totalled $843.16. such a sum is not > inconceivable. and over time it would be enough for him > to make a salary over the whole year on, perhaps!! I'm > arguing that this is increasingly going to become VIABLE > over the next few years with cyberspace and > microcurrency. Yes, but not with payment after the fact on the honor system. Sit down with *any* of the numerous vendors from whom you presently buy living space, food, municipal services, phone service, Internet access, car repairs, etc., and try convincing them that you should get the product first, and if you like it you will pay. Later. Right. > the microcurrency situation can even be set up in a > company. "whoever codes this computer problem will > receive [x] dollars from the company". the whole economic > system becomes a fluid, pulsing entity that filters down > to the tiniest fraction of value and gives each > individual a quantitative value on his contribution. > companies talk about "incentive systems" today, but > perhaps the entire economy will become an enormous > incentive system in this way in the future!! I believe this is called "The Free Market," and it has little to do with any concept of "pay what you think it's worth after you use it." The Internet is exploding in part because it is the *only* free market in the world, though a market in tenuous and vaporous ideas and information propagated for many reasons other than direct pecuniary benefit. A micropayment mechanism will allow the net to mature into a fully functioning free market in information and services of value on which many of the participants will support themselves. Many of those products and services do not presently exist as such. "Companies" will be quite virtual and non-geocentric, and will form and disband in the ether. Too, everyone's low-cost opinion soapbox will sprout a 1-cent sign on it, and the ones with something to say that others want to read will make something on their expression of thoughts, research, and other information while the ones no one cares to pay for will wither or preach to themselves. > in this system, ultimately, I think the whole concept > that someone "buys a product" will dissolve into the > idea that "one rewards intellectual productivity to bring > more of the same". it's as fundamental and intuitive as > the difference between atoms and bits. I disagree. I believe you're right about the imminent revolution that will take off when the micropayment mechanism falls into place, and several of the underpinnings you present in support of that view, but I think you've misread what this is about and where it's going. The crypto relevance is that everything is in place for profound new growth in a new form of commerce, awaiting only an effective mechanism that will allow one to make a fraction-of-a-second decision and click on something to at once authorize a micropayment and navigate somewhere. Web page designers will work out how to best use it and how to package the information it buys. Storable pre-authorization tokens would be nice, so that one can make a decision that persists through subsequent accesses and only pops up for review if the price changes. And it's got to be smooth enough for Grandma to use it. ------------ http://www.phoenix.net/~tjunker ------------ | Your freedom is on the auction block. What do you bid? | --------------------------------------------------------- Unofficial Wang VS Information Center

1 0

Re: Who needs time vaults anyway?
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:15 AM 11/11/95 -0700, bryce(a)colorado.edu wrote: >I don't really understand the use for "can't be opened until >Christmas" tricks. If you don't want anyone to see your info until >Christmas then just don't give them a copy until then! If you want >to prove that you have it but not let them see it until later then >do timestamping of hashes, zero-knowledge proofs and so forth. For instance, suppose you want to give someone digicash on a certain day (like a bond from your bank...) Or leave a will, which nobody can hassle you about while you're alive. Or (as an extension of both) a trust that can't be spent until some time certain in the future, like when you want to pay Alcor to thaw your carcass out. For the more realistic case, bonds, you want to be able to give them the bond so they've got it in their hot little hands, but can't cheat by spending it. In a normal business relationship, where all the parties have names of some sort, this isn't so tough; it gets harder when some or all of you are pseudonyms... #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Re: Lotus Notes RSA Implementation Question
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:13 AM 11/11/95 GMT, bglassle(a)kaiwan.com wrote: >>Notes V3 (the one currently deployed) uses 512 bit RSA keys in both the USA >>and exportable versions. Notes V4 (currently in Beta) uses 512 bit RSA keys for >>encryption in the exportable version and bigger keys for signatures in all >>versions and for encryption in the USA version. > >I would assume since they are using a key size >40 bit, it is used for >authentication only, not for data encrytion, that would skirt the ITAR >regs. If fact according to the docs, there is no data encryption when >connecting to an international version server, regardless of the >client version. RSA keys get to have more bits than symmetric-key encryption, because they're easier to crack and you typically use them for different things. The permitted length seems to usually be 512 bits for RSA and 40 bits for decent-quality symmetric cyphers (as opposed to easy-to-crack proprietary cyphers, which may be longer if they're wimpy and the NSA's in a good mood.) Your mileage may vary, of course. >My understanding was that the problems exposed with RC4 that you >mentioned, were with the particular implemenation by Netscape. There were two different problems found. The first was a straightforward brute-force crack on 40-bit RC4 (RC4 lets you choose key length...) While it did have known plaintext near the beginning of the message, having it _anywhere_ makes it crackable, with a bit more work. The second problem was a Netscape-specific use of low-quality random numbers to pick the RC4 keys. But the first crack was the real thing. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

RadioMail and chaining remailers
by anonymous＠robo.remailer 17 Dec '03

17 Dec '03

Hello All, I am planning to purchase a HP200LX with a wireless modem with the RadioMail system, My question is. Does the RadioMail software allow chaining of messages for remailers? Is there other crypto applications for the HP200LX's Thanks in advance! Liam

1 0

Yvette
by tony266＠vabeach.email.net 17 Dec '03

17 Dec '03

I'm wondering if Yvette from Smithfield, Va is as fine as most people say she is...

5 4

Noise and the Zen of making it go away
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: cpunk(a)remail.ecafe.org (ECafe Anonymous Remailer) Subject: Win95 A Hacker's Net Dream Windows 95 Is A Hacker's Dream Over The Internet >Central, Hong Kong, Nov 9 (NB) -- Windows 95, combined >with the Internet, could be a dream made in hacker >heaven. From seasoned propeller heads Newsbytes has >contacted, it looks like Windows 95 could be more of >a security nightmare than was first thought. [snip] From: an407769(a)anon.penet.fi (jerry the golden retriever) Reply-To: an407769(a)anon.penet.fi Date: Sat, 11 Nov 1995 06:29:46 UTC >Windows 95 Is A Hacker's Dream Over The Internet >CENTRAL, HONG KONG, 1995 NOV 9 (NB) -- Windows 95, combined with the >Internet, could be a dream made in hacker heaven. From seasoned propeller >heads Newsbytes has contacted, it looks like Windows 95 could be more of a >security nightmare than was first thought. Gee, somebody not been reading the list lately? I think it's true, the list has become the fast lane to dump junk into. Re the idea of making cpunks subscriber only- that would solve a few problems, and people could post anonymously if a seperate address were rigged up ("security through obscurity") as a subscribed address that throws away anything from cpunks and forwards everything else to cpunks. The idea being, of course, that if you're not close enough to the action to know what the current anon-routing address is, you should go away. At least the bulk of the conspiracypunk stuff has gone away. Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMKR6icLa+QKZS485AQHiFQMAlil+qYChoLhIkqxjlTvSiZacgHPHAGOx BnauPARLTrO/MelBq2/p4gLkiYGBN6Z4Ut5wy0kZVpkRlDcDPewnhOEMZHZMZAsM JbI79tkVZrTGTRUmwBQ2GlKctYbayodC =HQsn -----END PGP SIGNATURE-----

1 0

mailing list.
by David.Y＠freedomnet.com 17 Dec '03

17 Dec '03

Please put me on your mailing list, thanks.

1 0

Re: DejaNews all over again
by rah＠shipwright.com 17 Dec '03

17 Dec '03

> Jeff, I think it's in your best interest to not waste your time >responding to this moron (who bears many features in common with >Detweiler) Except for his esteemed "credentials", of course... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0