December 2003 - cypherpunks-legacy

Re: IPG message
by John Pettitt 17 Dec '03

17 Dec '03

At 02:58 AM 3/20/96 GMT, ECafe Anonymous Remailer wrote: >could some kind person that got IPGs' many time pad thing post it >somewhere so people that never got a copy can see it???????? > > > >thanks. > > > > > > > IPG wrote: Obviously, you meet our requirementsfor the release of the IPG ABC Encryption algorithms. We need no further information from you. though we would appreciate your telephone num and snail mail address. The algorithms detailed below are copyrighted 1995 and 1996 by Internet Privacy Guaranteed, Seymour, TX. All rights are reserved. You may not provide them to any other party, or parties, by any means or any media, without the expressed written permission of Internet Privacy Guaranteed. What is specially claimed as copyrighted and or patentable are: 1. The use of the word Ultima for the system, because it is impossible to have a either a more secure system - it is impossible to break the Ultima system, other equally difficult to break systems may exist, or may be formulated in the future, for example a true OTP, and in those cases, they may "theoretically" be more difficult to break than the IPG Ultima System, for example a true OTP. However, that would exist only in theory, because in those eventiualities, none of the systems would be breakable. Furthermore as to speed, Ultima, or simple variations, XOR, OR, or AND, instead of the Add or Subtract, is the fastest possible algorithm which will produce an unbreakable encryption system, without having a single OTP byte for each byte of plain text to be encrypted, as in an OTP. However, with the IPG system, we can obtain the same speed, or theoretically faster speeds than a pure OTP, with some very simple parrallelism - and that begs how you get humoungous OTPs to use, both in terms of generating them and getting them into a stream to be XORed against the plain text. That FACT, that the IPG algorithms are the fastest possible encryption system which will become evident when you examine the algorithms in detail. Thus it is impossible to produce a better system, in terms of either security or speed, thus we call our system Ultima, the ultimate. 2. The use of the term ABC Encryption algorithm that at once describes the basics of the system and its simplicity as will quickly become evident. 3. The use of a hardware generated OTP, which serves as a purely random seed, for the system to be described. 4. The use of a table of prime numbers, any number of which is greater than 3, from which random selections are made to be used in the algorithms to be described. The prime numbers for the system described have been selected for a specific hardware, namely the IBM PC clone, market. With other 16 bit, 32 bit, or 64 bit hardware, other prime numbers could be used to provide immediate results just as in the system to be described. The use of larger numbers, the use of larger adders, or logic gating systems, is self evident in the copyrights/patents. 5. The use of a random 8 bit seed for the dynamic vaiable that links the sets of equations into one system. This variable, D, for dynamic is the real key that distinguishes our system from any other system - excepting hardware implemented systems that use extremely large numbers, and or possible partitions, that encompass possible meaningful message lengths. Such systems, are self evident extensions of the simple IPG system. 6. The use of partitions within one OTP, pure random seed, PRNG stream - either by using parts of the random seeds, or more likely by using fixed intervals within the PRNG stream, for example, arbitrarily say every 100 gigabytes, or 100 terabytes for that matter. Using this technique, one random seed can be used for any abritrary period of time, one message, 10 messages, one day, one week, one year, one century, one millenium or whatever. The use of multiple Ds, in linear partitions, that is within one otp every terabyte fior example, is a self evident extension of the IPG system. 7. The use of a simple serial hardware implementation of the IPG system is self evident, and produces impressive speeds, mutiple megabyte per second, dependent of course on hardware speeds. 8. The use of a very simple single level of parallelism in hardware implementation, where the ABCs are computed in parrallel, and the D is passed along, is a simple self evident extension of the system and will allow a throughput of over 100 megabytes per second, on state of the sart hardware. 9. The use of a three dimensional parallel system, where the PRG stream is chopped up into several partitions, say every terabyte, and then each module proceeds as in paragraph 8, just above, is a simple extension of the basic IPG system, a would enable a system to operate at any conceivable line speed. 10. The changing of the number of equations, modules, prime number values, length of prime numbers, or length of random sample, probe values, or the other algorithmic values does not change the basic algorithm. It is the same algorithm with different values. With the previously detailed claims relating to the copyrightable and patentable features of the IPG algorithm system, IPG prersents the the Ultima Algorithms. - the ABC Encryption system. Given: 1. A 1792 BIT OTP, RANDOM SEED, generated from a hardware source. 2. A Table of 319 Prime Numbers in the range of 6,667 to 11,997, out of the 580+ available, the 384 selected for dynamic variance, the table is called BPRIMES. 3. A Table of 319 prime numbers in the range of 14,007 to 19,997, out of the 800+ available, the 384 selected for dynamic variance, the table is called CPRIMES The 1792 bits of OTP, Random Seed, are allocated as follows. 1. 512 bits for the 64 probes, for 64 C vales 2. 512 bits for the 64 probes, for 64 B values 3. 512 bits for the 64 starting A values 4. 8 bits for the initial ID value. Those 1544 bits are the actual random seed used for generating the PRNG stream, if you insist on calling it that. In addition, there are 248 bits used as follows. 5. 128 bits for the offset, partition, if applicable into the PRNG stream. Actually they are used to encrypt the actual underlying value of the partition, if any - note - in this case the mode is actually a true OTP, the first time only ot really does not help to know the offset unless you know the OTP, Random Seed. 6. 72 bits for uniquely identifying the OTP being used. 7. 48 bits as spares temporarily - can be used as different D values for partitions. If more As, Bs, Cs, are needed the random seed, OTP, can be expanded as necessary. Unlike RSA, there is no practical limit - I am actually sending you 1792 BYTE Random seeds, so that you can test other variations if you like, or use each of them, there are 32 of them in all, as 8 random seeds for the 1792 bit algorithm. 8 bit random starting A values are sufficient because we are only talking about the effect on the low order 8 bits in our PRNG stream. We actually AND these values with the constant 13,568 to give us a start that will intially have a dynamic effect on the A, B, and C values, that is the smallest possible B+13568, exceeds that largest possible C value. This selection process of course makes the A, B and C values random, 8 bits, as well as the initial ID value - the random range of each set is 2 to 32 but as you will see they are interlimked with the Dynamic variable, D. The procedure is as follows: 1. Using the 64 bytes for B selection, we select 64 Bs, B1,..,B64, as follows. B1=BPRIMES(SB1) WHERE SB1 is the first byte of the Random Number Seed, thus B1 is one of the BPRIMES, BPRIMES(0),..BPRIMES(255) then BPRIMES(SB1)=BPRIMES(256) then B2=BPRIMES(SB2) AS BEFORE EXCEPT Byte 2 of the OTP, Random Seed, is used. then BRPIMES(SB2)=BPRIMES(257) and so forth through 64 Thus you have 64 constants, B1,..,B64, each of which is an unique prime number. This of course, is the same as a lottery selection, except there is no denominator and the section pool does not shrink. Thus you have 1 in 2 to the 512 possibilities of a repeat, or guessing the selections. 2. The same procedure is used for selecting 64 C values, C1 through C64. 3. The 64 starting A byte values, from the random seed, are ANDed to 13,568 to give the 64 starting A values, random, at least 8 bit random. 4. 8 Bits are used for the starting D value Thus the B and Cs are constants - the As and D changes Then quite simply, you have 64 equation sets as follows. A1=(A1+B1) MOD C1 (Move, Add, Compare, Conditional Subtract) D=(D+A1) AND 255 (Really just use DL in assembly language) + A2=(A2+B2) MOD C2 D=(D+A2) AND 255 .............. + A63=(A63+B63) MOD C63 D=(D+A63) AND 255 + A64=(A64+B64) MOD C64 D=(D+A64) AND 255 the XOR operation against the plain text may vary. In our case, we accumulate a pair of DLs in CX, and then XOR it against a wor, two bytes of plain text. Thus we have one XOR for each set of two equations above, 32 XORs for the 64 equations. We string A1 type 8 sets of those 64 equations together, essentially duplicates of each other except for the XOR operation, which are constants, as opposed to indexed variables. Thus we do a disk sector at a time, with only the A values and D being variables. With double buffering, you can see that it cooks, to say the very least. Obviously by definition, there can be no repeat before the product of the C values, that is (C1*C2*C3,..,*C63*C64), and that does not take into account the starting A values and the starting D value. The average C value is slightly over 14 bits. Accordingly, no repeat is possible before 2 to the 864th power,minimum, or 2 to the 896th power average, 10 to the 267th power minimum, which will handle anything that can possibly occur, ever, ever, ever. If every atom in the universe was a Googol of Cray T3E's and they had been computing since the big bang, the possibilities they would have tried so far would be less than 1 part in 1 Googol. And that does not take into account the other 2 to the 1543+ possibilities. There is absolutely no way to prove that any message of any possible length is or is not possible, without trying all of the 1 to the 470th power possibilities, which of course is impossible. As John von Neumann once said to Dr. Bloome (Dottie), in my presence - it in a similar but totally unrelated case, it is not enough to say that it some theoretical message may not be theoretically possible, you must prove that at least one specific message is not possible. Of course, like JvN's case, that is not possible in the case of the IPG system. Continuing along that line, we in recognize that because we are working with a 1544 bit key, over 2 to 1543, but someewhat less than 2 to the 1544, that we only have approximately 10 to the 478th possibilities, that is 2 to the 1543+. Thus with a 125,000 byte message, we do not have 2 to 1,000,000th possible keys, but only 2 to the 1544 possible PRNG streams. Having said that, and fully recognizing that as incontrovertible, we invite you to test a long PRNG generated stream by the method, using a truly random seed of 1544 bits. You will find over both short and long sample sizes that the "effect" is indistinguishable from an OTP of the same length. To facilitate this, we are including herewith: I combined all these files listed below under BSD UNIX with the zip program so you shouldn't have any problems extracting them. If you do, please get back in touch with us and we can re-send the file under a different format, PKZIP. Note: The zipped files are considerably larger than the original because they are random unzippable data files. I promise you that with these, you can write the program to generate the PRNG streams in somewhat less than two hours. I am referring to the 64 sets of the equations set out above: This approach will also demonstrate how incredibly fast the system is and also how incredibly secure it is. Therefore, please find attached in the zipped file BINARY.ZIP consisting of: 1. BPRIMES.DAT - 384 prime numbers used for randomly selecting the B1,..,B64 values in what we are now calling the 1792 bit system - I am including 384 instead of 319 in case you want to try variations.. 2. CPRIMES.DAT - 384 prime numbers used for randomly selecting the C1,..,C64 values in the 1792 bit system - again 384 in case yopu want to try variations. 3. 32 - 1792 BYTE Hardware generated OTPs, specifically OTP.001,..,OTP.032. - any of these may be used in the 1792 BIT system, or the 5600 BIT system, or the 12288 BIT system. Further, any of the 32, can be used for other possible system configurations. The L1792 BYTE OTPs, can also be broken down into 8 - 1792 BIT OTPs. With these variables, you will not have any problem doing any kind of test that you may desire. As a prelude, consider, if you will, the 1st 64 bytes of the PRNG stream. 1. Byte 1 D is random A1=(A1+B1) MOD C1: is where A1 is random, 8 bit, and B1 and C1 are randomly selected from a table of primes and become a constant for that OTP, random seed. THE resultant A1 is some indeterminate number between 0 and C1-1. A1 MOD 256 is therefore likewise some random number between 0 and 255. There are 16,677,216 possible variations, and only 1 is the actual. ID=(ID+A1) AND 255. ID is random and A1 is pseudo random with 16,677,216 possible variations. Accordingly: by definition the new TD is random. Now therefore: if D was used for only this equation, there would only be 2 to the 32nd possible, 8 ID - 8 A1 - 8 B1 & 8 C1 possible variations and what you would have would be a system partioned into 64 didfferent subsystems. However, that is obviously not the case, D is passed from one equation set to the next, so there is no repeat possible until at the very least ID short of the entire C1*C2,..*C63*C64 cycles. 2. Byte 2, The process is the same and the resultant ID is random. The process is the same for all the other 62 bytes. Accordingly, how is it possible to determine the first 512 bits of the PRNG stream? That is 10 to the 158th power possibilities. Obviously they cannot all be tried - and any of the possible 2 to the 512th power of underlying clear text is possible. As stated, the reultant system is absolutely unbreakable - no ifs, no ands, no buts, no maybes, no anything. Also, as you can clearly demonstrate for yourself, there is no more robust system, with respect to speed, possible. It is truly Ultima, the ultimate system, as you will find out for yourself. Enough, I assume. After you have satisfied yourself that the ABC Encryption system is absolutely unbreakable and the fastest system possible. We will proceed to the demonstrate that the Key distribution is no problem and as stated, we are willing to license the process as desired by users. I invite your response, Thanks so much, Ralph, John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch PGP Key available at: http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA37…

4 3

Would the FTC crack down on snake oil someday?
by Deranged Mutant 17 Dec '03

17 Dec '03

Enclosed is an excerpt from Edupage. Snake-oil crypto popped into my mind.... I wonder if the FTC (Federal Trade Commission... agency *meant* to crack down on consumer fraud, for non-US readers here) would ever get into act here. Does the FTC have a home page? (Guess I'll do a search...) ------- Forwarded Message Follows ------- ***************************************************************** Edupage, 17 March 1996. Edupage, a summary of news items on information technology, is provided three times each week as a service by Educom, a Washington, D.C.-based consortium of leading colleges and universities seeking to transform education through the use of information technology. ***************************************************************** TOP STORIES FTC Targets Internet Fraud [..] FTC TARGETS INTERNET FRAUD The Federal Trade Commission is conducting a "wholesale crackdown" on perpetrators of allegedly deceptive marketing schemes that are advertised in Internet news groups or on the World Wide Web. Charges were filed against nine individuals or companies accused of misleading the public, and agency officials say this is only the beginning: "The Internet opens a world of opportunities for consumers. Unfortunately, it also presents opportunities for scam artists. We intend to monitor the Internet rigorously and act decisively when we see deceptive and misleading marketing," says the director of the FTC's Bureau of Consumer Protection. (Investor's Business Daily 15 Mar 96 A4) [..] Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

3 2

If you can't take the heat... (Was Re: Keep the pressure!)
by mccoy＠communities.com 17 Dec '03

17 Dec '03

At 12:05 PM 3/20/96, Perry E. Metzger is rumored to have typed: > anonymous-remailer(a)shell.portal.com writes: > > Some people have wondered why I am anonymous and attack me. > > I am not ashamed of my views. > > Well, then you should be. > > > I write this thread anonymous as a form of protest. > > Why is it a form of protest? If you aren't ashamed, post it under your > name. What amuses me most about this series of rantings by whomever, other than the paranoid and baseless claims made by the anonymous poster, is the number of people who have been complaining about the author doing so anonymously through a remailer. The irony of such a situation is too rich to pass up. It seems that cypherpunks can dish it out when other newsgroups and mailing lists suffer such problems ("well, the remailers do nothing that telneting to port 25 cannot do..." or "internet identity is such a fiction anyway, get used to it" seem to be common responses), but when the cypherpunks lists is the victim of unpleasant anonymous messages we fall back to the tired refrain of "if you have nothing to hide why are you posting anonymously." How sad. So, why the hypocrisy here? If you don't want to be bothered by these messages there is a simple solution, use a mail agent that can filter out remailer postings and trash them. Of course this would also kill interesting messages from others who use remailers, but that's the price we pay for having remailers that do not support anonymous identity upon which reputation can be built. Oh yeah, I forgot...cypherpunks write code (snicker). So why not stop bitching and write a bit of code that provides for useful anonymous reputations and/or fix the glaringly obvious problems with current remailers. jim, who is sorry that he is not the one posting such trolls to the list just to make the puppets dance...

3 2

NT's C2 rating
by Brad Shantz 17 Dec '03

17 Dec '03

I have been working for some time on a project that involves doing proactive file authorization/authentication under Windows NT. In the process, I've been working on an extension to the Kernel layer of the operating system because we need to be able to catch read/writes to the disk. (All perfectly legal according to the DDK, just ot documented worth a damn.) All of this is designed to work directly with the functionality given to us by the NT-Security layer. Basically, I'm now questioning the C2 rating of Windows NT. The entire security layer is modular to the Kernel. As a modular driver, it can be removed, rewritten, and replaced. So, what makes it secure? What gives it the C2 Rating? How would one go about getting a C2 rating? Brad

2 1

Why and how people work for free on "challenges"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:56 AM 3/25/96, Black Unicorn wrote: >I think, should you have the right attitude, many people here will be >happy to review your source code, given some pre-conditions. Mr. May >summed these up quite well only days ago in the IDG (or whatever) >snakeoil thread. I would suggest you take a gander at his post on the >subject. Briefly, (and I hope I'm not butchering his points to >bitterly), he indicated that unless you had hit on most of the basic >source material to begin with (applied cryptography for example), and >really knew a bit about the subject, most people wouldn't much care to >pay attention to you. > >I think, however, that if you know your stuff, and you release the source >code to the list, many people here will be open minded enough to take a >good look, give you some pointers, perhaps even improve your work. While I'm certainly no expert in cryptanalysis, the situation with "Can you break this?" challenges is a special case--and an important one--of challenges in general. To cut to the chase, why do challenges work at all? And under what circumstances? A challenge that grabs the attention of key people can result in vastly more effort being put into a task than could be effectively marshalled almost any other way. An example will make this clearer: human-powered flight. A challenge prize was offered for the first human-powered flight around some particular set of pylons...I don't recall the details, but it was heavily publicized some years back. Vast amounts of effort were put into this. Flight, like cryptanalysis, has long been a fairly ideal area for such challenges. But, like crypto, there are some things that work for such challenges (and some things that don't). * the challenge should come from a reputable group or individual (casual challenges of the "I dare you" sort thus get winnowed out) * the challenge should involve something "interesting"....first solo flight across the Atlantic, first human-powered flight, etc. * the challenge needs to come at the right time. There would be little interest, for example, in a challenge about the first fusion-powered flight (excluding solar-powered, which was a challenge). There is, for example, likely to be little or no interest if I pose this challenge: "I challenge any of you to fly from San Francisco to Canberra to Taipei and back to San Francisco without once saying a single word." The challenge needs to arouse wide interest. In crypto, there have been _many_ challenges which basically meet the sorts of criteria I listed. Ralph Merkle offered a prize for anyone who could break the knapsack algorithm (iterated, or somesuch...cf. Schneier etc. for details). This was already an important issue, so the challenge was taken seriously. Shamir ultimately claimed the prize. Later prizes followed a similar trend. And there were challenges by Rivest, involving RSA, which an MIT team ultimately broke (RSA-129). Our own Derek Atkins was involved (and he may be able to say more about why RSA challenges are more interesting to students and faculty than are mere "Here's my new cipher" challenges. And the CIA even has a challenge involving a statue or seal outside its Langley headquarters building. Not to mention the Beale Cipher. So, a reasonable challenge will likely generate a lot of free effort. Even a $1000 prize, if combined with other factors, will draw attention. The prize itself is not important; it is the defining of precise conditions for success that is important and interesting. The recent "I challenge Cypherpunks to break our unbreakable system" challenge from Snake Oil Associates failed on several grounds. There was no real evidence the algorithm was "interesting," there was no evidence the folks at SOA were competent and worth going up against, the conditions of the challenge were suspect, and there was no substantive prize making effort potentially rewarding. (The offered to sell the company for $1 to whomever broke their system, but now seem to have reneged, predictably enough.) Even so, a couple of Cypherpunks analyzed their system (parts of which were secret, usually another killer for effective challenges!). In less than a day, a crack was reported. (The motive here was yet another one, not listed above. Namely, the desire to go "gunning" for the incompetent newbies and cretins.) So, well-planned challenges can be effective. Naive and puerile challenges of the sort "I dare you to break this! I double-dog dare you to!" are rarely treated seriously. Not too surprising. Bayesian statistics says that someone we've never heard from before is unlikely to be producing a new cipher which is interesing enough to try to break. A new cipher from Rivest or the like would of course be somewhat more likely to be analyzed (though even these ciphers are rarely analyzed directly). >Take a look at Mr. May's cyphermonicon, (anyone have the URL/FTP handy >for our new friend?) The URL I like is http://www.oberlin.edu/~brchkind/cyphernomicon/. Though, as I have noted in other threads, I have very little if anything on "cryptanalysis" per se. Modern ciphers are just not very amenable to attacks via conventional cryptanalysis. (And symmetric-key ciphers are really, really old news.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

Re: apology - here is C source code
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 6:00 PM 3/24/96, Jack Mott wrote: > I apologize to everyone for the binary posting, I figured it was small > enough to not cause problems. Here is the source.... <snip> I am a junior in high school ... <snip> > --------------- > // encryption program - constructive flames appreciated <snip> Looks like I spoke too soon about the "tentacle" thing. My apologies. Welcome, Mr. Mott. I have no idea of the quality of your code, but you *do* write code, which is a *good* thing around here (at least until the "coderpunks" flap). You should be aware, however, that even though there are many active cryptographers on this list, most of whom *do* write code, that people probably won't fall over themselves to look at your first effort. As people say, "cryptography is hard". It's a science. As such, it takes a long time to get to the point where you're actually improving the state of the art. Don't let that stop you from coding new stuff. Far from it. Especially if you're coding strong cryptographic software based on algorithms of proven reputation. Lord knows, there are lots of potentially good algorithms out there that need implementation. My suggestion is that you put out a request for correspondence so that people could talk to you about your new work privately, in e-mail. That's because this list periodically gets unsolicited code like yours, and most of it isn't worth the time to read, much less do a proper vetting. So it tends to get trashed upon receipt. Getting together with a bunch of people in your own shoes may be the best way to start, and I'm sure there are one or two others on this list who are plinking around implementing stuff just to see what it looks like. Nonetheless, the trick, it seems to me, (and I'm a poor person to ask, because I couldn't code my way out of a paper bag) is to keep plugging away at stuff like your application, because cryptography is the principal technology of internet commerce, among other things. You also might want to look at the cypherpunks archives, read Tim May's "cyphernomicon" FAQ, and read some good crypto books, not the least of which is "Applied Cryptography" by Bruce Schneier. If you've done all of that, and have written your code afterwards, then you probably have made a nice start. If you haven't looked at the above resouces, you might want to, and check your new code in light of that new information, and give yourself a head start on what others might say. If they looked at your code, I mean. ;-). Anyway, welcome to cypherpunks. It's great to have someone of the next generation on board! Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: LIST OF SHAME VOLUNTEERS
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 01:22 AM 3/25/96 -0500, Declan B. McCullagh wrote: > Leahy Bill has NOT A CHANCE IN HELL of passing, and so is worth > supporting to raise awareness of crypto. Washington is the last place where we wish to raise awareness of crypto --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: So, what crypto legislation (if any) is necessary?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:14 PM 3/25/96, Simon Spero wrote: >If the Leahy bill is unacceptable, what legistlation is necessary? I >can't see how the use of cryptography in the commission of a crime needs >to be a separate offence, but I could see how it could be treated as a >special circumstance - that doesn't really needed a new law though. I don't see any compelling need for U.S. legislation. And given the pressures to attach all sorts of language to bills, I think it best that no legislation happen. Consider a few areas in turn: * DOMESTIC USE OF ENCRYPTION: Currently, no restrictions whatsoever. No laws saying messages can't be encrypted, no laws saying keys must be escrowed, no laws about permissable strength of ciphers, no special laws covering disclosure of keys. Just silence, blessed silence. The Constitution says there shall be no laws about permissable speech (what language one speaks in, or writes in), and other provisions about compelled testimony seem adequate. * EXPORT OF CRYPTO BEYOND U.S.: This is indeed a thorn in the sides of U.S. companies, but is not _per se_ an issue I worry about. So long as I have strong crypto, I don't really care too much about export. It would be nice to get the ITARs modified, but not at the risk of adding language (such as Leahy did) making use of encryption a possible crime (we've debated this, so I won't elaborate here). Besides, I think the best way to overturn the ITARs is through a court challenge; as I have noted, even the NSA's lawyers felt that the ITARs would not withstand court scrutiny. * KEY ESCROW: A matter of contract law, nothing more. If I want to give a copy of my key to my lawyer, fine. If I want to give a copy to Vince's Offshore Key Repository, no current U.S. laws stops me from doing so, and I can even get it to him securely without violating any ITARs by using the cipher that _he_ uses and then importing it here! (Michael Froomkin speculated in one of his articles, I don't recall which, that there might need to be certain guidelines or laws if a key escrow protocol were to invoke the U.S. court system. Maybe. But I think ordinary contract law, about what a contract says and what it means, is adequate. If I pay Joe's Key Warehouse a fee to store my key and it loses it, or gives it to another party, then damages can be collected.) IMPORTANT NOTE: It is often said, in a correct interpretation I think, that a third party holding a key (Joe's Key Warehouse) is _not_ covered by the 5th Amendment's protections against self-incrimination, and so must honor a subpoena. Sounds accurate to me. However, what if Joe is _also_ one's lawyer? Does attorney-client privilege apply here? Perhaps. A better solution is also fully legal at this time: use only offshore key storage. A U.S. subpoena to Vince's Offshore Key Repository will carry no weight in Anguilla. (Can I be compelled to ask Vince to send my key? Sure. But Vince and I could have a stipulation that such "duress requests" will not be honored, no matter how loudly I squawk.) * DIGITAL MONEY. Well, this is such a confusing muddle of competing systems, unclear interpretations, and hyped claims, that I won't address it. Nor do any of the current bills being considered address it. In conclusion, things are fine as they are. I see no compelling need to write a special law confirming the rights we already are enjoying. If the Congress wants to relax the ITARs (fat chance), they can direct that the language of specific sections be redrafted. (I'm not even sure when and how the original language was crafted, though it is part, I believe, of the ancient Munitions Act and/or Trading with the Enemy Act. The enabling legislation for the ITARs, and especially for the specific items actually ON the "Munitions List" could be trivially changed. Were this Leahy's intent, an easy thing to write a bill for. I doubt this was his intent, however. Last point: >I do feel that it should be possible for courts to sub poena crypto keys, >but that doesn't really need new law either (4th and 5th ammendments >become _really_ important though (hmmm- there advantages to writing down a >constitution after all :) I agree that subpoenas for keys are legit. While I may dislike giving up my key, in a criminal matter it seems like "just another document." If they can subpoena my diary, my phone records, my dentist bills, why not another this document? Nothing in the Constitution giving it special status. Still, one can store spare copies of keys with one's lawyer, which _may_ protect it against retrieval by subpoena, and one can store spare copies of keys in foreign jurisdictions, which almost certainly will protect against the retrieval (unless an international treaty on such things is passed!). Obviously things get more complicated when a private key or set of keys "is one's identity." That is, at some future time, when a key or set of keys is literally the key to one's identity, then this document is no longer "just another document." A law enforcement agency or court that obtains these keys could do much damage, beyond just the matter being investigated or tried in court. The release of the key cannot be undone. A thorny problem. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

Re: protection on IoMega ZIP drives
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Death rays from Mars made alano(a)teleport.com (Alan Olsen) write: >At 05:08 AM 3/23/96 +0000, Deranged Mutant wrote: >>On 23 Mar 96 at 3:00, Ed Carp wrote: >> >>> Has anyone tried SFS? It should work on the zip drive, though I've not >>> tried it (yet)... >> >>If I recall some recent threads on alt.security.pgp (or sci.crypt?), >>SFS doesn't work on ZIP drives (since ZIPs use the parallel port...). >> >>[Or do ZIPs use Scuzzies and the people who had problems were just >>too lame to figure out that they had to load the driver before SFS?] > >There are two versions of the Zip drive. One is SCSI and one is Parallel >faking scsi. > >The big problem is with the zip drivers. There is some sort of >incompatibility between SFS and the zip drivers. (I hacked on it for a >couple of hours with no luck.) The Zip drives have a firmware bug in that they don't do anything if the (appropriately-named) FUA bit is set in SCSI requests, and then return a command complete status. SFS 1.20 has a workaround for this problem. It works with both SCSI and parallel-port versions. Before anyone asks when it's due out, its the end of February, probably about the 60th of the month. Peter.

1 0

WSJ on Big Java Flaw
by John Young 17 Dec '03

17 Dec '03

Wall Street Journal, March 26, 1996, p. B4. Researchers Find Big Security Flaw In Java Language By Don Clark A team of Princeton University researchers said they discovered the most serious security flaw yet in the widely used Java programming language from Sun Microsystems Inc. The flaw could make it possible for unscrupulous hackers to destroy files or cause other types of damage on any personal computer that uses Netscape Communications Corp.'s Navigator program, said Edward Felten, a Princeton assistant professor of computer science who helped discover the flaw. Netscape Navigator, which uses Java, is the most popular software for browsing the Internet's World Wide Web. Java enables the creation of tiny programs, called applets, that are transferred from a Web site on the Internet to a PC running Netscape Navigator. Mr. Felten said that unscrupulous people who discovered the flaw could boobytrap a Web page on the Internet, essentially seizing control of the browser software of any PC that tapped into that page. At that point, the hackers could read or delete an entire hard disk of data files. "The consequences of this flaw are as bad as they can be," he said. Sun, a computer maker based in Mountain View, Calif., acknowledged the problem. "This one is a serious bug," said Marianne Mueller, a senior Sun engineer specializing in security issues. The company, alerted by Princeton on Friday, is already testing a software fix it has developed for the program and hopes to distribute it to Netscape and other users in about two days. Those companies are then expected to distribute updated versions of their Web browsers or other products to users. "We plan to fix it and get it out to our customers as fast as we can," said Jeff Treuhaft, a Netscape product manager. Java was originally touted by Sun as a secure language. But at least two other flaws have already been discovered in the technology, including a less-serious problem uncovered by the Princeton team last month. Sun's Ms. Mueller said the problems have been correctable details in the way the Java code is written, not problems with its basic design. [End]

3 2