December 2003 - cypherpunks-legacy

Re: [IRS] Elvis in Escrow
by jim bell 17 Dec '03

17 Dec '03

At 04:40 AM 4/16/96 -0700, Dave Del Torto wrote: >[from SF Examiner somewhere around 12-14 April 96] >.............................................................................. >"IRS Worker Took Peek at Celebrities' Records" >[Associated Press] > Memphis - A former IRS employee who said boredom had led him to peek at >the tax records of President Clinton, Elvis Presley and other famous people >has been acquitted of federal charges. > Robert Patterson, 38, said it wasn't malicious - he was just trying to >learn how to better use the Internal Revenue Service computers. > "I was sitting there bored, so I started punching up names," said Patterson. >.............................................................................. >Hmmm. _We_ do it, it's "malicious cracking/hacking" and they toss us in the >clink... _they_ do it, and it's "practice" (and they get acquitted). And >_these_ are the people who want to escrow _my_ keys? As IF! I have a solution to this problem. Jim Bell jimbell(a)pacifier.com

1 0

Re: why compression doesn't perfectly even out entropy
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:07 PM 4/16/96, Perry E. Metzger wrote: >Timothy C. May writes: >> Well, I don't view any of the "simple definitions" of randomness as >> especially useful; that is, the simple definitions have a kind of >> circularity (implicit in the points we both make). For example, "an object >> is "random" if it has no shorter description than itself," the classic >> Solomonoff-Kolmogorov-Chaitin definition, is quite elegant, but doesn't >> help much in many cases. > >Except that it goes against our normal definitions of random in a >crypto context. A string that is compressable might still be >random. There is no reason you can't have a string of 20 1 bits in >a row in a perfectly random sequence, for example. Usually, random >sequences are non-compressable, but it is possible (though very >improbable) for Hamlet to appear out of a random number generator, >and it is of course quite compressable... Sure, compressibility is not a determinant of randomness....nothing is, actually. This is my point about there being no simple definition of randomness. However, "most" objects derived from a "random-like process" have no shorter description than themselves, by a variant of the pigeonhole principle (i.e., there are more things of some size than descriptions of less than that size, so most "random" objects, are, perforce, not describable in short descriptions). --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: RSA & SDI
by vin＠shore.net 17 Dec '03

17 Dec '03

Steve Reid <steve(a)edmweb.com> exclaimed: >> It's true: >> FOR IMMEDIATE RELEASE >> Security Dynamics to Acquire RSA in Transaction Valued at >> Approximately $200 Million > >Okay, so what do we know about Security Dynamics? What are they expected >to do about licensing etc? I know a lot about SDI's technology and history. (Under contract to SDI, I just finished writing a draft FAQ on their ACE/SecurID user authenication system. It's unofficial and in-process, but I'm willing to e-mail the SecurID FAQ to anyone willing to read it and give me comments, criticism, and suggestions on how to improve it. Fair warning: it is 20,000+ words and written to educate a lay audience.) I haven't heard anything yet about SDI's position on RSA licences; but I doubt if there will be any surprises in that area soon. Among people associated with either company, it has been common knowledge that SDI and RSA folk have been very close for years, on both personal and professional levels. RSA's technical expertise has been apparent in SDI's user authentication system at several levels (albiet undocumented) and SDI's marketing expertise has doubtless informed RSA's policies in recent years. SDI, with over 150 salesmen on the street, fields the largest and most successful sales force selling Computer Security. SDI's SecurIDs tokens dominate the large-site (<1,500 tokens) corporate market for user authentication tokens with an estimated 70-80 percent of the market -- largely on the basis of the relative ease-of-use of the SecurID over its challenge/response competitors; SDI's early committment to client/server environments; and SDI's corporate promise to evolve to meet the changing CompSec threat. A SecurID generates the token's 4-8 digit token-code from an SDI-proprietary hash that puts Current Time and a token-specific key through a one-way function to create a PRN that changes every 30 or 60 seconds. All SecurID authentication calls also require two-factor validation; both the token-code and a user-memorized PIN must be submitted to the ACE/Sever for validation. There has never been any doubt -- given the evolving risks and the needs of on-line business community -- that SDI would eventually sell both authentication and encryption services. (It has also been obvious for years that SDI had, in its SecurID token-code, a neat symmetrical encryption key-generator already in widespread use in many networked environments. SDI had a mocked-up system that effectively used a SecurID token to generate DES keys seven or eight years ago, as I recall -- but apparently SDI never felt the market opportunities were sufficient to lure them into the political malestrom around crypto... until now.) I have no secrets to share, but it would surprise me if many SDI customers don't read a major opportunity for themselves in SDI's purchase of RSA. Last fall, SDI upgraded its ACE/Server to a new version (2.X) which manages user records on a fully-integrated Progress relational database. This integration of a SQL and 4GL-accessible RDBS brought a whole new level of functionality, complexity, and opportunity into ACE system administration -- but it also offers the security, scalability, and RDBS-to-RDBS communication options necessary to manage enterprise-wide IS security systems. Managing a large key-management system through a flat text database would be a nightmare. With the flexibility of an indexed RDBS, it becomes feasible to look to SDI's ACE/Server as a vehicle to hold and manage crypto keys, either PKC pairs or symmetrical keys, for an enterprise-wide system with multiple and distributed sysadmin sites. Some ACE/Server systems now support over 20,000 SecurID users, and the ESQL comm options will finally open the door to integrated multiple-server environments. >The question of the day is... HOW WILL THIS AFFECT CRYPTO? I have no answer on that one, but the marrage of RSA's technology and SDI's marketing muscle -- given RSA's credibility and SDI's installed base in commercial MIS sites -- unveils a world of interesting opportunities. One interesting thought: since SDI has a shoe-leather sales force on the street in 20-odd nations, SDI (with RSA) might be able to leverage an integrated crypto/authentication technology and sell in markets where RSA's algorithms doesn't even enjoy patent protection. In the best of commercial traditions, SDI would be selling a solution rather than a technology. Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

IRO_nic
by John Young 17 Dec '03

17 Dec '03

4-16-96. Jour: "Bidzos Holds Key to Guarding Internet Secrets." Mr. Bidzos has made shrewd deals to build a powerful franchise, but he has also angered the government's security apparatus and some of his own customers and partners. Mr. Bidzos has fended off the government with a mix of stratagems and chutzpah. Lynn McNulty, an ex- Commerce official, said Mr. Bidzos always found "the open door that we hadn't thought about locking." Adds NSAper Stew Baker, "Jim has made a career out of bashing the NSA." 4-16-96. Fint: "A hacker's paradise. One computer on the Internet is broken into every 20 seconds." Despite a proliferation of computer security products ranging from "secure" server and browser software to firewalls, encryption and authentication schemes, computer break-ins are on the rise. Security experts say US Internet sites are under frequent attack by hackers from eastern Europe. But there are also now more than 20,000 aggressive, deliberately destructive hackers in the US and the number is said to be growing at a minimum of 5 per cent per month. Ironically, as the number of sophisticated hackers rises, there is a dire shortage of computer security professionals. IRO_nic

2 1

Re: RSA-130 Falls to NFS - Lenstra Posting to sci.crypt.research
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: Bruce Marshall <brucem(a)wichita.fn.net> > However, I do feel that you may have a valid point when switching >"hackers" to "opponents of the research." Anyone with an interest in >preventing or slowing down the progress in such a project would be more >dangerous in my mind than your average hacker. > Preventing that from happening would be necessary if it is decided >that such a threat truly exists. Actually, people would also have a motivation to turn in false results if they were being paid (perhaps in ecash) for their computer time. If they could take less time and turn in a supposedly correct job, they would be able to be paid the same amount for less work. Fortunately, it does appear possible to filter out bad ones. In creating such a paid system, keeping this possibility in mind would be needed. -Allen

1 0

RE: math patents
by jim bell 17 Dec '03

17 Dec '03

At 11:21 PM 4/15/96 -0700, Robin Felix wrote: >At 04/14/96 1457, jim bell may have written: >>At 09:08 AM 4/14/96 -0800, Lee Tien wrote: >>>My recollection from law >>>school is that the law was friendly to math patents in the period before >>>the Supreme Court weighed in. There were some PTO denials, which courts >>>reversed (I think the Court of Claims heard these back then). So I think >>>the trend was toward patenting processes even if mathematical until >>>Gottschalk v. Benson > >>I seem to recall reading that one of the breakthrough "algorithm" patents >>was from the 1970's, in which a rubber-curing/molding process's cure time >>was determined by a mathematical formula based on heat, pressure, mold >>shape, and a number of other variables. > >You're referring to Diamond v. Diehr, 450 U.S. 175, 195 (1981). I have a >half-finished article I wrote in 1994 on software algorithm patents, about >32K, available at <http://www.delfinsd.delfin.com/felix/Algorithm_Patents.htm. It's the good >part, the background material minus footnotes. Although it's a bit dated, >the description of foundational cases is still accurate. Thanks for the reference, and yes, the article was very interesting. As usual, it sounds like the legal system has gotten the whole thing screwed up. I am still mystified, however! If I understand the thrust of the legal cases you cited, purely mathematical algorithms are still not patentable, yet the patents on public-key cryptography are about the most purely mathematical ones that could be imagined. They are not an element in the process, they ARE the process. To recap, I've asserted (with no definitive proof, obviously) that when public-key cryptography was invented, in about 1976, the US government decided that it wanted to restrict it as much as possible from ordinary US citizens. Due to the 1st amendment, legal restrictions on speech would not fly, and copyright was out because that would only have protected one particular program, if even that much. The final alternative, patent protection, was essentially unavailable (or thought to be so) because of the traditional non-patentability of software and mathematics. Patents would not have prevented the Russians from using RSA, nor any other foreigners, so as far as I can see the only group of people impaired by the RSA patent were American citizens as a group. To me, there are at least two mysteries that need to be solved here. The first is why the cryptography patents were issued in the first place. The second, and perhaps even more incriminating, has to do with why the patents were applied for. Because the patent application has to be filed within a year of disclosure, the RSA patent would have to have been filed at latest by April of 1977. Yet, that predates some of the earliest cases in your article by a year or more. I've never heard a cogent explanation as to how R, S, and A decided that a "doomed" patent application was worthwhile, unless they had some insider information that the Gottschalk v. Benson case would be essentially ignored and the patent granted anyway. This isn't unrealistic paranoia or conspiracy theory, either. It is reasonable to assume that since the government would be the first, largest beneficiary of keeping RSA out of the hands of the public, and since the government made up and controlled the patent office and the court system as well, it could easily have made a decision that RSA was going to be patented, and Messr's Rivest, Shamir, and Adleman told of their luck in plenty of time to apply for a patent. The other cases from 1978 on might simply have been window-dressing, to make it look like the courts had had a change of heart unrelated to the subject of public-key cryptography. My question is this: "Is there anything you're aware of that contradicts this impression?" Or, is there a way to confirm this?

1 0

Re: [NOISE] Consolidation of threads ...
by Clay.Olbon＠dynetics.com 17 Dec '03

17 Dec '03

At 9:58 PM 4/15/95, eriksmit wrote: >Clay Olbon II wrote: >> >> OK, I have a proposal that consolidates two threads that have been >> discussed recently. How about proposing legislation that mandates that a >> byte is now 9 bits instead of 8. This would allow the ninth bit to be the >> decent/indecent bit, thereby solving all of our problems. >> >> Clay >> >> --------------------------------------------------------------------------- >> Clay Olbon II | Clay.Olbon(a)dynetics.com >> Systems Engineer | ph: (810) 589-9930 fax 9934 >> Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html >> 550 Stephenson Hwy | PGP262 public key: on web page >> Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 >> TANSTAAFL >> --------------------------------------------------------------------------- > >Get me off from the list OK, this is either a comment on my admittedly weak attempt at humor, or the unsubscrives have gotten more creative <g> Go Wings! Clay

1 0

Re: CDA Court Challenge: Update #7 (Ducks on the Net)
by Lou Zirko 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Hope the Kinks don't see this. (Ducks on the Wall). >Excerpts from cypherpunks: 15-Apr-96 Re: CDA Court Challenge: Up.. > by >Timothy C. May(a)got.net >> ???? >> >> Apparently "The Netly News" has given up on simple, straightforward >> reporting in favor of "Pop Journalism." Cute headlines instead of >> informative ones. >> >> (The reason I no longer try to wade through the cuteness of > "Wired," >> another example of postmodernism carried too far.) > >The headlines were mine, not The Netly News'. They do not appear on >TNN's web site. > >-Declan, now guilty of "cute headlines" > > -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMXPc0BKvccEAmlQ9AQFHigf/Qy1h07dX6GQF6Bqoqz7y9SG8IrIQYaDE M88a+4r/k90caBDE42T0l7aiZpjuehLIq/ouvrFtW3ZTM5Z1aEM6GdhF30f794qK el0dZWBztePlNhINDBauXUQQlDa+o4QSEhJHBOfBoN1k1sOpjlumimeNjZpgaTYv ZU1ufXlb6DcfaAePsJUWezLzcZx7Y9RCZAcCKV941/UOsNqPcogCimlieVwu0EEf ZJNRFGXb1ZfHvgyAzsEoP2QfajXudboGyeLY66fRS1uFwdzKQ2WbUI+dRzWRPchA Rm54MsDVusEemw9auho83olNlJ189n1Oi8cvhKOa6LIr0Sc6sGBHrg== =wEGj -----END PGP SIGNATURE-----

1 0

A possible problem with more regulation possible?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

This proposal would appear to increase vulnerability to regulation. -Allen From: IN%"educom(a)elanor.oit.unc.edu" 7-APR-1996 18:42:00.83 >MORE ROUTERS = MORE INTERNET BROWNOUTS >As businesses and Internet operators keep adding routers to speed electronic >content on its way, the proliferation of routing devices actually begins to >slow traffic, causing Internet "brownouts" -- when the response time slows >to a crawl. The solution could be an updated Internet, redesigned for >fewer, more powerful routers, so that data packets need fewer hops. "The >U.S. Internet is about as reliable these days as the phone system in >Russia," says NetStar's VP for sales and marketing. (Business Week 8 Apr 96 >p82)

1 0

Re: CDA Court Challenge: Update #7 (Ducks on the Net)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:51 AM 4/16/96, Declan B. McCullagh wrote: >In this update: Ducks on the Net! > More on BYU's Dan Olsen's censorhappy boondoggle > Grey Flannel Suit wears Blue Pinstripe, surfs for porn ???? Apparently "The Netly News" has given up on simple, straightforward reporting in favor of "Pop Journalism." Cute headlines instead of informative ones. (The reason I no longer try to wade through the cuteness of "Wired," another example of postmodernism carried too far.) Curmudgeonly Yours, --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2