December 2003 - cypherpunks-legacy

Re: "Export" controls
by Michael Motyka 17 Dec '03

17 Dec '03

> Export farce is just a neat way of scaring companies and individual > contributors from developing and providing cryptographic systems > within US. > 100% accurate, but old, conclusions. > Anyone providing domestic crypto runs the risk of violating EARs. > Manufacturers are ultimately responsible when their products end up > overseas... > Can you give me an example of a commercial vendor who has suffered because someone bought a "dangerous" product ( Windows, for example ) at retail and carried it out of the country in a suitcase? My guess would be that anything sold at retail would pose no problem for the manufacturer unless domestic regulations were in place. Even then the retailer is the first in line for questioning. > [ For example, try to buy one of IBM crypto-cards - give them a call > and ask what does it take to purchase one with hard crypto on it > Save me the phone call and describe your experience. BTW - IBM derives a large portion of its revenues from government contracts. They would be pretty easy to convince. An non-dependant might be different. > Would a US citizen have to produce ID in order to buy ? > Not until there are domestic regulations. Except for firearms, cigarettes, alcohol and prescription drugs I can't think of any. My guess would be that start-up manufacturers could get their tails twisted long before the retail shelf: Personal Audits Business Audits Supplier problems ( caused by similar techniques being threatened or applied ) FCC EMI Test Delays and Failures Credit Problems Lots of Traffic Tickets for everyone. It could be fun to try an embedded product. Make some development kits then try to license it. Let a manufacturer with some resources handle the heavy lifting. If you have trouble with that give 'em the bird - just write a damn book, source, VHDL etc. You can even export that. My favorites are: Secure phone - I know it exists already but still fun Disk encryptor - SCSI/EIDE, a bump in the wire between the motherboard and the disk drive. With its own smartcard/keypad interface, keys are never seen by OS. It doesn't solve the security problem while the system is on but it sure as hell makes the disk useless to opponents once it has been shut off. Good storage. Effectively shredded if you destroy the smart card or forget the key. The proper way to keep your data as long as the courts respect the Fifth Amendment. Oh well, Mike

1 0

dctest remailer - remailer@dragoncon.net
by nobody＠dragoncon.net 17 Dec '03

17 Dec '03

A new remailer will be up for the next two weeks. This is an attempt to play with and test the Win95 Reliable remailer software available at ftp://ftp.efga.org/privacy remailer(a)dragoncon.net is a Cypherpunk Type I remailer w/o Mix, which uses RSA keys. The operator had problems getting the later key types to work properly. Please send comments about the configuration and operation to admin(a)dragoncon.net

2 1

Big Brother Banks? FDIC has snooping plans
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text <snippetasnippeta> >Big Brother Banks? FDIC has snooping plans >By David M. Bresnahan >Copyright 1998 WorldNetDaily.com > > > Are you a potential criminal? Are you a threat to banks, airlines, a >potential spy, or perhaps an IRS tax protester? The government >would like to know and they are about to force banks to be their >detectives. > >The federal government wants banks to investigate you. Soon your >banker will know more about you than anyone else in town. Banks >must not only determine your correct identity, they must also know >how you make your money, and how you spend it. Once you >establish a pattern of deposits and withdrawals, banks must inform >federal agencies when you deviate. > >Bank customers may soon find themselves explaining to the FBI, >Internal Revenue Service, and the Drug Enforcement Agency why >they made a $15,000 deposit to their bank account. According to >current Federal Deposit Insurance Corporation plans, banks will >soon establish "profiles" of their customers and report deviations >from those profiles. > >If you sell a car, for example, and place the proceeds in your >account while you shop for a new one, a red flag may go off in the>bank > computer. Such a situation puts law abiding citizens in a >situation where they must prove they are innocent, says Scott >McDonald of the watchdog group Fight the Fingerprint. > >An uproar from grass roots Americans is the only thing that will >stop the current plans for the FDIC "Know Your Customer" >program, according to McDonald. His organization has led the >charge against the national ID, medical ID, and computerized >information about private aspects of people's lives. > >A recent announcement by the FDIC provides for citizen comment >prior to implementation of their new banking regulations. The >deadline for comments is Dec. 27, 1998. > >"The FDIC is proposing to issue a regulation requiring insured >nonmember banks to develop and maintain 'Know Your Customer' >programs," according to a recent FDIC information package sent >to Congress to provide notice of proposed rulemaking, and to >banks for comment. > >"As proposed," the 29-page FDIC document begins, "the >regulation would require each nonmember bank to develop a >program designed to determine the identity of its customers; >determine its customers' source of funds; determine the normal >and expected transactions of its customers; monitor account >activity for transactions that are inconsistent with those normal and >expected transactions; and report anytransactions of its customers >that are determined to be suspicious, in accordance with the >FDIC's existing suspicious activity reporting regulation. By >requiring insured nonmember banks to determine the identity of >their customers, as well as to obtain knowledge regarding the >legitimate activities of their customers, the proposed regulation will >reduce the likelihood that insured nonmember banks will become >unwitting participants in illicit activities conducted or attempted by >their customers. It will also level the playing field between >institutions that already have adopted formal 'Know Your >Customer' programs and those that have not." > >Many banks across the country have already begun to implement >such programs, according to the FDIC. A quick search of the >Internet found many stories in press accounts of problems reported >at such banks. There have been a number of stories dealing with >banks requiring fingerprints to open accounts and to cash checks. >There are several lawsuits presently underway testing the right of >banks to make that requirement. > >McDonald has been fighting that issue, along with fingerprints on >driver's licenses for some time. He pointed out the many errors >found on credit reports and suggested that banks will soon make >similar errors when they begin creating profiles of their customers. > >The FDIC is selling the planned regulations by pointing out the >need for prevention of financial and other crime. > >"By identifying and, when appropriate, reporting such transactions >in accordance with existing suspicious activity reporting >requirements, financial institutions are protecting their integrity and >are assisting the efforts of the financial institution regulatory >agencies and law enforcement authorities to combat illicit activities >at such institutions," says the FDIC. > >The proposed regulation is, according to FDIC spokesperson Carol >A. Mesheske, authorized by current law. It comes from the >statutory authority granted the FDIC under section 8(s)(1) of the >Federal Deposit Insurance Act (12 U.S.C. 18189s)(1), as amended >by section 259(a)(2) of the Crime Control Act of 1990 (Pub. L. >101-647). > >The FDIC claims that the law requires them to develop regulations >to require banks to "establish and maintain internal procedures >reasonably designed to ensure and monitor compliance with the >Bank Secrecy Act. Effective 'Know Your Customer' programs >serve to facilitate compliance with the Bank Secrecy Act." > >The proposed regulations will mandate that all banks insured by >the FDIC must maintain an intelligence gathering department that >screens out customers and keeps an eye on existing customers. >Before you decide to move your money to a credit union, you >should know that the FDIC is not the only federal organization >making such plans. > >"Each of the other Federal bank supervisory agencies is proposing >to adopt substantially identical regulations covering state member >and national banks, federally-chartered branches and agencies of >foreign banks, savings associations, and credit unions. There also >have been discussions with the Federal regulators of non-bank >financial institutions, such as broker-dealers, concerning the need >to propose similar rules governing the activities of these non-bank >institutions," reports FDIC attorney Karn L. Main in the proposal. > >The purposes for the regulation are to protect the reputation of the >banks, to facilitate compliance with the law, to improve safe and >sound banking practices, and to protect banks from being used by >criminals as a vehicle for illegal activities. > >Current customers will be subjected to the new regulation in the >same way new customers will be scrutinized. The FDIC does not >wish to permit any loop hole which would leave any bank >customer unidentified or unsupervised. > >Each bank will create profiles. The first profile will determine the >amount of risk a potential customer might present by opening an >account. The system of profiling potential customers will be >different from one bank to the next, since the FDIC does not >provide a uniform program. The purpose of the profile is to >identify potential customers who might use a bank account for >funds obtained through criminal activity. > >The next profile will be one that is used by automated computers >to determine when suspicious activity is taking place in an account. >When activity in the account does not fit the profile, banks will >notify federal authorities so they can investigate. > >Banks are expected to identify their customers, determine normal >and expected transactions, monitor account transactions, and >determine if a particular transaction should be reported. > >The FDIC has sent copies of the proposal to all banks and is >asking for input. The questions asked by the FDIC in the proposal >do not ask whether the regulations should be put into place, only >how to implement them in the best way. None of the questions in >the proposal are directed to bank customers. > >The FDIC reassures banks that because the requirements will be >universally applied to all banks it will not hurt their business and >drive away customers. The proposal does not mention penalties for >non-compliance, nor is there any mention of regulations to provide >access to bank records by customers so errors can be found and >corrections made. > >"If 'Know Your Customer' programs are required, insured >nonmember banks can more easily collect the necessary >information because customers cannot turn readily to another >financial institution free of such requirements," stated the proposal. > >Comments from the public may be sent to Robert E. Feldman, >Executive Secretary, Attn: Comments/OES, Federal Deposit >Insurance Corporation, 550 17th Street N.W., Washington, DC >20429 or faxed to (202) 898-3838 or e-mailed to >comments(a)FDIC.gov. > >-------------------------- >GunsSaveLives Internet Discussion List > >This list is governed by an acceptable use >policy: http://www.wizard.net/~kc/policy.html >or available upon request. > >To unsubscribe send a message to >majordomo(a)listbox.com > >with the following line in the body: > >unsubscribe gsl > >GUNSSAVELIVES (GSL) IS A PRIVATE UNMODERATED LIST. >THE OWNER TAKES NO RESPONSIBILTY FOR CONTENT. ALL >RIGHTS RESERVED. <snippage...> --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Sternbot on RSA
by Eric Cordian 17 Dec '03

17 Dec '03

Vin has now cloned his vigorous defense of the RSA patent to several Usenet newsgroups, posting his "summary" of the discussion. Sternlight now leaps in, to add his two cents worth. In talk.politics.crypto David Sternlight <david(a)sternlight.com> wrote: > I simply cannot believe the post by Cordian below. His argument seem to > be: Good morning, David. We've missed you on the Cypherpunks List. > 1. I am right and the court is wrong. No, David. Vin's argument is that since the patents were upheld in court, no knowlege of the specific algorithms or methods used to construct the patented entity pre-dated the work which led to the patent. In point of fact, such things do not automatically invalidate patents. Certainly the concept of trapdoor functions, their cryptographic utility, and that multiplication of primes was such a function, were known prior to the development of the RSA Public Key Cryptosystem. I vaguely recall that encipherment by modular exponentiation has also been published as an algorithm, albeit prior to the recognition that it had utility in constructing public key systems. > 2. I vaguely recall a paper that might have been prior art. Certainly the notion that the difficulty of factoring composites could be employed in the construction of cryptographically useful things was prior art. The description of encryption by modular exponentiation I recall would have been additional prior art. > 3. It is disingenuous to say there has been no invalidating prior art > even though the court has found the patent valid. There is a huge difference between "prior art" and "invalidating prior art" under patent law. Indeed, to invalidate the patent, it would have been necessary not only to find a description of the mathematical methods used in the construction of the RSA algorithm, but also a claim for the specific use for secure communication over insecure data links. > 4. Cylink's arguments must be right even though they lost in court. Some of Cylink's points were factually accurate. A system which permits the patenting of applied mathematics, which many engineers could have independently derived, is hardly likely to stun us with a brilliant interpretation of the various shades of meaning surrounding such claims and counterclaims. Again, losing in court does not equate to ones facts being in error, any more than it equates to the mathematics being patented being unknown prior to their incarnation in the patented application. > 5. RSA won because nobody could afford to litigate against them, even > though Cylink did. RSADSI's aggressive litigation posture discouraged people from ignoring their patent, and given that the patent could be licensed for much less than a lengthy court fight, kept litigation to a minimum. Cylink was pretty much the sole exception to this, and that was a legal fight internal to PKP. > 6. Anyone can patent anything and nobody could afford to oppose them > (N.B. Presumably not IBM, not DEC, not DuPont, ..oh well, you get the > idea) Yes, David. Practically anything can be patented. The power of patents is in defending them, not in applying for them, or in receiving them. > 7. Rich, smart companies with big legal departments license bogus > patents rather than litigating. Well, that depends on how you define bogus. I consider patenting applied math to be bogus. Your mileage may vary. > 8. Someone who opposes me is a troll. Someone who responds to a one line comment about the mathematical underpinnings of RSA being previously known, with several multipage essays whose central thesis is that such a claim cannot possible be true, because the patent would have been invalidated by the courts, is a troll who either understands nothing about how patents work, or is blowing a foghorn on behalf of the patent holder. > 9. If someone takes the time to oppose me, someone must be funding him. Vin has already outed himself as someone who has done work for RSADSI. He has vociferously defended various key recovery schemes implemented in their products against critics. This, combined with his rabid insistance that the RSA patent is something novel and unique, does equate to what some of us might describe as a "vested interest" in the matter, directly funded or not. > 10. The patent office never refuses patents on "method and apparatus" > except in the case of perpetual motion machines. Patent examiners generally rely only upon the material presented with the patent application when reviewing it, and expect people to do their own searches, and correctly cite related patents. Litigation is generally the means by which patents are challenged, not by the patent office refusing them, except in extrordinary circumstances, perpetual motion machines being one well-known example. > 11. Security Dynamics is paying for those who oppose me. I merely asked if Vin intended to bill them for the time he spent writing his rants. A rhetorical question. > 12. Such opposition is "a tirade". Suggesting that I would have to retire my nym after criticizing the RSA patent and taking several pages to say a paragraph of material certainly qualifies as a tirade in my book, especially when combined with a lot of irrelevent innuendo unrelated to the topic being discussed. > 13. No corporations are buying products with GAK, key recovery, etc. > (N.B. in That is what "no corporate demand" means). To an economist, perhaps. It would be more accurate to say that demand as a function of whether such features are included is a pretty flat function. > 14. Someone who opposes stronger escrow/GAK/key recovery than RSA is > offering must be suspect. Your point here eludes me. > I could go on ... And you usually do, and on, and on, and on... > but it seems to me, knowing nothing about the parties involved and > having no views on their personalities, that on the basis of the post > below Cordian is uh, um, er, a few clauses short of a syllogism. I simply believe that patents on applied math are inappropriate. Given that they are allowed, it seems silly to cite the fact that the courts uphold them as evidence for anything, particularly claims that they are new, novel, and non-obvious. -- Sponsor the DES Analytic Crack Project http://www.cyberspace.org/~enoch/crakfaq.html

1 0

MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN SERVICES FOR THE NEXT MILLENIUM
by Marita N�sman-Repo 17 Dec '03

17 Dec '03

Press Release For immediate release DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN SERVICES FOR THE NEXT MILLENIUM Espoo, Finland, December 1, 1998 -- Data Fellows, the leading global security solutions vendor, and Sonera, the leading Finnish telecommunications service provider, have announced a partnership to create next-generation Intranet and extranet services. The scope of the partnership is to develop a secure IP service platform by combining Sonera's leading-edge telecommunications services with Data Fellows' award-winning secure VPN and anti-virus products. "Security is not a simple issue. We see leading telecommunications service providers in a key position to help corporate customers reap the benefits of the Internet without the inherent risks," says Risto Siilasmaa, CEO of Data Fellows. "Over the years, Sonera has always paved the way with innovative telecommunications services. Well-managed strong security is the logical next step." "Our key challenges are the increasing demand for mobility and the increasing use of extranets between companies," says Jukka T Leinonen, Managing Director of Sonera Solutions. "Managed IP-based virtual private networks with a functioning Public Key Infrastructure (PKI) and strong security constitute the foundation for future corporate information systems. Data Fellows can provide us with standards-based, proven security with globally available strong encryption." The first products and services will be announced early next year. Data Fellows' groundbreaking F-Secure products provide a unique combination of globally available strong encryption, revolutionary anti-virus software and policy based management. Data Fellows products are relied on by the world's largest industrial corporations, best-known telecommunications companies and major airlines, several European governments, post offices and defence forces as well as several of the world's largest banks. Data Fellows was selected one of the Top 100 Technology companies in the world by Red Herring magazine in September 1998. Sonera Ltd is Finland's leading telecommunications company, with subsidiaries and associated companies in 14 countries. Internationally, Sonera is a forerunner in the rapidly growing field of mobile, data, and media communications. In 1997, Sonera's net sales amounted to FIM 8 billion, and operating profit was FIM 1.7 billion. The Group employs 8,200 people. For more information, please contact USA: Data Fellows Inc. Mr. Pirkka Palomaki, Product Manager Tel. +1 408 938 6700, fax +1 408 938 6701 E-mail: Pirkka.Palomaki(a)DataFellows.com Europe: Data Fellows Oy Mr. Jukka Kotovirta, Director, Service Provider Business Unit PL 24 FIN-02231 ESPOO Tel. +358 9 859 900, fax. +358 9 8599 0599 E-mail: Jukka.Kotovirta(a)DataFellows.com or visit our web site at http://www.DataFellows.com Sonera Solutions Ltd. Mr. Timo Korpela, Head of Product Development Tel. +358 2040 63296, fax. +358 2040 64652 E-mail: Timo.Korpela(a)sonera.net -- Marita.Nasman-Repo(a)DataFellows.com, World-Wide Web http://www.DataFellows.com

1 0

Re: more FUD!
by HaB 17 Dec '03

17 Dec '03

Hello. First time poster. Been reading for awhile now and I feel like a goof for having to ask, but what does FUD stand for anyway? Thanks... HaB

3 2

Re: more FUD!
by Marcel Popescu 17 Dec '03

17 Dec '03

-----Original Message----- From: HaB <hab(a)gamegirlz.com> To: <cypherpunks(a)toad.com> Date: marþi, 01 decembrie 1998 01:46 Subject: Re: more FUD! >First time poster. Been reading for awhile now and I feel like a goof >for having to ask, but what does FUD stand for anyway? Fear, Uncertainty, Doubt. Alleged technique of large companies to make people think twice before buying products from lesser companies by casting doubt over the reliability of the product and its creator. Thinking twice is known to be a Bad Thing. <g> Mark

1 0

bonjour
by Thierry Roch 17 Dec '03

17 Dec '03

Ici tout va bien, merci. On espère qu'une version fiable pour windows sortira un jour Salut ________________________________________ roch(a)liberation.fr Tel : +33 (0) 1 42 76 17 68 - Fax: +33 (0) 1 42 76 02 24 Informatique Libération http://www.liberation.fr

2 1

Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S...
by Opencity＠aol.com 17 Dec '03

17 Dec '03

Hi Mimmi Okay...this can be distributed as of today? Thanks phil

2 1

Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S...
by eschuman＠cmp.com 17 Dec '03

17 Dec '03

Same request. May I be removed from this list as well? falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:20:14 AM Please respond to press-english-technical(a)lists.datafellows.com To: press-english-technical(a)lists.datafellows.com cc: bcc: Evan Schuman/MHS/CMPNotes Subject: Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S... Please remove my name from your email list. Opencity(a)aol.com wrote: > Hi Mimmi > > Okay...this can be distributed as of today? > > Thanks > phil

1 0