December 2003 - cypherpunks-legacy

Sternbot on RSA
by Eric Cordian 17 Dec '03

17 Dec '03

Vin has now cloned his vigorous defense of the RSA patent to several Usenet newsgroups, posting his "summary" of the discussion. Sternlight now leaps in, to add his two cents worth. In talk.politics.crypto David Sternlight <david(a)sternlight.com> wrote: > I simply cannot believe the post by Cordian below. His argument seem to > be: Good morning, David. We've missed you on the Cypherpunks List. > 1. I am right and the court is wrong. No, David. Vin's argument is that since the patents were upheld in court, no knowlege of the specific algorithms or methods used to construct the patented entity pre-dated the work which led to the patent. In point of fact, such things do not automatically invalidate patents. Certainly the concept of trapdoor functions, their cryptographic utility, and that multiplication of primes was such a function, were known prior to the development of the RSA Public Key Cryptosystem. I vaguely recall that encipherment by modular exponentiation has also been published as an algorithm, albeit prior to the recognition that it had utility in constructing public key systems. > 2. I vaguely recall a paper that might have been prior art. Certainly the notion that the difficulty of factoring composites could be employed in the construction of cryptographically useful things was prior art. The description of encryption by modular exponentiation I recall would have been additional prior art. > 3. It is disingenuous to say there has been no invalidating prior art > even though the court has found the patent valid. There is a huge difference between "prior art" and "invalidating prior art" under patent law. Indeed, to invalidate the patent, it would have been necessary not only to find a description of the mathematical methods used in the construction of the RSA algorithm, but also a claim for the specific use for secure communication over insecure data links. > 4. Cylink's arguments must be right even though they lost in court. Some of Cylink's points were factually accurate. A system which permits the patenting of applied mathematics, which many engineers could have independently derived, is hardly likely to stun us with a brilliant interpretation of the various shades of meaning surrounding such claims and counterclaims. Again, losing in court does not equate to ones facts being in error, any more than it equates to the mathematics being patented being unknown prior to their incarnation in the patented application. > 5. RSA won because nobody could afford to litigate against them, even > though Cylink did. RSADSI's aggressive litigation posture discouraged people from ignoring their patent, and given that the patent could be licensed for much less than a lengthy court fight, kept litigation to a minimum. Cylink was pretty much the sole exception to this, and that was a legal fight internal to PKP. > 6. Anyone can patent anything and nobody could afford to oppose them > (N.B. Presumably not IBM, not DEC, not DuPont, ..oh well, you get the > idea) Yes, David. Practically anything can be patented. The power of patents is in defending them, not in applying for them, or in receiving them. > 7. Rich, smart companies with big legal departments license bogus > patents rather than litigating. Well, that depends on how you define bogus. I consider patenting applied math to be bogus. Your mileage may vary. > 8. Someone who opposes me is a troll. Someone who responds to a one line comment about the mathematical underpinnings of RSA being previously known, with several multipage essays whose central thesis is that such a claim cannot possible be true, because the patent would have been invalidated by the courts, is a troll who either understands nothing about how patents work, or is blowing a foghorn on behalf of the patent holder. > 9. If someone takes the time to oppose me, someone must be funding him. Vin has already outed himself as someone who has done work for RSADSI. He has vociferously defended various key recovery schemes implemented in their products against critics. This, combined with his rabid insistance that the RSA patent is something novel and unique, does equate to what some of us might describe as a "vested interest" in the matter, directly funded or not. > 10. The patent office never refuses patents on "method and apparatus" > except in the case of perpetual motion machines. Patent examiners generally rely only upon the material presented with the patent application when reviewing it, and expect people to do their own searches, and correctly cite related patents. Litigation is generally the means by which patents are challenged, not by the patent office refusing them, except in extrordinary circumstances, perpetual motion machines being one well-known example. > 11. Security Dynamics is paying for those who oppose me. I merely asked if Vin intended to bill them for the time he spent writing his rants. A rhetorical question. > 12. Such opposition is "a tirade". Suggesting that I would have to retire my nym after criticizing the RSA patent and taking several pages to say a paragraph of material certainly qualifies as a tirade in my book, especially when combined with a lot of irrelevent innuendo unrelated to the topic being discussed. > 13. No corporations are buying products with GAK, key recovery, etc. > (N.B. in That is what "no corporate demand" means). To an economist, perhaps. It would be more accurate to say that demand as a function of whether such features are included is a pretty flat function. > 14. Someone who opposes stronger escrow/GAK/key recovery than RSA is > offering must be suspect. Your point here eludes me. > I could go on ... And you usually do, and on, and on, and on... > but it seems to me, knowing nothing about the parties involved and > having no views on their personalities, that on the basis of the post > below Cordian is uh, um, er, a few clauses short of a syllogism. I simply believe that patents on applied math are inappropriate. Given that they are allowed, it seems silly to cite the fact that the courts uphold them as evidence for anything, particularly claims that they are new, novel, and non-obvious. -- Sponsor the DES Analytic Crack Project http://www.cyberspace.org/~enoch/crakfaq.html

1 0

MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN SERVICES FOR THE NEXT MILLENIUM
by Marita N�sman-Repo 17 Dec '03

17 Dec '03

Press Release For immediate release DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN SERVICES FOR THE NEXT MILLENIUM Espoo, Finland, December 1, 1998 -- Data Fellows, the leading global security solutions vendor, and Sonera, the leading Finnish telecommunications service provider, have announced a partnership to create next-generation Intranet and extranet services. The scope of the partnership is to develop a secure IP service platform by combining Sonera's leading-edge telecommunications services with Data Fellows' award-winning secure VPN and anti-virus products. "Security is not a simple issue. We see leading telecommunications service providers in a key position to help corporate customers reap the benefits of the Internet without the inherent risks," says Risto Siilasmaa, CEO of Data Fellows. "Over the years, Sonera has always paved the way with innovative telecommunications services. Well-managed strong security is the logical next step." "Our key challenges are the increasing demand for mobility and the increasing use of extranets between companies," says Jukka T Leinonen, Managing Director of Sonera Solutions. "Managed IP-based virtual private networks with a functioning Public Key Infrastructure (PKI) and strong security constitute the foundation for future corporate information systems. Data Fellows can provide us with standards-based, proven security with globally available strong encryption." The first products and services will be announced early next year. Data Fellows' groundbreaking F-Secure products provide a unique combination of globally available strong encryption, revolutionary anti-virus software and policy based management. Data Fellows products are relied on by the world's largest industrial corporations, best-known telecommunications companies and major airlines, several European governments, post offices and defence forces as well as several of the world's largest banks. Data Fellows was selected one of the Top 100 Technology companies in the world by Red Herring magazine in September 1998. Sonera Ltd is Finland's leading telecommunications company, with subsidiaries and associated companies in 14 countries. Internationally, Sonera is a forerunner in the rapidly growing field of mobile, data, and media communications. In 1997, Sonera's net sales amounted to FIM 8 billion, and operating profit was FIM 1.7 billion. The Group employs 8,200 people. For more information, please contact USA: Data Fellows Inc. Mr. Pirkka Palomaki, Product Manager Tel. +1 408 938 6700, fax +1 408 938 6701 E-mail: Pirkka.Palomaki(a)DataFellows.com Europe: Data Fellows Oy Mr. Jukka Kotovirta, Director, Service Provider Business Unit PL 24 FIN-02231 ESPOO Tel. +358 9 859 900, fax. +358 9 8599 0599 E-mail: Jukka.Kotovirta(a)DataFellows.com or visit our web site at http://www.DataFellows.com Sonera Solutions Ltd. Mr. Timo Korpela, Head of Product Development Tel. +358 2040 63296, fax. +358 2040 64652 E-mail: Timo.Korpela(a)sonera.net -- Marita.Nasman-Repo(a)DataFellows.com, World-Wide Web http://www.DataFellows.com

1 0

Re: more FUD!
by Marcel Popescu 17 Dec '03

17 Dec '03

-----Original Message----- From: HaB <hab(a)gamegirlz.com> To: <cypherpunks(a)toad.com> Date: marþi, 01 decembrie 1998 01:46 Subject: Re: more FUD! >First time poster. Been reading for awhile now and I feel like a goof >for having to ask, but what does FUD stand for anyway? Fear, Uncertainty, Doubt. Alleged technique of large companies to make people think twice before buying products from lesser companies by casting doubt over the reliability of the product and its creator. Thinking twice is known to be a Bad Thing. <g> Mark

1 0

Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S...
by Opencity＠aol.com 17 Dec '03

17 Dec '03

Hi Mimmi Okay...this can be distributed as of today? Thanks phil

2 1

bonjour
by Thierry Roch 17 Dec '03

17 Dec '03

Ici tout va bien, merci. On espère qu'une version fiable pour windows sortira un jour Salut ________________________________________ roch(a)liberation.fr Tel : +33 (0) 1 42 76 17 68 - Fax: +33 (0) 1 42 76 02 24 Informatique Libération http://www.liberation.fr

2 1

Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S...
by eschuman＠cmp.com 17 Dec '03

17 Dec '03

Same request. May I be removed from this list as well? falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:20:14 AM Please respond to press-english-technical(a)lists.datafellows.com To: press-english-technical(a)lists.datafellows.com cc: bcc: Evan Schuman/MHS/CMPNotes Subject: Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S... Please remove my name from your email list. Opencity(a)aol.com wrote: > Hi Mimmi > > Okay...this can be distributed as of today? > > Thanks > phil

1 0

RE: bonjour
by Ayoub, Mark (CAP, FLEET) 17 Dec '03

17 Dec '03

Please do not click on REPLY ALL, click on REPLY only, otherwise EVERYBODY on the mailing list receives a copy of your message. -----Original Message----- From: falcon falcon [mailto:falconinc@earthlink.net] Sent: Tuesday, December 01, 1998 11:19 AM To: press-english-technical(a)lists.datafellows.com Subject: Re: bonjour please remove my name from your email list. Thierry Roch wrote: > Ici tout va bien, merci. > > On espère qu'une version fiable pour windows sortira un jour > Salut > ________________________________________ > roch(a)liberation.fr > Tel : +33 (0) 1 42 76 17 68 - Fax: +33 (0) 1 42 76 02 24 > Informatique Libération http://www.liberation.fr

1 0

RE: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATESECURE VPN S...
by Mark Denny 17 Dec '03

17 Dec '03

===== Original Message from PRESS-EN @ INTERNET {press-english-technical(a)lists.datafellows.com} at 1/12/98 16:21 >Same request. May I be removed from this list as well? > > > > >falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:20:14 AM > >Please respond to press-english-technical(a)lists.datafellows.com > >To: press-english-technical(a)lists.datafellows.com >cc: >bcc: Evan Schuman/MHS/CMPNotes >Subject: Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE > SECURE VPN S... > > > > >Please remove my name from your email list. > > >Opencity(a)aol.com wrote: > >> Hi Mimmi >> >> Okay...this can be distributed as of today? >> >> Thanks >> phil ===== Comments by MAD@MM-CROY (Mark Denny) at 1/12/98 16:27 Could you please stop sending me your emails. I think that some thing has gone wrong with your server. Thanks. Mark.

1 0

Re: Old Hat 2
by Anonymous 17 Dec '03

17 Dec '03

Here's what is likely going on right now, though its availability to LE is questionable: NSA probably maintains surveillance of all or nearly all encrypted remailers. They log and archive the content of all traffic. First arrivals of messages in the remailer "cloud" provide source identification in many cases, so a database is gradually built of all the originating email addresses and IP addresses that have ever sent messages to a remailer. The same is true for the messages exiting the cloud, although many of those go to public lists or newsgroups. Sometimes, perhaps even often, the remailer cloud is so little utilised that one-hop or even multi-hop chained remalings are easily identified as to source and final destination. All goes into the database. Spook-style stylometers develop profiles of the users. Over time, more and more of the unidentified profiles become linked to known users. All it takes is one slip, or one piece of bad luck of low traffic levels. Linkage is also done on a probabilistic basis, many-to-many. Little human intervention is used except to develop and tune the correlation mechanisms. Filters aimed at content that might help correlate messages with senders is more important to the spooks than Echelon Dictionary filters. The priorities in getting a handle on something like the remailer cloud are quite different than the priorities in scanning ordinary traffic for content. Ultimately, though, the regular content filters come into play, but in this ongoing exercise of cat and mouse, the bulk of the effort is directed at developing the combination of surveillance and intelligent processing that can provide the basis for identifying, at least to some knowable probability, the sources and destinations of given remailer messages. Source and destination correlation can benefit greatly from knowledge of conventional email correspondent relationships. Most nonprofessional-spook people who send encrypted remailed email to a non-public destination are also likely to correspond with that destination in the clear. Archival logging of traffic is like a time machine - even if one ceases conventional correspondence with another, any past traffic can reveal the correspondence relationship. Mathematical correlation, given a very large amount of raw data consisting of timestamped message events, can reveal quite a lot about likely correspondence relationships. Even given a remailer network full of chaff, with reordered message pools and such, just running correlations on the end point data - who sent and when, and who received and when - can develop likely correspondent pairs. Be assured that the manipulation of such data relies heavily on probablistic clustering supported by database mechanisms not seen much in business environments. Instead of having firm relationships within an order or two of magnitude of the terminal node population, I would want something that allows having very large numbers of fuzzy relationships numbering many orders of magnitude greater than the node population. Nodes A, B, C and D send and receive remailer traffic. Everything that A has ever sent is clearly related to A, but each item can and likely would also have a probabilistic relationship to B, C, and D. The probability assignments would be updated as later analysis and later data more clearly identify who may have received which messages. Content comes into play here, too. At any time it is possible to query the database for the likely correspondents of A, and the likely messages A may have sent to B, C, or D, and get a result ordered by confidence. Similarly, it is possible to query for the likely sender(s) and recipient(s) of a given message. Occasionally, data may be firmed up - meaning achieving higher confidence levels of the relationships - by access to someone's PC, by whatever means, by stylometry, by specific content of public messages, and by fortuitous traffic analysis successes owing to the paucity of remailer traffic. It's also certain that to provide realistic cases that can be fully revealed to measure the efficacy of the various algorithms and methods involved, spooks use the remailer network themselves. That's the only way they can be sure to have any traffic that can be fully analyzed as a yardstick for the guessing games played by their software. A few rules of thumb result from even cursory examination of the likely environment: 1. Do not send clear messages through the remailers except to public lists and newsgroups. Sending clear messages to private correspondents provides the watchers with rich style and content material linked to a correspondent. It is usually easy then to link it back to you, and a firm correspondent pair is then established in their database. 2. Do not switch between clear and encrypted, remailed communication with the same correspondent. If your correspondent relationships are mapped via clear, conventional mail, those mappings can be applied to your encrypted, remailed mail to greatly narrow down the possible recipients, and quite likely combine with traffic analysis to correlate your outgoing message with one arriving at your correspondent. If the only communications you have with your deep contacts is by encrypted, chained remailer, only fortuitous or statistical correlation analysis or access to your or your correspondent's host machines will tie the two of you together. 3. Do not send traffic to significant correspondents when traffic levels are likely to be low. Good luck at guessing this. Probably the best way to get a handle on traffic levels is to run a remailer yourself. 4. Send lots of chaff. Chain some messages through the remailer cloud every day. If you have time and the ability, write and release something that will allow large numbers of people to send lots of chaff. 5. Ultimately, the only way the remailers will provide what might be described as Pretty Good Security will be when we have software that maintains a regular or random rate of messages to and from the remailer cloud, a stream into which the meaningful messages can be inserted with no visible change in traffic. Until then, the best we can do is try to keep traffic levels up, and to send and receive frequently enough to frustrate end-to-end traffic analysis. 6. Don't send anything that can have grave consequences. 7. Take names. Always take names. Some day... FUDBusterMonger It Ain't FUD til I SAY it's FUD!

2 1

Re: bonjour
by dan_verton＠fcw.com 17 Dec '03

17 Dec '03

this is not my list and I want off as well. falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:19:07 AM Please respond to press-english-technical(a)lists.datafellows.com To: press-english-technical(a)lists.datafellows.com cc: (bcc: Dan Verton/FCW) Subject: Re: bonjour please remove my name from your email list. Thierry Roch wrote: > Ici tout va bien, merci. > > On esp ère qu'une version fiable pour windows sortira un jour > Salut > ________________________________________ > roch(a)liberation.fr > Tel : +33 (0) 1 42 76 17 68 - Fax: +33 (0) 1 42 76 02 24 > Informatique Libération http://www.liberation.fr

1 0