December 2003 - cypherpunks-legacy

Re: Text of Wassenaar regulations, with comments
by Frank O'Dwyer 17 Dec '03

17 Dec '03

"Arnold G. Reinhold" wrote: > I am not a lawyer and different administrations could issue more > restrictive rules (as the US does), but the new Wassenaar regulations > themselves do not seem to affect free distribution of programs like PGP and > Linux as long as they qualify as "public domain" as Wassenaar defines it. Unfortunately, AFAIK copyrighted software is NOT public domain. GPL and the like usually make a big song and dance to the effect of "this s/w is copyrighted and not in the public domain". Even worse, I think the original PGP is pretty clearly not in the public domain, since commercial uses must be paid for. So does anyone know just how does Wassenaar define the term "public domain", and is open source indeed covered? Cheers, Frank.

1 0

Re: COMMENT: Minimum Security Devices and Procedures and Bank Secrecy
by Anonymous 17 Dec '03

17 Dec '03

>If this act is passed, I know what my response will be. I will promptly >withdraw all my monies from any institution that follows these regulations, >refuse to do any sort of business with them, and urge all my friends and >family to do the same. I know that many others will do the same without >hesitation. Today I called the manager of the branch where I have account (for many years) and asked him about "Know your customer" thingy and reporting that they currently do. He seemed knowledgable to a certain extent about this matter, and assured me that today they report only the $10K+ cash transactions. Then I told him that I will take my business elsewhere should they decide to offer "know your customer" service to the government and asked him nicely to relay my stand to his manager. Call them. These people make living from your money.

1 0

Some sites are...!!
by cyphrpnk＠rainbow.thinkthink.com 17 Dec '03

17 Dec '03

-------- Some of us were in a position to make the switch... www.first-ecache.com www.donpablocigars.com www.permutation.net Service will resume as normal at 2400 monday PST cheers Gwen Hastings Web weaver for above sites

1 0

Striking!
by Sun Toucher 17 Dec '03

17 Dec '03

well you could say I striked. "Twilight is upon me and soon night must fall"

1 0

RE: Anyone Striking?
by Gomes, Carlos 17 Dec '03

17 Dec '03

My original statement is a bit off. I think the past weekend in Dallas is still with in spirit.... I don't think Jim nor Perry openly advocated the strike so let me chop that statement. And as for myself, I was hoping to see something a bit more active in regards to a protest and I was hoping that the call to strike would be a start. The call appears to have been slightly still born if not horribly premature. There were several ideas floating around: a) detach from the net and from work b) create a signed letter of disapproval published to appropriate orgs c) _short_ loosely organized burst of DoS against select online targets from widely distributed sources. All valid forms of protests (when properly organized and executed) all with varying forms of impact and visibility. For the record, I think option c) could be a valid and effective form of active protest. It is a form which has not been used in support of the cpunks' agenda (or many agenda's for that matter) to date and one that merits a review. On to the next online skirmish... regards, C.G. -- DISCLAIMER: The above views are mine and not of my employer or coworkers. I do not speak as a representative of their views. Only of my own. > -----Original Message----- > From: Tim May [mailto:tcmay@got.net] > Sent: Monday, December 14, 1998 12:39 PM > To: Gomes, Carlos; James Glave > Cc: cypherpunks(a)toad.com; cryptography(a)c2.net; dcsb(a)ai.mit.edu > Subject: RE: Anyone Striking? > > > At 9:29 AM -0800 12/14/98, Gomes, Carlos wrote: > >Even http://www.openpgp.net is still up and operational. I > agree with Perry > >M. and Jim C. that the concept was good but the timetable > was unfortunately > >unrealistic. I've not run across any strike pages. > > A foolish idea, that little "strike." Something out of the > lefty sixties. > Grape boycotts and all that nonsense. > [deletia] >

1 0

Re: Mathematician-to-silicon compilers and the Law
by Mark Lanett 17 Dec '03

17 Dec '03

Speaking of carrying... Can I export my theoretical closed-source-commercial-strong-crypto-using software by printing out the source at Kinko's, binding it, and flying out of the country? Any company can afford to set up a 1-person shop in a variety of countries as necessary (besides you need local ops to distribute and do tech support). Or do F-O-Speech rights only apply to books published in quantity and that I'm willing to let anyone read? [I assume I haven't been paying enough attention; if was this easy then Wassenaar wouldn't be effective.] ~mark -----Original Message----- From: Dutra de Lacerda <dulac(a)ip.pt> >How about the best cipher of all?!? The one we carry between our ears? >(Just proving the illegitimacy of such law attempts)

1 0

Re: Text of Wassenaar regulations, with comments
by Arnold G. Reinhold 17 Dec '03

17 Dec '03

At 5:59 PM +0000 12/14/98, Frank O'Dwyer wrote: >"Arnold G. Reinhold" wrote: >> I am not a lawyer and different administrations could issue more >> restrictive rules (as the US does), but the new Wassenaar regulations >> themselves do not seem to affect free distribution of programs like PGP and >> Linux as long as they qualify as "public domain" as Wassenaar defines it. > >Unfortunately, AFAIK copyrighted software is NOT public domain. GPL and >the like usually make a big song and dance to the effect of "this s/w is >copyrighted and not in the public domain". Even worse, I think the >original PGP is pretty clearly not in the public domain, since >commercial uses must be paid for. So does anyone know just how does >Wassenaar define the term "public domain", and is open source indeed >covered? > This is the definition of PD from Wassenaar's "DEFINITIONS OF TERMS USED IN THESE LISTS" http://www.fitug.de/news/wa/Def.html: >GTN "In the public domain" > > GSN This means "technology" or "software" which >has been made available without restrictions upon its further >dissemination. > > N.B. Copyright restrictions >do not remove "technology" or "software" from > being "in the public domain". I think that is pretty clear, but it might be wise for people who are distributing open source crypto to include language in their legal notices stating that the material is to be considered in the public domain for the purposes of the Wassenaar arangement and waving any rights that would cause the export of the material to be prohibited under that arangement. Check with a good lawyer first, of course. Arnold Reinhold

1 0

Forced DNA Collection
by Eric Cordian 17 Dec '03

17 Dec '03

Top Story on AP... NEW YORK (AP) -- Despite objections from civil libertarians, the city's police commissioner proposed Monday to take a DNA sample along with the fingerprints of everyone arrested. Commissioner Howard Safir said the test would solve crimes and help curb repeat offenders. ``The innocents have nothing to fear ... only if you are guilty should you worry about DNA testing,'' he said. ... In Britain, where DNA samples are taken from every suspect, officials have solved 17 major cases using such data since 1995, according to the National Institute of Justice Journal. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

MEDIA RELEASE: Data Fellows Joins the Microsoft Security Partners Program
by Marita Nasman-Repo 17 Dec '03

17 Dec '03

This message comes from Data Fellows. You have previously expressed interest in our products or asked to be included on one of our press release lists. To remove yourself from our mailing lists, reply to this message with the text "remove " in the subject field. PRESS RELEASE FOR IMMEDIATE RELEASE Data Fellows Joins the Microsoft Security Partners Program Helsinki, Finland, December 15, 1998-- Data Fellows, the global leader in developing data security software solutions, has been invited to join the Microsoft Security Partners Program. The Microsoft Security Partners Program (http://www.microsoft.com/security/partners) provides customers with the tools and information they need to establish, test and maintain effective information security for their computing infrastructure. The program brings together software manufacturers, security consultants and security trainers, making it even easier for customers to provide robust security in their Microsoft Windows NT operating system-based networks. Three Data Fellows products are included in the Microsoft Security Partners Program. F-Secure Workstation Suite consists of malicious code detection and removal as well as unobtrusive file and network encryption, all integrated into a policy-based management architecture. F-Secure VPN+ provides a software-based, IPSec/IKE VPN solution scaleable for large corporate networks as well as remote and small office networks. F-Secure FileCrypto is the first and only product to integrate strong real-time encryption directly into the Windows NT-based file system. "Microsoft is pleased to include Data Fellows as part of its Security Partners Program," said Karan Khanna, Windows NT Security Product Manager at Microsoft Corp. "This program will help our mutual customers develop and deploy secure solutions built on the Windows NT platform." "The relationship with Microsoft shows Data Fellows commitment to improve the native security of standalone and networked computers with a comprehensive, centrally managed suite of security services," said Risto Siilasmaa, president and CEO of Data Fellows. "Data Fellows is committed to providing globally available seamless security for Windows users; security that is strong yet easy to manage and economical." Data Fellows is one of the worlds leading developers of data security products. The company develops, markets and supports anti-virus, data security and cryptography software products for corporate computer networks. The company has head offices in San Jose, California, and Espoo, Finland, and branch offices in Washington, DC, Calgary, London, Paris and Munich, as well as corporate partners, VARs and distributors in over 80 countries. All F-Secure products are integrated into the F-Secure Framework management architecture, which provides a three-tier, scaleable, policy-based management infrastructure which minimizes the costs of security management. In addition to the products in the Microsoft Security Partners Program, the F-Secure product line also includes the following products. F-Secure Anti-Virus is the most comprehensive, real-time virus scanning and protection system for all Windows platforms. It utilizes multiple scanning engines, including F-PROT and AVP. F-Secure SSH provides secure remote login, terminal, and other connections over unsecured networks. It is the most widely used secure remote administration tool. F-Secure NameSurfer is the solution for remote Internet and intranet DNS administration. Its easy-to-use WWW user interface automates and simplifies DNS administration. Data Fellows has customers in more than 100 countries. Its customers include many of the worlds largest industrial corporations and best-known telecommunications companies, major international airlines, governments, post offices and defence forces, and several of the worlds largest banks. Data Fellows was named one of the Top 100 Technology companies in the world by Red Herring magazine in its September 1998 issue. Other commendations include the Virus Bulletin 100 % award (several times in 1998); Hot Product of the Year 1997 (Data Communications Magazine); and the 1996 European Information Technology Grand Prize. For more information, please contact USA: Data Fellows, Inc. Mr. Pirkka Palomaki 675 N. First Street, 8th floor San Jose, CA 95112 USA Tel. +1 408 938 6700, fax +1 408 938 6701 E-mail: Pirkka.Palomaki(a)DataFellows.com Europe: Data Fellows Ltd. Mr. Ari Hypponen PL 24 FIN-02331 Espoo Finland Tel. +358 9 859 900, fax. +358 9 8599 0599 E-mail: Ari.Hypponen(a)DataFellows.com -- Marita.Nasman-Repo(a)DataFellows.com, World-Wide Web http://www.DataFellows.com

2 1

....
by Anonymous 17 Dec '03

17 Dec '03

> For fast file-system crypto, you really want to implement the ciphers > so that you encrypt several blocks at a time. ... > I'd like to know how this method compares to using an interleaved cbc > mode - for example 8-way interleaved cbc. The n-way interlaved > cbc-mode works by chaining each n'th block together instead of each > block. [...] Am I missing something? In either case, you need to be sure that changed data is always encrypted with different parameters -- that is, a changed file should be encrypted with a new IV or different offset into S1 and S2. Otherwise, the attacks used to recover badly wiped information could be used to look back in time, so to speak, and figure out which portions of the file were changed. It's more of a problem if you're using ofb o ecb o ofb (i.e., the CFS mode) than an interleaved CBC mode. The 8-way interleaved CBC mode should have different IVs for each "lane" (that is, a monster 512-bit IV) -- otherwise, files data types with repetitions in the headers could be identified. The IV should be secret to completely rule out leakage. However, there are some important restrictions on how you can use the key in making an IV -- I suggest something like this to ensure nothing is messed up: hash the passphrase into K0, use nDES-OFB with K0 to make a K1 and K2, then nDES-OFB with K1 for making the IVs which nDES-interleaved-CBC uses with K2 for the actual encryption. > > astor > > -- > Alexander Kjeldaas, Guardian Networks AS, Trondheim, Norway > http://www.guardian.no/

1 0