December 2003 - cypherpunks-legacy

Re: Why RSA?
by derek＠cs.wisc.edu 17 Dec '03

17 Dec '03

First, my sincere gratitude for the replies to my queries regarding public key cryptography patents. To pay back such generosity, I will summarize. Also, I have done a little more digging and will present my findings, even though those findings include more questions! My original question was why cypherpunks don't just pick some non-RSA public key algorithm to achieve widespread distribution of cryptographic tools. My contention is that for such widespread distribution to occur, the price must be small in comparison to the average user's electronic communication outlay, and the tools must be beyond reproach legally so that it can be distributed by commercial email tool providers in a form that is elegantly integrated into the user's environment. My mother will not fetch, install, and configure PGP, though she might pay $10 - $20 more for an email product with "privacy enhancements". My reading of the comp.patents FAQ leads me to understand that any use of PGP by an individual in the U.S. is in violation of U.S. law (though the chances of being prosecuted are vanishingly small). Cypherpunks probably don't care too much about that, but the masses waiting for conversion probably do. The reasons for the desirability of widespread public key tools are obvious, even without considering the collapse of governments. For example, digital signatures can be used to authenticate electronically-distributed software upgrades, and so on (but this is all old hat to the folks on this list!). Unfortunately, as Perry Metzger pointed out: > All are patented in so far as one of the patents covers ALL public key > schemes. Some, like Rabin's scheme, have possible technical advantages > over RSA. First, a note: "Rabin's scheme" is (as Perry said) the one provably linked to factoring (a major advance!) and I assume it's the one implemented in RPEM. According to the RIPEM FAQ, PKP squashed that development by claiming that their patents were broad enough to cover Rabin's scheme, and the effort was abandoned "for pragmatic reasons" (another example of how superior technology can be suppressed by monopolies). Now, I've looked a little further into the patent issue, and I remain kind of confused. I went to the library and read the four patents in question (but only made a hardcopy of the first chronologically). I found the documents difficult to understand (for legal rather than crypto-tech reasons). All four applications were made in 1977-1978, and the patents were granted variously from 1980-1984. The earliest one has Hellman, Diffie, and Merkle as inventors; the second just Hellman and Merkle. Both are assigned to Stanford University. It seems to me that one of these is the one that covers, broadly, public key cryptography -- presumably the earliest one (4,200,770), since it has all three major players as inventors and the language of the eight claims seems to be rather broad (though only the second patent, 4,218,582, has the phrase "public key" in its title). Patent 4,405,829, granted in 1983, is for the RSA algorithm [footnote: the RSA patent apparently celebrated its tenth birthday two days ago; was there a party?]. There is no overlap between this patent's inventors and assignees and the earlier more general patent. Here's a question for somebody in the know: if the earlier patents cover all public key cryptography and RSA is a public key system, isn't it in violation of the earlier broader patent? Does PKP pay license fees to Stanford, or were they granted exclusive rights by Stanford as well as MIT? Similarly, apparently a public-key scheme called Warlock has been granted patent protection. How is this possible if somebody else holds patents covering all of public key encryption? If I understand patents correctly (hah!) they last for 17 years from the time they are granted. This means that the earliest public key patent will expire in about 3.5 years. After that presumably there will be no restrictions on new public key systems. The RSA patent would expire in 2000. If somebody could clarify which patent is the "broad" public key patent, I'd appreciate it (even with them right in front of me, I can't tell)! My guess is that it would have to be either 4,200,770 or 4,218,582 -- if it's the latter, how did Merkle get squeezed out of inventorship? Respondents to my initial questions pointed out that the patents may be over-broad and could be challenged on those grounds; given the history of how public key crypto was invented, it seems to me that it would be difficult to contend that the idea is obvious (Simmons says that the idea "stunned" the crypto community) -- but I'm no lawyer, and I'll leave that issue to those with more skill, brains, and money than me! For now, then, my conclusion is that for four more years at least, licensing RSA from PKP is probably the only viable commercial option for companies who wish to give their users public key crypto capabilities. It seems that the designers of Internet Privacy Enhanced Mail (PEM) agreed with this assessment, as they took the unusual step of including proprietary RSA in their standard. For their part, in RFC 1170, PKP states: "We assure the interested parties that Public Key Partners will comply with all of the policies of ANSI and the IEEE concerning the availability of licenses to practice this art. Specifically, in support of any RSA signature standard which may be adopted, Public Key Partners hereby gives its assurance that licenses to practice RSA signatures will be available under reasonable terms and conditions on a non-discriminatory basis." That sounds good -- but is troublingly vague. I have stated earlier what *I* think is are "reasonable terms" for the inclusion of a minor feature like PEM-compliance in an email processing system, but I don't get to decide that. If anybody knows more specifically how the standards bodies interpreted "reasonable", please let me know. As I am contemplating developing a PEM-compliant product, I will be writing to PKP to discuss licensing arrangements, but information from others (best: expressed publicly) would be helpful. If RSA is the only game in town, let's at least be clear about the price of admission. There seems to be a chance that manufacturing PGP-aware products (but not distributing PGP itself) could slide by, but it could also be interpreted as "inducement to infringe" which would apparently be actionable. The second point in my earlier message, largely obsoleted by the answer to the first, involved the development of new public key systems. Given that selling or otherwise using or distributing a new system now would invite litigation, the question is rather moot, but I'd like to thank L. Detweiler and P. Metzger for their comments on the all-important issue of trusting new algorithms. Finally, I suppose that it's always possible to come up with some radically new encryption technique that could be used to support authentication and yet have nothing to do with public key crypto... but I'm not holding my breath. Regarding the recent proposals for the construction of a toolkit, I'm all in favor and would personally welcome the opportunity to contribute to such an effort as a hands-on supplement to my crypto education. I have extensive experience with C and C++, and am VERY familiar with TCL (pronounced 'tickle', for those not in the know). A good start would be a clear statement of purpose. If this "Why RSA" thread has been too basic and has caused frustration for that reason, please forgive me. I have learned a great deal, and I hope that somebody somewhere else has profited as well. derek

5 6

Re: the public key minefield
by baumbach＠atmel.com 17 Dec '03

17 Dec '03

> derek(a)cs.wisc.edu (Derek Zahn) > >* in broad terms, what would I have to do to develop an > > algorithm that works from a user's perspective like > > p.k.c. (ie public/private keys, the central functional > > point of all the wonderful schemes based on pkc) but > > doesn't violate patents? L. Detweiler writes: > others have well addressed how patent issues are involved in this. but > this appears to be a simple technical question on one level. What does > it take to come up with a good public key system? How about a poor public key system? What is the simplest public key system you can invent, if you didn't care that it is trivial to break? If the NSA can crack RSA, does that change the fact that it is a pkc? message=99 public_key= 1/3 private_key= 3 encrypted_message= message * public_key message= encrypted_message * private_key Would PKP reading of their patent claims cover this pkc? Seems overbroad! Peter Baumbach baumbach(a)atmel.com

1 0

No Subject
by Eric.K.Kuecherer＠Dartmouth.EDU 17 Dec '03

17 Dec '03

Please remove me from the list. -kuech-

1 0

Re: Why RSA?
by accom!erc%accom＠uunet.UU.NET 17 Dec '03

17 Dec '03

> My > reading of the comp.patents FAQ leads me to understand > that any use of PGP by an individual in the U.S. is in > violation of U.S. law (though the chances of being > prosecuted are vanishingly small). I doubt it - the reason why is because under patent law, ther is an exclusion granted for educational, research, or experimental purposes. So, if you're using PGP to make money, you are in violation of PKP's patents (assuming they are, in fact PKP's patents to begin with and that Stanford and MIT had the right to reassign exclusive rights to something that was developed with public funds) and they would be quite right (legally speaking) to come and sue your ass off. ;) > in violation of the earlier broader patent? Does PKP pay license > fees to Stanford, or were they granted exclusive rights by Stanford > as well as MIT? I doubt that this would stand up in court. Universities often grant development and marketing rights to patents for stuff developed by them, but I seriously doubt that this is what either the original drafters of the patent laws or Stanford had in mind when they granted rights to PKP to develop and market the stuff. -- Ed

1 0

IDEA implementation
by danodom＠matt.ksu.ksu.edu 17 Dec '03

17 Dec '03

With all this talk about various libraries going on, I figure I might as well ask this: Is there an implementation of IDEA that will let me do something like this: encryptedbuf = encypher (databuf, buflen, passphrase); Where the arguments mean the obvious, and databuf can be of arbitrary length? If not, I may do it, but I wouldn't want to duplicate efforts :-) -- Dan Odom danodom(a)matt.ksu.ksu.edu -- Kansas State University, Manhattan, KS PGP key by finger or request.

1 0

Re: reporter seeking interview subjects
by judic＠netcom.com 17 Dec '03

17 Dec '03

>In <93Sep17.230857pdt.14382-4(a)well.sf.ca.us>, Matt Binder wrote... >> Hi, my name is Matt Binder. Please help me... >> I'm a radio reporter in the SF Bay area working on a series >> of pieces about invasions of privacy in the computer age. I'm >> looking for interesting "case studies" that I can use to horrify >> my listeners out of their complacency. > >I think it's really important that if you're looking to shock your audience >that you also show a glimpse of not only the "light at the end of the >tunnel" but also a glimpse of the reasons that people would be better off >making a dash for the end of the tunnel than trying to run back to the >tunnel's start. Otherwise, you're just fueling the anxieties of countless >luddites and techonophobes. > >> My most immediate need is >> to find someone whose medical records were used (perused!) > Thanks, Stig, for forwarding this for my "more immediate <ahem> attention." Matt, I agree with Stig that it's important not to horrify anyone out of anything unless you also give them something concrete that they can do about it. In most cases, invasions of privacy aren't something empowering, nor can most people do anything about them but know and worry. I don't find this too constructive. There are a couple of stories that you might be interested in, in any case. One is that San Francisco (and other counties across the state) is testing a plan to fingerprint all General Assistance recipients. You can get testimony from hearings conducted earlier this year from a friend of mine, Jim Davis <jdav(a)igc.apc.org>. I know that CPSR in Berkeley is planning on holding a meeting in late October to explore and talk more about this issue. Fingerprinting will be on the November ballot, btw. Second, the state has had a database system designed to track all recipients of state money. That is, if a day care center receives any state aid, all the kids go into the database. (They can't be removed, once added, until they turn 18 and file a petition with the state.) State aid is another part of this package, as are jail participants, and other state-oriented program participants. You can see this is just a short step from adding tax-payers, businesses, and everyone else that has anything to do with the state... The scary part of the above story, in case that wasn't enough, is that state hospitals and medicaid recipients are also in the database. The idea is that if a patient goes to another county, they can get consistent care, and not be able to "double-dip" from state agencies. Of course, that also means that many state agencies have access to confidential medical info about a lot of people (who, by nature of their being on the state's systems, are powerless). Furthermore, the designer of this system hasn't shown any priority or sophistication in creating levels of security so that people that aren't supposed to have access really don't. A friend just reminded me that there was a radio program on recently, This Week in California (KQED) which talked about the Alameda Co. system. This is an expensive system, and they didn't find any evidence of fraud. Good luck with your stories. I hope this gives you something to start with. yours in scary things, judi

1 0

Re: nonrandom string
by remail＠tamsun.tamu.edu 17 Dec '03

17 Dec '03

> Return-Path: <@CORNELLC.cit.cornell.edu:cjl@micro.med.cornell.edu> > Date: Mon, 20 Sep 93 17:02:49 EDT > From: cjl(a)micro.med.cornell.edu (Chris Leonard) > To: cypherpunks(a)toad.com > Subject: nonrandom string > > > I address this to the list at large hoping that one or more of you can > explain something unusual that I observed. A friend of mine and I have been > using PGP for several months and I just recently noted that in at least three > of the recent posts to me that the first 18 characters of the encrypted > message were identical. The first words of the plaintexts were not identical > and so I assume that these characters are something else, perhaps the stuffer > that I have heard mention of on this list. This repeating string is of > concern for obvious reasons (e.g. so much for anonymity), and I would like to > understand the cause of its recurrence. > > Please post to me and I will post a precis of the most reasonable suggestions. This is normal. PGP labels each message with a byte that defines its type (for messages between people this is a byte that indicates that what follows is public key encrypted) followed by type dependant information. Among the things in the first bunch of bytes are the KeyID (low order 64 bits, so this is eight of the bytes you see) of the destination's key. If you are always sending to the same person (i.e., the same key) these will always be the same.

1 0

P. Wayner on CSSPAB meeting
by L. Detweiler 17 Dec '03

17 Dec '03

an eternity ago in cyberspatial time (a few days ago in real time) P. Wayner posted some comments about the latest CSSPAB meeting. He hasn't appeared to have gotten any direct feedback on the list to that report, which I think is a pity, because he's one of the few cypherpunk `infiltrators' not only consistently attending important national government meetings, but conscientiously reporting them on the list (which involves a significant amount of labor) often to no reward but flames! (there's been quite a bit of indirect reaction to the `software Skipjack CRADA proposal he illuminated.) Anyway, my personal thanks! Cypherpunks, its in these kinds of reports that very important clues of future NSA directions are buried, and I'll start off with a gem: >A group of computer scientists from NIST came to discuss their plan >for the Federal Criteria for secure systems and the new "Common >Criteria" that may emerge. This is an updated version of the old >Orange Book classification scheme of C2 and B1 and stuff like that. >The scientists said the draft is being finished but it isn't ready >for release. But now, they're working on "Something Better." This >is a new plan to standardize the grading of secure systems with >other countries and evolve a "Common Criteria." In general, the >board groused about the fact that the public and industry have never >been invited to give comments during the process. The summary >of this talk is: "We might be able to tell you something someday." `other countries'? `Common Criteria'? holy cow, this is something *very big* in the works. The U.S. can barely figure out its *own* cryptographic policies, and imagine the sheer logistical nightmare of trying to come to an agreement between the most isolated and imperious agencies! I suspect GCHQ (Britain's NSA) would be involved in this at least. (There is a very cozy relationship between NSA and GCHQ that Kahn was harassed for revealing in _CodeBreakers_.)What other agencies? Mr. GraveDigger, the man in charge of NSA's Key Escrow: >He filled the hour with more descriptions with all of the restrictions >that they place on wiretaps at the Justice department. Once again, I >found myself wondering why they are going through so much trouble >over something that just seems to cause them grief. The taps cost >money. They divert manpower. Etc. Yet, the FBI and the rest of the >community is willing to go through a full court press on this topic. >The taps are essential in crime encapsulated in conversations (i.e. >influence peddling, bribery). but this only suggests how much of a crutch they have become for these agencies. They are terrified of losing this tool, for which they have come to rely on disproportionately. They have come to associate their job security with wiretapping -- a very dangerous proposition for freedom. >Some people from the Social Security Agency came to tell the board >about their internal security procedures that they use to track down >people inside the agency generating information for outsiders like >private detectives. They routinely run sting operations where they >call up information brokers and ask them to get a Social Security >file for an individual. Then they watch for accesses to that record >and flag the miscreant. fascinating. has this ever been noted before? the IRS would have benefited from this a few months ago. Or, on second thought, nevermind! all the tax evaders on the list will object to the IRS getting any help! >Dorothy Denning came to say that there was no final report from the >outside team performing an outside review of the Clipper algorithm. >In general, she said that the comments have been favorable to their >work. Several members of the board questioned the independence of the >review given that it was done at the NSA using NSA's computers and >NSA's programmers. They also wondered about the depth of the review >because it was apparent that Denning leaned heavily on the NSA's >analysis. reassuring to hear Dingaling is still alive and plugging away... I wonder what her next Lead Balloon will be? [EFF's Digital Privacy & Security Working Group] >The group feels that it can accept >Clipper if any participation in the key escrow program is completely >volutary. They proposed to test the administration's committment >to volunteerism by noting whether they relaxed export requirements. >To me, the statement was little more than a political gambit. All >of the companies involved in the DPSWG really, really, really want >export restrictions eased. So they offered their support for >Clipper as a quid pro quo. Let us export anything (not just Clipper) >and we'll support it. This is a very interesting stance, and IMHO not a bad tradeoff, if `support' means `lack of active attack and criticism'. But the NSA would never agree to this in a cyberspatial lifetime. We *still* don't even have any substantial promise that Clipper is guaranteed to be voluntary, let alone export restrictions relaxed. (Hypocritically, the announcements have always touted Clipper as Voluntary, the last redeeming feature cited by scoundrels like Dingaling and Sternlight, without ever guaranteeing it, and potentially even hiding the plan of *revoking* that aspect.) The plan, very likely, is quite to the contrary: increase market penetration of Clipper to the point that restricting other cryptography in subtle and insideous ways becomes possible. And I'm still waiting for the announcement in blaring fanfare that Clipper-based hardware can be freely exported, nothing else. I think its close on the horizon. Once they get chips that work :) [crafting official group report] >Most of the board wanted to say that the Clipper chip was >a pain in the neck that wasn't worth the trouble [...] >The fight seemed to break down between government employees and >non-government employees. Those outside the government kept arguing >for stronger language and those inside kept saying things like, >"But expensive relative to what? We don't have any concrete cost >estimates." hee, hee. the U.S. Civilization in a microcosm.

1 0

Bill O Rights
by Jiva De Voe 17 Dec '03

17 Dec '03

Lil while back someone posted something about "Our rights are dropping like flies" aboiut various violations of the Bill Of Rights.. could someone re-email that to me? Thanks! :)

1 0

Propriety of crypto on Munitions List
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

In U.S. v Martinez, Elizabeth Martinez and her fiance were convicted of violating the Arms Export Control Act by exporting cryptographic hardware, namely "Videocipher II" video descrambling devices. (I believe these are used to descramble satellite TV broadcasts of HBO and other networks.) Defendants appealed, asking the court to overturn their conviction on the grounds that "the inclusion of 'cryptographic devices and software (encoding and decoding)' on the [Munitions] list is overbroad because this heading includes items already in the public domain whose dissemination would pose no security threat, and which lack any characteristic that is inherently or predominantly military." The 11th circuit appellate court rejected this argument in 904 F2d 601. The court decided that the question of whether an item properly belongs on the Munitions List is inherently political and is excluded from judicial review. "The question whether a particular item should have been placed on the Munitions List possesses nearly every trait that the Supreme Court has enumerated traditionally renders a question 'political'.... No satisfactory or manageable standards exist for judicial determination of the issue, as defendants themselves acknowledge the disagreement among experts as to whether Videocipher II belongs on the List.... Neither the courts nor the parties are privy to reports of the intelligence services on which this decision, or decisions like it, may have been based.... The consequences of uninformed judicial action could be grave." In these days of judicial activism, it is ironic that one time when civil libertarians might wish the court to take a hand and reverse a decision made by the other branches of government, the court chooses not to do so. Shortly before this decision was issued, the AECA was amended by adding the following section, 22 USC 2778(h): "The designation by the President (or by an official to whom the President's functions under subsection (a) have been duly delegated), in regulations issued under this section, of items as defense articles or defense services for purposes of this section shall not be subject to judicial review." So Congress and the court agree that the propriety of an item's placement on the Munitions List is not a matter for the courts to decide. There appears to be little chance that any prosecution for AECA violations will result in the judical removal of cryptographic equipment from the Munitions List. Hal Finney hfinney(a)shell.portal.com

1 0