December 2003 - cypherpunks-legacy

NEED STATISTICS ON LOST CRYPTO SALES
by Stanton McCandlish 17 Dec '03

17 Dec '03

Something of import, and something you can DO. Please see note at end. Pardon the crosspostings, but this needs to get around. _______ begin forward ____________________ NEED STATISTICS ON LOST CRYPTO SALES The Software Publishers Association (SPA) has been working to bring about the liberalization of export controls on mass market software with encryption capabilities. SPA's much-publicized study of the foreign availability of cryptographic products has clearly demonstrated the widespread and easy availability of encryption that is stronger than what U. S. firms have been able to export. However, NSA claims that software companies have not demonstrated sufficiently the economic harm they have suffered from export controls. Congress has told us that without better economic harm statistics, our chances of liberalizing the export laws are slim. Therefore, WE NEED YOUR HELP. If you or your firm has lost business because you have not been able to export your encryption product, please let us know. Be as specific as possible. It is the cumulative effect of this information that will be most compelling. Please pass this on to those in your firm who might know about these matters or might also be able to respond. Please send replies to i.rosenthal(a)applelink.apple.com or to Ilene Rosenthal, General Counsel Software Publishers Association 1730 M St. NW, Suite 700 Washington DC 20036 (202) 452-1600 ext. 318 or to Douglas Miller (same address) (202) 452-1600 ext. 342 ________ end forward _______________ Please also send this info to eff(a)eff.org! We're all in this one together! -- -=> mech(a)eff.org <=- Stanton McCandlish Electronic Frontier Foundation Online Activist & SysOp "A nation that is afraid to let its people judge the truth and falsehood of ideas in an open market is a nation that is afraid of its people." -JFK NitV-DC BBS 202-232-2715 Fido 1:109/1103 IndraNet 369:111/1, 14.4V32b 16.8ZyX Join EFF! For more information about membership, send mail to eff(a)eff.org

1 0

"Root Canal" questions
by David Sobel 17 Dec '03

17 Dec '03

"Root Canal" questions >In the latest CPSR update: >> "Each FBI Special Agent in Charge's contacting key law >> enforcement and prosecutorial officials in his/her territory >> to stress the urgency of Congress's being sensitized to this >> critical issue; > >Isn't this a violation of the Hatch Act? Either on the part >of the agents, or on the part of the "key" officials directly >"sensitizing" Congress, or both. The Hatch Act applies only to "partisan" activity (i.e., electoral). There is, however, a very real question as to whether or not the activity we've uncovered might violate 18 U.S.C. Sec. 1913, which prohibits the use of "appropriated funds" for lobbying purposes. I'm in the process of looking into that. There's no way to read this material without concluding that the Bureau was undertaking an orchestrated, agency-wide lobbying campaign in support of the "Root Canal" initiative. BTW, anyone have ideas about that name!? David Sobel CPSR Legal Counsel

1 0

Instant check system
by kone＠COURIER1.SHA.CORNELL.EDU 17 Dec '03

17 Dec '03

Jim Miller asked about the "Brady Bill" instant check system. In the House version no deadline is set for the nation wide system. As for fingerprints, it is one of the ways the bill authorizes to check back grounds. My over payed earrend boy, Congressman Hinchy, got a copy of the bill for me and two of my Cornell pre-law friends looked it over. We still don't know what they want in the end. (not counting the total ban.) The bill did refer to an "individual number" a lot. It is not clear if the "individual number" is your SS number or the serial number of the weapon. I personly like the idea of instant check, if my privacy can be preserved. The last thing I want is either a convicted "rights-violator" with a weapon or someone keeping track on what I buy or don't buy. I have been trying to keep my life out of as many records as possable, and am a bit worried by the vage instant check program. (is visiting a srink for depresion a sign of mental instablity?) Ther should be a way for individuals to check on their own record, as often as they want, yet not alowing for others to check. i.e. the sellor types in your number (public key) and the confuser says OK or NOT OK. You type in your private key and see your arest record and such. One final item, I do agree that weapon ownership is not the issue we should talk to, but how can we protect our privacy yet keep "rights-violators" from open access to weapons. William Kone "I have trained over a thousand young men to eat, sleep, and shoot with their weapon. But, I still get worried the first time I give them the rifels."

4 3

Re:Bandwidth limitations
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Perry writes: >The human genome fits nicely in 1 GB. Mere Gigabit networks could allow you >to send your whole genome in seconds -- and fiber can do many orders of >magnitude better than that. The human genome has approximately 3 x 10^9 base pairs. Each base is represented as the following binary code: G=1000, A=0100, T=0010, C=0001. Thus the human genome represents about 3 gigabytes of info (uncompressed), as Perry said easily transmitable by fiber optics. When you all do finally get your genome sequenced, the last thing you should do is let anyone see it (perhaps only small segments of it). I can think of no better use for cryptography than to keep citizens genomes to themselves. Would you give anybody a crystal ball which tells of your past, present and future? Some of us write genetic code and, IMHO, one's own genetics are a source code which should not be freely distributed. Scott G. Morham !The First, VACCINIA(a)uncvx1.oit.unc.edu! Second PGP Public Keys by Request ! and Third Levels ! of Information Storage and Retrieval !DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLONRDD2paOMjHHAhAQHKTQP9ExGhcllgQrSVLPaucpEM+1/6HSUcyf71 OC4dloljbhV2S0qu1VnutiyPHa/OwZyDu0prXA1Xt+8q17CVsMKgmp38xVO/i1fy JOrw+9EOUE4K13HLGiH0GPE07gow8MoaYqIGN4a6gqHFDoejOi27zNoAz/gulVr9 0xNUIWSfE28= =Cvzf -----END PGP SIGNATURE-----

2 1

Re: Instant check system
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Mike McNally writes: > The Brady Bill is just a gun-grabber Creationist plot to foil > Nazi Abortionists who don't realize that Libertarinaism is the only > true way to distinguish saffron from turmeric. What about the Nazi Abortionists who *do* realize that Libertarinaism is the only true way to distinguish saffron from turmeric? Will we still be able to get guns? :-) I'm beginning to regret my 'Brady Bill and Instant Check system' post... Jim_Miller(a)suite.com

1 0

VMS Password security
by baldwin＠LAT.COM 17 Dec '03

17 Dec '03

One of the barn-door sized holes in VMS was (still is?) that VMS used the Purdy Password hashing function. I considered using it for the Oracle RDBMS password function, but dropped the idea when I realized that it is possible to invert the hash function. I don't have my notes, but I recall that it only took me a couple days to work it out. The problem is that many passwords hash to the same value. It is actually hard to find out the true password that someone else chose, but easy to find another password that will hash to the same value. The hard part is finding a printable password that maps to the desired value. --Bob Baldwin

1 0

Re: Should we oppose the Data Superhighway/NII?
by jazz＠hal.com 17 Dec '03

17 Dec '03

Okay, now let's look at Tim May's hypothetical case. Tim wants X-rated cable. But the first nine cable companies don't want to provide it. And the Metzger-Godwin Cable operation, which would provide it, can't get financing. There's a market for it, but there's also a barrier to entry. If there's a market for it, investors will poney up the money; that's just the way it works, Mike. I leave to your imagination what happens in the event that we *do* start the P-G Cable company, but content providers won't sell other programming to us so Tim is forced to choose between only X-rated cable--us--and cable services that provide other kinds of programming. (Tim may have no problem with this, but lots of other people in our market will want to watch CNN as well as X-rated videos.) Cable, like many other utilities, doesn't restrict you to a single provider. I can imagine having phone lines from two local loop providers to maximize redundancy; similar for an information utility, where the information provided will likely differ from one provider to another. In the cable business, two companies will not want to compete on price; they'll try to compete on content instead, each having exclusive material. The ideal situation from the cable companies' perspective is for customers to *want* to subscribe to more than one. The infrastructure will grow to allow it. Wouldn't it be better to live in a world in which the cable infrastructure, like the telephone infrastructure, could be serviced by competing providers, and at the individual level? We already have this with long-distance--if I want, I can have Sprint, MCI, *and* AT&T accounts and use them all from the same phone. Ultimately we'll have it in the local loop. If you have competition in the local loop on shared infrastructure - who owns that infrastructure, who maintains it, who allocates costs? Probably some neutral 3rd party, possibly regulated. Square one. > > They used the same wires, Perry. > > Nope, they didn't. If necessary, we can dig up references. Oh, you're saying that one couldn't make a phone call from one local phone company to another? Exactly correct; you had to know which company provided service to your party and use their equipment. Much like dialing 1-800 numbers from overseas; you have to contact the US operator for the company that provides 800 service and ask them to hook you up. Perhaps 800 number portability will solve that, though; are you suggesting something like the infrastructure that supports 800-number portability will appear at the local-loop level as well? Not any time soon; they can barely get the 800 number stuff to work right, and local loop is three orders of magnitude larger. Jason Zions

1 0

The Depravities of Cypherpunks
by jazz＠hal.com 17 Dec '03

17 Dec '03

>Also, I have mail from Mr. Jason Zions (jazz(a)hal.com) also complaining >that I violated Mr. Metzger's privacy in revealing his mailbomb to me >to the list as a whole. This strange code of cypherpunk chivalry I am >not familar with. It's not chivalry; it's copyright law. The creator of a message owns the copyright to that intellectual property; the recipient owns the copy of the message, much like one who buys a recorded album owns the copy of the work. The message you quoted contained the statement "Do not forward/reproduce this message" or words to that effect. That is a clear statement by the copyright holder which limits any redistribution rights that might have otherwise become yours upon receipt of the message. Given the nature of the communication (i.e. mention of potential email bombing), I believe you'd be within your rights to share the threatening content of the message with upstream mail host admins who might play a role in preventing such an occurance; but no further. It's also common courtesy. You can have significant disagreements with a person, yet still honor their simple requests. Jason

1 0

Key Sharing Protocols
by an7822＠anon.penet.fi 17 Dec '03

17 Dec '03

I'm working on an internal protocol for securing company records and I'd like to solicit some net.wisdom. One of my requirements is to ensure that no data is lost if an employee quits, is fired, dies, etc. At the same time, I don't want to have a security officer with the "keys to the castle" for every user. I've had these ideas, so far. * Use PGP for all encryption, for both E-mail and personal files on disk. * For personal files, encrypt with your own public key. This allows all files and communications to be encrypted while using one passphrase, which may be changed without having to re- encrypt files. To allow for loss of a passphrase, for whatever reason, use a secret sharing protocol to split the secret key of the user into several pieces, held by designated security officers. Reconstruction of the key will require cooperation by "n" security officers. I have some problems with this. * While I can extract the secret key from the user's private keyring, it is still encrypted by the user's passphrase. Is there any method for extracting an unencrypted key? * If there is no way to produce an unencrypted key, I could have the user extract her key after setting her passphrase to some standard value, and then change it again after extraction. * How can I ensure, without reconstructing the key from my secret sharers, that the key and passphrase I have been given are, in fact, correct. If I could produce an unencrypted key, I would just have to verify that this was the correct private RSA key. If the private key can only be extracted encrypted, I have to verify both the standard passphrase and the private RSA key. I would be interested in comments and suggestions on this proposed protocol and the unresolved issues. My intent is that a user be able to generate a key pair, run a job to split the key into n segments for the sharers and have the sharers able to verify that they have the correct key, without having to reassemble the key. Has anyone implemented code for any of the secret sharing protocols, or am I going to have to reinvent this particular wheel? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

(fwd) Netcom adds access in Denver area
by jazz＠hal.com 17 Dec '03

17 Dec '03

Gee, it'd sure be nice if they showed up in Austin. Hint, hint. Jason

1 0