December 2003 - cypherpunks-legacy

Re: PGP 2.6 is dangerous in the long term ?
by lefty＠apple.com 17 Dec '03

17 Dec '03

>What if (the cypherpunk community) comes out with a secure program that >doesn't rely on RSAREF? Can it be done? Bizdos and gang will _still_ hold the patent on RSA-style public key encryption. What you're suggesting is, in essence, exactly what Phil Zimmerman did with PGP 1.0. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

3 2

Another AOL
by fnerd＠smds.com 17 Dec '03

17 Dec '03

CDMA -- Carrier (Collision?) Detect Multiple Access, Code Division Multiple Access. Grr. Tim has me started. -fnerd - - - - - - - - - - - - - - - To auditors without the code, calls seem indistinguishable from noise. --George Gilder -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

Re: Graph isomorphism based PK cryptosystems?
by smb＠research.att.com 17 Dec '03

17 Dec '03

This is one of the main reasons behind such publications as the IBM Technical Journal--the publication of results not worth patenting themselves, but definitely worth preventing others from patenting. Actually, no. IBM has a separate publication for just that purpose. The Technicnal Journal (and others like it) are intended as PR vehicles and as gold stars for researchers -- that's an important part of our salary, as it were.

1 0

Re: Trust Models
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 11:52 5/25/94 -0400, peace(a)BIX.com wrote: ... >I have a paper that I am preparing for publication called "Trust >Models" that discusses the difference between PGP & PEM and looks >towards a synthesis of these two models. Since it is not yet >published, I will only send it to those who agree (1) not to >rebroadcast it, and (2) send me their thoughts on it. ... I agree to your condition and would be glad to look at your paper. Trust issues are at the core of secure operating system design as well.

1 0

Re: Graph isomorphism based PK cryptosystems?
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 11:43 5/25/94 -0400, Perry E. Metzger wrote: >Harry Bartholomew says: >> > Jay Prime Positive says: >> > > I only worry that if I publish, it could be patented. And I don't >> > > want the algorithm to end up in the hands of the software patent >> > > folks. Especially if they will be making money off it, and I wont. >> > >> > If you publish, only you could patent it. There is only danger if you >> > don't publish, in which case others can independently make the same >> > discovery and patent it. >> > >> > Perry >> >> But you would then need to file within one year of the publication >> date I think. > >His whole point was that he wanted to render the process unpatentable. > >Perry I talked to a lawyer very recently about this. She does not specialize in patent law but does deal with it. The situation is confusing and fluid. Here is what I think I heard, ommiting occasional caveats: If the patent office knows of prior art (as indicated in some publication) it will not issue a patent. If it does not know then it may issue the patent even if the art is well known outside the patent office. (Software is very new to the PO.) When a patent is contested by virtue of duplicating prior art the PO may admit that they goofed and invalidate part or all of the patent. The PO doesn't like to do this. Litigation is the next step and a judge decides if there was prior art. This is usually expensive. The case of the recent Compton multimedia (?) patent was so egregious that the patent office said that they had goofed and would reconsider. I have not seen the patent but the rumour is that there were few ideas that had not been covered in Goodman's (?) book on Hypercard (?). The book had been out for while before the patent was granted (or submited, I think).

1 0

Orthogonal Checksums?
by fnerd＠smds.com 17 Dec '03

17 Dec '03

Bob is storing a file for Alice. Once in a while Alice wants to check that Bob still has it. The first time, she can ask him to take the MD5 of the file. What about the second time? (A single MD5 he could just store). I've looked it up in Schneier. There doesn't seem to be anything about this exact situation; will the following work? Alice makes a 128-bit random string and asks Bob to take the MD5 of the file with her random string prepended. This is impossible for Bob to compute without the file. Right? Alice, however, can precompute as many of these as she wants (as long as she keeps them secret) so she doesn't have to actually keep the file. -fnerd ps. MD5 of a file with a random string appended to the *end* *can* be computed after having discarded the file. - - - - - - - - - - - - - - - To auditors without the code, calls seem indistinguishable from noise. --George Gilder -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

2 1

Re: Graph isomorphism based PK cryptosystems?
by smb＠research.att.com 17 Dec '03

17 Dec '03

I talked to a lawyer very recently about this. She does not specialize in patent law but does deal with it. The situation is confusing and fluid. Here is what I think I heard, ommiting occasional caveats: If the patent office knows of prior art (as indicated in some publicat ion)it will not issue a patent. If it does not know then it may issue the patent. Etc. Note that the patent office itself has a publication for stuff that you don't want to patent. I know of no better way to get something into their files.

1 0

(fwd) EPIC: 1993 US Electronic Surveillance Stats
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

From: Dave Banisar <Banisar(a)epic.org> Newsgroups: alt.privacy,alt.privacy.clipper,talk.politics.crypto Subject: EPIC: 1993 US Electronic Surveillance Stats Date: 25 May 1994 11:12:20 GMT Organization: Electronic Privacy Information Center Lines: 101 Distribution: world Message-ID: <2rvbqk$60e(a)news1.digex.net> NNTP-Posting-Host: cpsr.digex.net X-UserAgent: Version 1.1.3 X-XXMessage-ID: <AA0953E05402D314(a)cpsr.digex.net> X-XXDate: Wed, 25 May 94 23:13:36 GMT >From the EPIC Alert 1.01 ----------------------------------------------------------------------- [1] Federal Electronic Surveillance Increased in 1993 ----------------------------------------------------------------------- Fueled by an increased use of electronic surveillance by federal officials in drug cases, the number of wiretaps and microphones installed by federal, state and local law enforcement officials increased by six percent in 1993 over the previous year. There were also substantial increases in the total number of days in operation, extensions granted and in the cost of each order. However, the efficiency of wiretaps continues to decline as the percentage of relevant communications intercepted has dipped below 20 percent for federal investigations Federal and state courts approved a total of 979 requests, the highest number since electronic surveillance was legalized in 1968. Federal orders increased by 33 percent from 1992, while state investigations decreased by nine percent. No surveillance requests were rejected or amended. In 25 years, only 27 requests have ever been rejected, two most recently in 1988. Narcotics Main Offense Cited The vast majority of cases investigated involved narcotics. Seventy-four percent of the federal investigations and 69 percent of all investigations were for narcotics related offenses. These figures continue long-standing trends. Use of electronic surveillance in narcotics cases has increased 240 percent since 1980 and over 500 percent since the legalization of electronic surveillance in 1968. Use of the technique in investigations of other offenses has decreased or remained at similar levels. Federal Use Increases Federal investigations accounted for nearly half of all requests for electronic surveillance in 1993. Federal judges approved 450 requests, a 30 percent increase in requests over 1992. The 450 requests approved by federal judges represent a 30 percent increase over the previous year. Federal use of electronic surveillance has increased nearly 450% since 1980. Fifty-one federal judicial districts utilized electronic surveillance in 1993. The Southern District of New York, which includes New York City, and the Eastern District of Michigan, which includes Detroit were the areas with the highest number of orders. State Use of Electronic Surveillance Declines State use of electronic surveillance declined by nine percent from 1992. State use was at its peak in 1973, when 734 orders were approved. Since the mid-1970s, the average number of state orders has fluctuated between 450 and 550 per year. In 1993, only 23 states used electronic surveillance. New York had the highest number of orders - 204. New York, New Jersey and Pennsylvania accounted for 73 percent of the state surveillance orders. Efficiency Declines As the use of electronic surveillance has increased, its efficiency as a law enforcement tool has substantially declined. The majority of conversations overhead are determined by prosecutors to be irrelevant to any investigation. In 1993, prosecutors determined that only 20 percent of all conversations were relevant. For federal investigations, only 17 percent were relevant. These percentages have decreased significantly since the 1970s when prosecutors reported that, on average, over half of all conversations were relevant to an investigation. ======================================================================= To subscribe to the EPIC Alert, send the message: "subscribe cpsr-announce <your name>" (without quotes or brackets) to listserv(a)cpsr.org. You may also receive the Alert by reading the USENET newsgroup comp.org.cpsr.announce ======================================================================= The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues relating to the National Information Infrastructure, such as the Clipper Chip, the Digital Telephony proposal, medical record privacy, and the sale of consumer data. EPIC is sponsored by the Fund for Constitutional Government and Computer Professionals for Social Responsibility. EPIC publishes the EPIC Alert and EPIC Reports, pursues Freedom of Information Act litigation, and conducts policy research on emerging privacy issues. For more information email info(a)epic.org, or write EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. +1 202 544 9240 (tel), +1 202 547 5482 (fax). The Fund for Constitution Government is a non-profit organization established in 1974 to protect civil liberties and constitutional rights. Computer Professionals for Social Responsibility is a national membership organization. For information contact: cpsr(a)cpsr.org

1 0

My 2.3a Key is listed as a 2.6 on MIT
by Brian Beker 17 Dec '03

17 Dec '03

On the WWW I went over to Brian LaMacchia's announced new keyserver and looked myself up. I was amazed to see that my 2.3a key now carries a 2.6 version number and lists an 8-bit key ID. The key ID is identical to the old one with two new characters up front. I have never ordered 2.6 because I'm satisfied with 2.3a and rely on it for communications with people outside the US. Does this bizarre "upgrading" mean that my key, as downloaded from that server, will function as a 2.6 key and become incompatible with 2.3n versions after the September 1st deadline? And what are the other implications of the keyserver evidently automatically changing version numbers and ID's on public keys previously resident on the list? I am bothered by seeing my key differ in any way from the way I originally generated it. Brian Beker

2 1

Re: My 2.3a Key is listed as a 2.6 (Aaargh!)
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Haa, *my* key was also converted to a 2.6 key (certainly just s/2.3a/2.6/g; , but it _is_ a 2.6-Key now). Now my public key is a 2.6 key and I am not allowed to have or use 2.6, because I'm german. Isn't it lovely? Hadmut

5 4