December 2003 - cypherpunks-legacy

Re: IMP (was Re: ecash-info (fwd))
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > 1.) Chaum's e-cash coupled with WWW/Mosaic is a de facto internet > > mercantile protocol. It ain't de facto until a lot of people are using it. I suspect PGP with credit card numbers in free-form ASCII is almost as common, at least for now; there are 4 or 5 groups I've seen that will accept that. And phone calls or faxes to the number on the bottom of the ad on Usenet probably outmumber those... In particular, digicash isn't a standard until there's at least one bank a lot of people can access via digicash. However, it's certainly a nice approach. Credit cards do take care of one of the objections Hal mentions, which is how you can trust your vendor to ship you the goods instead of absconding with your cash. Some of the digicash protocols can help with that process, at the cost of privacy - the spender can reveal the number of the coin that was ripped off, but the receiver may have cashed it via anonymous remailers, making it difficult to prove who's telling the truth in court, especially when the goods were software delivered by anonymous remailer chains as well. Bill

1 0

Re: PGS bug! (fwd)
by ER CRAMER 17 Dec '03

17 Dec '03

I tried to reply to this messages but it was bounced back to me... So I mail it to this list... > > I like your PGS shell a great deal. Thank you for writing it. > > Thank you for liking it ;-) > > > However, I have found what appears to be a small bug. I do not have my > > keyrings in my pgp directory. They are in a separate directory, specified > > via the PubRing, SecRing, and RandSeed directives in 'config.txt'. When I > > load PGS, it checks my pgp directory for these files, does not find them, > > and asks if I want to create a secret key ring. When I answer no, the > > program generates a General Protection fault #13, which is gracefully > > caught and handled by QEMM386, my memory manager. > > We don't support keyrings that aren't in the PGPPATH (at least not yet). > To tell you the truth I didn't know of hte PubRing, SecRing and RandSeed > directives... I guess I can take a look at it, maybe it's easy to change... > > If you answer NO on the question to create a keypair PGS should quit. I have > know problem with QEMM myself. What version of QEMM do you use??? > BTW: I tried out the PubRing and SecRing directives in my config.txt but they where nog supported... Does anyone knows something about it??? ... If you outlaw Privacy, only the Outlaws will have Privacy! Eelco Cramer <crame001(a)hio.tem.nhl.nl> ------ --------------------------------------------------

1 0

PGS-list
by HHM LIMPENS 17 Dec '03

17 Dec '03

For anyone who is interrested in bug-reports/update reports etc for the Pretty Good Shell (PGS, available on several FTP sites, see previous (few days) mail from Eelco Cramer, send a mail to listserv(a)vox.hacktic.nl and "they'll get my crypto key when they pry it from my dead, cold fingers" -NSA's (former) chief counsel Stewart Baker "the NSA being the devious bastards" - Michael Handler +----------------------------------------+----------------------------+ | Eric Limpens | Where is my spycamera !? | | | ..Bart Simpson.. | | <Limpe001(a)hio.tem.nhl.nl> +----------------------------+ | S=limpe001;OU=hio;OU=tem;O=nhl;PRMD=surf;ADMD=400net;C=nl | | finger limpe001(a)141.252.36.60 for PGP 2.7 key | +---------------------------------------------------------------------+

1 0

re: PGS-list
by HHM LIMPENS 17 Dec '03

17 Dec '03

Sorry, please forget the previous mail, things went weird.... Here we go again: For anyone interressted in bug-reports/release updates etc.. on the Pretty Good Shell (PGS, compatible with 2.3a-2.6 and the notorious 2.7) please send a mail message to: listserv(a)voc.hacktic.nl with in the body of the message: subscribe pgs-list Anyone who encounters bugs/wants extra features etc, please drop us a message using that list. Eric Limpens, co-author of PGS. "they'll get my crypto key when they pry it from my dead, cold fingers" -NSA's (former) chief counsel Stewart Baker "the NSA being the devious bastards" - Michael Handler +----------------------------------------+----------------------------+ | Eric Limpens | Where is my spycamera !? | | | ..Bart Simpson.. | | <Limpe001(a)hio.tem.nhl.nl> +----------------------------+ | S=limpe001;OU=hio;OU=tem;O=nhl;PRMD=surf;ADMD=400net;C=nl | | finger limpe001(a)141.252.36.60 for PGP 2.7 key | +---------------------------------------------------------------------+

1 0

Re: re: PGS-list
by usura＠vox.hacktic.nl 17 Dec '03

17 Dec '03

HHM LIMPENS <limpe001(a)hio.tem.nhl.nl> writes: > >For anyone interressted in bug-reports/release updates etc.. >on the Pretty Good Shell (PGS, compatible with 2.3a-2.6 and the notorious 2.7) >please send a mail message to: listserv(a)voc.hacktic.nl ^^^ If you really want to subscribe send the message to: TO : listserv(a)vox.hacktic.nl SUBJ: any BODY: subscribe pgs-list end >Anyone who encounters bugs/wants extra features etc, please drop us a message >using that list. > >Eric Limpens, co-author of PGS. The Staff at VoX Propaganda Labz. -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0

Clipper in patent trouble?
by Mike Ingle 17 Dec '03

17 Dec '03

(From alt.security.pgp) Rich Lethin <lethin(a)toast.ai.mit.edu> wrote: > >I was chatting today with someone moderately well-informed about the >clipper controversy (unlike me). He pointed out the following work to me >by Prof. Silvio Micali at LCS on a technical scheme which can serve as a >compromise between the needs of society for legitimate wiretaps and the >need of individuals for strong privacy. Basically, it seems to be a >protocol for extending a public key algorithm into a k-escrow system. This >apparently differs from the Clipper chip in that algorithmic details are >well publicized. > >The work was in Crypto '92 apparently, and an MIT lab for CS tech report >numbered TR-579b. Even worse, Micali is claiming that his patent on fair cryptosystems (#5,276,737) covers Clipper as well. In the Wall Street Journal (May 31, 1994, p. B6): Mr Micali, whose patent was issued in January, says his patent covers the concept of breaking an encryption key into multiple parts that are guaranteed to work, and are held by escrow agents. It seems to me that Clipper does not guarantee that the multiple parts will work in anywhere near the same way as his scheme does (see my book for details); Clipper is simply a secret splitting scheme. On the other hand, Micali filed his patent application in Apr 92, a full year before Clipper became public. Bruce ************************************************************************** * Bruce Schneier * Counterpane Systems For a good prime, call 391581 * 2^216193 - 1 * schneier(a)chinet.com **************************************************************************

1 0

clipper patent troubles?
by Brian D Williams 17 Dec '03

17 Dec '03

---------- Date: Wednesday, June 01, 1994 9:41AM ADMINISTRATION'S CRYPTO PLAN MAY HAVE PATENT PROBLEMS - MIT professor says he deserves royalties An MIT computer scientist is trying to earn royalties on the use of the Administration's Clipper encryption plan. Negotiations, which one government official described as "erratic," have been going on for a couple months. Silvio Micali, the professor, holds one patent that he says covers a critical part of the government's Clipper project. He says the U.S. Patent and Trademark Office approved but has not yet publicly issued a second patent improving on the original invention. The royalty negotiations throw a wildcard onto the table of U.S. cryptography policy at an uncertain time. If the patent covers Clipper, opponents of U.S. policy will likely seize on the patent dispute as just one more reason to kill Clipper; users of Clipper will face higher costs; and the U.S. government will also have a much harder time exporting Clipper technology. Foreign governments recoil at the prospect of paying royalties to a U.S. citizen. Still, it is unclear how committed Micali is to facing off against barrel-chested U.S. negotiators. So far, he has been talking amiably to Michael Rubin, deputy general counsel of the National Institute of Standards and Technology, without the aid of a lawyer. "I didn't think that in dealing with the U.S. government, I would need a lawyer," Micali says. "I may be proved wrong." The key escrow, or Clipper, proposal is a coding scheme to provide privacy to voice, fax, and computer communications through the use of a secret codes. The code is embedded in a computer chip, the Clipper chip, that the government wants installed in telephones, fax machines and computers. But there's a catch: The secret key that unlocks messages is broken into two pieces and held in escrow by the government. With a court order, the government can reunite the two escrowed keys and tap the coded communications. Micali says that his patent covers the basic notion of escrowed keys in which trustees are given guaranteed pieces of the key. And while most of the 18 claims of the patent don't seem relevant to Clipper, the last four could be troubling. One of the claims clearly covers the division of a secret key into pieces and the recreation of those pieces in order to tap a line. If it applies to Clipper, Micali's patent would pose a vexing problem. Unlike most of the rest of the key U.S. cryptographic patents, the government does not seem to be able to use Micali's technology for free. Micali says he made the invention on his own time, not while working on a government-funded project, which would give the U.S. government royalty-free use. At least initially, the government will be the primary user of Clipper chip encryption devices. Officially, it is a voluntary standard for government use. But the Clinton Administration hopes the concept will spread into the private market. If that happens, consumers could face a higher price tag because of the Micali patent. The Clipper chip itself currently costs $25. A NIST official says the government is now evaluating Micali's patent and talking to the professor. The analysis includes whether the government provided any sort of funding to Micali's research that led to the invention underlying the patent. Micali initially approached the government several years ago about adopting a cryptographic scheme that he says is preferable to Clipper. Clipper is a private key system in which the same key, a so-called session key, is used to both code and decode a message. From a practical point of view, this requires the sender and user to exchange keys beforehand, which can be dangerous, time-consuming and expensive. Micali envisioned a public key system that would still give the government access to tap phone lines. Public key, of course, is the greatest recent cryptographic breakthrough because it frees the parties from selecting a key in advance. In a public key system, a sender will code a message with the receiver's public key, which is widely known. The receiver will then decode the message with his or her private key, which is mathematically related to the public key but difficult to compute. Under Micali's scheme, users would break their private keys into pieces and give each escrow agent a piece and a mathematical proof that the piece is legitimate. Upon proper authority, the government could then reassemble the pieces of the key to tap a message. The government obviously opted for Clipper rather than Micali's approach, but Micali did not go away. Last January, the patent office issued his patent, so the topic of conversations shifted to royalties. Micali won't say what sum he is seeking from the government except that it is reasonable compared to standard practices. It is not unusual for patent holders to seek 5 percent to 10 percent of sales if they feel they hold a core patent and up to 2 percent if their invention is peripheral. The Micali patent covers a public key system, which Micali says would give users more control over their keys and would be less expensive, even with royalty payments, than a hardware-based solution, like Clipper. Most of the patent's claims, therefore, don't cover Clipper, which is a private key system. (A user, however, may want to use a public key system like RSA to generate the session key under Clipper.) Micali's patent lawyer was wise enough to round out the patent with four general claims that cover the use of escrowed keys, regardless of the method. Micali says his second patent, which is not yet public, may cover Clipper even more directly. Claim interpretation, of course, is a matter of impression and imprecision, especially when it relates to inventions implemented in software. And it may be that NIST decides that Micali's claims don't specifically cover Clipper. In that case, Micali would be facing a legal bill of hundreds of thousands of dollars to make his case in court. Until that time, Micali is not revealing his strategy other than to say that he may soon need a lawyer. ----- that's all -----

2 1

eWorld & Anonymity
by Pierre＠eworld.com 17 Dec '03

17 Dec '03

I thought this might interest people... eWorld's "policy" on anonymity... *************************************** Date: Sat, May 28, 1994 5:52 AM EST From: eWorldAlert(a)eworld.com Subj: About Member Profiles. To: Pierre Dear eWorld Beta Tester, The recent eWorld host software upgrade rebuilt Member Profiles using the name you entered during registration. If you do not want your complete name reflected in the Member Profile you can change it. We ask that you enter at least your first initial and true last name. You can edit this field for the next couple of weeks, after which you can no longer change it. We want eWorld members to have real identities to encourage responsible online behavior. In the near future the eWorld Member Name in the Member Profile of newly-registered people will automatically reflect the name provided during registration and will not be editable. During registration members will choose between listing first & last name or first initial & last name in the Member Profile. This prevents people from using anonymous member names in eWorld, such as Your Worstnightmare. It also allows members to have impersonal identities in eWorld if they are concerned about harassment. Someone asks, "What if I have an uncommon last name, live in a small community and express an unpopular viewpoint in a discussion where tempers are high? Someone can use my Member Name and Location information to find my phone number (or even my address) and harass me!" Those with unusual last names have two options. The first is to change the community name from a city or town to a geographical region, or even to change the geographic reference to Somewhere Else. The second is to call the eWorld Assistance Center at 1-800-775-4556, explain the problem and ask for an altered Member Name. You don't need to do that now, though -- at this point you can change it yourself. We don't want anyone getting beat up or harassed because of membership in eWorld. But we do want to *substantially* reduce the amount of anonymity and consequent irresponsible behavior possible with the present registration system.

1 0

Re: Clipper in patent trouble?
by smb＠research.att.com 17 Dec '03

17 Dec '03

Even worse, Micali is claiming that his patent on fair cryptosystems (#5,276,737) covers Clipper as well. In the Wall Street Journal (May 31, 1994, p. B6): Mr Micali, whose patent was issued in January, says his patent covers the concept of breaking an encryption key into multiple parts that are guaranteed to work, and are held by escrow agents. It seems to me that Clipper does not guarantee that the multiple parts will work in anywhere near the same way as his scheme does (see my book for details); Clipper is simply a secret splitting scheme. On the other hand, Micali filed his patent application in Apr 92, a full year before Clipper became public. I think Micali has a good case. In patent law, the claims are vital. Exactly what it is that you're claiming is new is described in the claims; something infringes if it includes all of the elements of any one claim. Here's claim 15 of that patent: 15. A method, using a cryptosystem, for enabling a predetermined entity to monitor communications of users suspected of unlawful activities while protecting the privacy of law-abiding users, wherein a group of users has a secret key, comprising the steps of: breaking the secret key into shares; providing trustees pieces of information that include shares of the secret key; and upon a predetermined request, having the trustees reveal the shares of the secret key of a user suspected of unlawful activity to enable the entity to reconstruct the secret key and monitor communications to the suspect user. Sure sounds like Clipper to me... (Claims 1-14 deal with Micali's major stuff, the ``fair'' public-key based systems.) If Micali's claim holds up, it provides Cypherpunks with a whole new weapon against obnoxious cryptographic protocols -- build 'em first, patent 'em, and *don't* license them to the government... (Of course, since the U.S. uses a ``first to invent'' standard, they could defeat that by opening up secret NSA archives to show that they really had it first...) Btw -- I found the patent online via WWW; see http://town.hall.org/ and do the obvious. If you want just that single patent, go to ftp://ftp.town.hall.org/patent/data1/05276/05276737, or do the obvious ftp.

3 2

Pedophiles in Cyberspace
by Duncan Frissell 17 Dec '03

17 Dec '03

The WSJ op ed page today has an article on the 1st Amendment in Cyberspace by Stephen Bates that focusses (analytically) on pedophiles and Usenet. It is not hysterically negative but discusses the "downside" of our technology. DCF

1 0