December 2003 - cypherpunks-legacy

News: SecureDrive 1.3d
by edgar＠spectrx.sbay.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Maintenance: The original FPART 1.3d was not updated to check for 1.3d-level SECTSR loaded. It would run without SECTSR loaded. I have distributed now FPART13D.ZIP, which contains a replacement FPART executable, source, and signature. Length Method Size Ratio Date Time CRC-32 Attr Name ------ ------ ----- ----- ---- ---- -------- ---- ---- 4346 DeflatX 1717 61% 05-05-94 06:00 8ab67f77 --w- FPART.C 15452 DeflatX 9798 37% 05-05-94 06:01 bae1a9d8 --w- FPART.EXE 152 Stored 152 0% 05-14-94 23:10 7cc1bfdc --w- FPART.SIG FPART13D.ZIP is now available for download on the following public BBS's. Eagle's Nest (408)223-9821 Flying Dutchman (408)294-3065 Catacombs BBS (303)938-9654 (unverified) It is also available from a mailserver in Texas. Send mail to Server(a)Star.Hou.TX.US with body text that looks like this get /files/public/fpart13d.zip quit This file is also available via FTP from netcom.com ftp.netcom.com:/pub/mpj/I_will_not_export/crypto_???????/secdrv/fpart13d.zip (See ftp.netcom.com:/pub/mpj/README.MPJ for the ???????) Note the file SECDR13E.ZIP in this same NETCOM directory is just SecureDrive 1.3d with the new FPART modules. The internal modules all still call themselves 1.3d. Furthermore, this ZIP file is incomplete, but all the files except a trivial part of READ.ME can be retrieved after processing the file with PKZIPFIX. I haven't been able to verify if csn.org also contains FPART13D.ZIP. Also note that the ZIP files contain PGP detached signatures (*.SIG) for the executable files. Documentation: "Heavy" SecureDrive user, Duncan Frissell <frissell(a)panix.com>, offers the following update to running SecureDrive under Windows: Ordinarily, PGPPASS will not be available to DOS programs run under Windows but if you use the Windows virtual device driver EDOS (Extended DOS) PGPPASS will work in DOS windows. EDOS --- Enhanced DOS for Windows Mom's Software Box 449. 391 So. Pacific Street Rockaway, Oregon 97136 503-355-2281 Voice EDOS is Shareware. Note: Windows 3.1 and Windows For Workgroups 3.11 allow you to enable 32-bit disk access in the Virtual Memory/Windows Swapfile menu under the 386 Enhanced section of the Control Panel. In addition, Windows for Workgroups 3.11 allows you to enable 32-bit file access in the same menu. You will be able to read a logged in SecureDrive partition with 32-bit disk access enabled but *not* with 32- bit file access enabled in Windows for Workgroups 3.11. [end] Finally here is my (Edgar's) public key, also available on many public keyservers; note who has signed it. Also note that my only correct address is the sbay.org one. The saigon address is no longer valid. Type bits/keyID Date User ID pub 1024/DA87C0C7 1992/10/17 Edgar W. Swank <edgar(a)spectrx.sbay.org> sig 4AAF00E5 David Del Torto <ddt(a)lsd.com> sig 08B707C5 Anton Sherwood <dasher(a)netcom.com> sig 32DD98D9 Vesselin V. Bontchev <bontchev(a)fbihh.informatik.uni-hamburg.de> sig 34D74DC1 Peter Simons <simons(a)peti.GUN.de> sig DA87C0C7 Edgar W. Swank <edgar(a)spectrx.sbay.org> Edgar W. Swank <edgar(a)spectrx.saigon.com> sig 3245BF5D Jeremy S. Anderson <jeremy(a)cctwin.ee.ntu.edu.tw> sig 08B707C5 Anton Sherwood <dasher(a)netcom.com> sig 4AAF00E5 David Del Torto <ddt(a)lsd.com> sig 32DD98D9 Vesselin V. Bontchev <bontchev(a)fbihh.informatik.uni-hamburg.de> sig FF67F70B Philip R. Zimmermann <prz(a)sage.cgd.ucar.edu> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAirfypkAAAEEAKe2jziPeFw6hY19clR2GtQ4gtGCSSVOTgPKEJzHfuC74Scf 9PEuu1kebLhHk43A9wo1vr52o4jpH/P/tnFmRtBQOMzLUzAt5rMucswtSVviMQS2 hBuc9yGJKWHVcyfA79EARKEYTdhx+2qKI+hFJcPE+rmD8wVoF94nNf3ah8DHAAUR tCdFZGdhciBXLiBTd2FuayA8ZWRnYXJAc3BlY3RyeC5zYmF5Lm9yZz6JAJUCBRAt 1dNBocE4X0qvAOUBAQdhA/kB2vTXCIjZGtOw/bC6gOTHnMPBVTQeXHIZ3BZ4xYRd MfdKsxN3gTezOI8QixQoHzhvNGB02fB5EdB8+Ulw9kn08AR2b+mTwkgeNtlytvNZ 52E7UpWEVtznxlGeiwRMbOFIaGKJFsGXFSRw3F89ZqoUnoeRvRgL0kJIQOZCLF62 ZYkAlAIFEC2o/S8YM6FlCLcHxQEBHcsD9i0o2d7Q2rsG/iRRwapxGKQbHPxgQXCB 6MLVNDEa3c/png8r2PA9cOeRcwx2xY/XxNuZo7lHXNp/j5xwYhooq+yTBJIL8DZq W99QT8+c05vw7M1UCEpy7NT1exkMzoVR/Y3jKbIa4X1tX1ZrdmoozxW0T3DwCcCZ 7dR26eZXlx2JAJUCBRAtmw+uNlaXxjLdmNkBAULKA/4wqdMn2GCApAq+5kJT+iJm LvVeNZj0JVjWspGDcd+1cjCK9XWVTATVtRAfWbDukoJ2wNzNuz7gbqVHHcrV7nvc Qt3KUsxWRyahREklc75PtXBm0PKpr5TNTM2J/Kql28GXQQyL+PHawTDQVE8ybCPj +WUgK5qd1o/2QPxnb4EAmYkAlQIFEC2bGrAPRy9bNNdNwQEBhLAD/3vWoDu4msz4 YA8BcnfuovI0ApDL5ekSu447ByXgIcqNRe4oDtGdvrqXvJhpyuj5t7vVDGtzgQE0 jU8H6u+Ocpj1nBlOXL36DASSaJuLErByNCzqTaGVya5WGxmK2m+pKS6UVIXitF2t GxrKu+Pdp3rkv3oPHTWVgFT5eGRvfJIKiQCVAgUQLZj0qd4nNf3ah8DHAQFrQwP+ OeVHrxlNzhC+SxfttzIUC3g+VALuM6gv8b+cyxl0tlkwi6H9G8qmPh9nr2ppQZR5 jHUhubfsek/QGi88UwOfuRPdh+ZDl/rU4kMcXvdYGT9clOLjzXmcLM7y9v8F4mFL sNtvFN2qWLsqne6hUI7EFn2ea/8ujdm7eoNlq7t8Cyu0KUVkZ2FyIFcuIFN3YW5r IDxlZGdhckBzcGVjdHJ4LnNhaWdvbi5jb20+iQCVAgUQLAAAujTiKn8yRb9dAQGY 1AP/SNRWpPQsyhW/DtnPYVfJat0GfptGXIbF6pBaGKANdGKlnzbj98dsDa+RsBzM RrLDxmnBFWaFY2zHFaGNgUiL3YpglsA/9chuv6sS5MiE8oooqG64YtRaF9eEIWW4 eOzcIDplDCdPiOe7U2UKRydYtsviS2q5vbMvCscI9R7fUvWJAJQCBRAr1jnTGDOh ZQi3B8UBAc+sA/MFt/qVDLPBtTB3FrLMsOiHcfKCe6cuiiL7LPOIRVByE6BK3ewt 7YjXTwMvFOCn7bqUlhMBkH4aDwcbIH43PrbrcPReVVRdCL3/sJJHJ3xuFgV64U/A XMc9ZmXIsMAiy5oR8GyanYMEuB9++FQKqKJZiY/2hr6s4D7kgdL7E3y0iQCVAgUQ K5cyE6HBOF9KrwDlAQGoXQP+K0aEladxviotML5HAL6Z8Le70hGKR10pMqAvC3QK rPW37eTQ0zspIMOR9ahRtQ6KpOqEdMsWNJPdXlaAVXJS1g2/eLDTtyYxySjv0HTg 4pOQ6ZlxJ0IQXy5bo7mJArSY6Ab9fkHSJp57/WjYnRriwJ3jb2flDTanxNyEUocz cNyJAJUCBRArY+YsNlaXxjLdmNkBAQxGA/9ojDJpeuXhWjVqzT+2m2IfEFt/jJ48 peQjaQIxpMXo5iJuJ2SqlBzeQ7hs6SQ57LUcG8+nWlyteV3KDNZvILobulMyMB7P foWyhOop0ws+AtJhOeT0prxf3o43sZxs7IhabhZ4zf7Ea0h3Oe35TiFFgQmQ/B4s 892mAcZr8CfOt4kAlQIFECsRFxzidd4O/2f3CwEBsmID/2qXL/VdjGxxYFNIZdA+ DC6howUXlHw66MUArILE2/9J69VvcpbQTKmD4A+04SwH9q8SDzWxsg+1VANuy08E E0up9pm7ZBzrxkFcOydhsEwOt9fRn9EJ3tDNYe1SVoxV9Fc47of55Om7cTNrky0h dp1LA13uf/TeV3nrBYa21zaz =88H8 - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLe7bB94nNf3ah8DHAQH8IQQAmqUpS3pCl1ByhKebRbp5ingyuk4WFkY0 T57ugOcVALqfmI7L1Cju/Hz6RkrJPrmfNqVmjY55XgXbrteZ8sXJ6ZS+wSsxP281 hRSTe83oaBN/JJXNc7rUkzkv6pUvWzzdE6ngj07PSIM0uOnm6HnNhrz+Md14l4vG 04LBE5T0DPw= =qpRY -----END PGP SIGNATURE----- -- edgar(a)spectrx.sbay.org (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

digital clearinghouse idea
by edgar＠spectrx.sbay.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Eric Hughs said, If you use the ACH system, you can't pre-authorize sporadic payments for arbitrary amounts. ... Not true. Counter-example: I recently authorized automatic (ACH) payments from my bank account to pay my Discover Card (tm) bills. These are both sporadic (some months may have no purchases) and in varying amounts, usually a few hundred dollars, occasionally a few thousand. Personal note: This feature of DC is especially valuable, since they tend to have a short billing cycle and send their statement around the middle of the month, too late to pay with all the other monthly bills. The automatic payment is scheduled -after- the time limit for normal payments, at the start of the next billing cycle (but still no finance charge). DC does not publicize this option. You have to call them & ask about it. ACH also pays my PG&E bill, which is not sporadic, but (obviously) does vary in amount. Same with the water bill. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLe9z1N4nNf3ah8DHAQH3pQQAknjEoByxvF5XGQYrUvOq6Tdw4agBqPzD THbC2JQaJJ0jRUVu7wvW/oU381MlTRIKU5EsR32pJb1qu0lARUbbxint1Atn4Ini e8TBfKR49WX5cNVrbpKVYMrMCLTv5yWhA1RtasSggoTLHqm9XSq2NpK5LIiEtpPc FUaYJ/2F2Pg= =bFyB -----END PGP SIGNATURE----- -- edgar(a)spectrx.sbay.org (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

FW: NSA Takes Over Healthcare Reform
by Blanc Weber 17 Dec '03

17 Dec '03

From: Dr. David Chaos <dchaos(a)delphi.com> Newsgroups: comp.org.eff.talk Date: Fri, 3 Jun 94 02:07:20 -0500 June 3, 1994 NSA CLIPPER CHIP FAILS, AGENCY SETS SIGHTS ON HEALTHCARE (ups) After the discovery of a fatal design flaw in the Clipper chip's "crime-busting" LEAF system, NSA has shifted its focus to a "more attainable goal, healthcare reform", said an anonymous government source. "It appears that President Clinton's healthcare reform package will likely result in citizens, who can afford it, leaving the country for private healthcare provided by foreign countries. Based on this, NSA believes they have a clear, jurisdictional mandate to develop healthcare policy." the source further stated. "With NSA's technological superiority, we should have a system in place which will prevent medical subversion within a few months. Even the Bahamians will be powerless to overcome it" said the source. Despite objections from diverse medical organizations, the President supported NSA's position that they are the most qualified to determine healthcare policy. He further justified the agencies assertion that the details of the policy must remain secret to prevent medical malingerers from abusing the system. Secret details of the policy, obtained by confidential informants, indicated that it would be based on the "KneeCapstone" and the "Clapjack" algorithms. An "independant" examination by the renowned doctor and cold-fusion investigator, Dr. Staley Ponz, was recently conducted on the KneeCapstone and Clapjack algorithms. "These algorithms are totally and completely malingerer proof...I really mean it, this time, honest!" said Dr. Ponz from an undisclosed location in South America. Further details on the plan will be forthcoming "real soon now" said government policy advisor, Tyrone Shoelaces. Reprinted, with permission, by, Dr. David Chaos

1 0

No compulsory licensing of patents in USA.
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Perry Metzger writes: > smb(a)research.att.com says: > > Why can't they refuse to license a patent? > I was under the impression that the law obligated you to license > patents -- albeit not necessarily at an attractive price. I am quite > likely to be mistaken on this -- my memory on the topic is very > sketchy, as demonstrated by the fact that I didn't realize the > government can patent things (although I was right on copyrights.) - From "Intellectual Property: Patents, Trademarks, and Copyright in a Nutshell", pp 12-13, Miller & Davis, West Pub., 1990. (not a particularly authoritative cite, but it ought to do) "During the life of the patent, the owner has the complete right to determine who, if anybody, will have the right to use, make, or sell the patented item, 35 USCA (s) 261, and to a more limited extent, how or where it will be initially exploited. It is important to understand that American law does not require the patentee to put the patent into use or allow others to do so. The first requirement, of putting the patent into use, is called 'working' the patent, a requirement with some historical meaning and considerable foreign patent law significance. The second requirement, of allowing others to use the patent, is called 'compulsory licensing.' Like working, there is no absolute American requirement of compulsory licensing, but other aspects of the law, especially antitrust, may have the effect of obliging a patent owner to license others to use the patent." -----BEGIN PGP SIGNATURE----- Version: 2.5 iQCVAgUBLe+bQn3YhjZY3fMNAQFMbQP/d6MuZtq87sbJIyZQaG05fMfvd2M0uCNP hL18MTRCMAr+6esg5/QOsSwJ7Xd4XiRPFG3Dhq8U1Itl0zemcKd+5u0pxgAP3Dbu GkNTDfk3x5TQMjzScchdkL7+V/yZ3G00GnH+kJwGdfIckJd/35nocN0KFVAle/28 Zi66/HIz3Sc= =AnQK -----END PGP SIGNATURE-----

1 0

Black Eye for NSA, NIST, and Denning
by an5877＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On the one hand, I applaud Dr. Blaze for the discoveries based on his black-box analysis of the NSA product. How fortunate to have him working in a laboratory seeded with this gear. On the other hand, I am amused at the "big deal" being made about such a minor result. This "protocol failure" exposes the NSA product to no new threats. If one's objective is to use SKIPJACK but to defeat key escrow, pre-encryption is easier, conceptually simpler, and may be more secure, depending on what is actually inside the SKIPJACK code. I won't ask why the big deal is being made about all of this -- the agenda surrounding Clipper and friends is clearly a political one, not a technical one, so it is no surprise to hear even the technical voices, i.e., this list, trumpeting Blaze's paper as though it were a dagger in the heart of SKIPJACK. But let's all acknowledge the technical weight and importance of Blaze's result for what it is: minuscule. DEADBEAT <na5877(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBFAgUBLe9KWPFZTpBW/B35AQEbdwGAmBpl2lBCtLkPN4QBruEEKsstCWWpIEGm KMBK2YlxL5V9fnHRDn3RlRJT6Ji++7yd =gIHN -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

Re: Black Eye for NSA, NIST, and Denning
by thad＠pdi.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com Subject: Re: Black Eye for NSA, NIST, and Denning DEADBEAT sez >> I won't ask why the big deal is being made about all of this -- the >> agenda surrounding Clipper and friends is clearly a political one, not >> a technical one, so it is no surprise to hear even the technical voices, >> i.e., this list, trumpeting Blaze's paper as though it were a dagger in >> the heart of SKIPJACK. But let's all acknowledge the technical weight >> and importance of Blaze's result for what it is: minuscule. > The importance is that the current justification for Clipper is 1. The benevolent government wanted us to have very good encryption so they gave us SKIPJACK, but 2. They didn't want to hurt themselves by giving away something that they couldn't crack. The Clipper apologists have retreated from the "we are going to use this to catch criminals" posture to "let's give the citizens good encryption that doesn't hurt us". PGP et al was a devastating answer to the first position, so that is why they abandoned it. Blaze's result destroys the current justification, they are giving us good encryption that they can't break. There is then no reason to push Clipper, unless it is fixed, of course. thad Thad Beier Pacific Data Images 408)745-6755 thad(a)pdi.com

1 0

Re: Black Eye for NSA, NIST, and Denning
by sidney＠taurus.apple.com 17 Dec '03

17 Dec '03

DEADBEAT <na5877(a)anon.penet.fi> says: >If one's objective is to use SKIPJACK but to defeat key >escrow, pre-encryption is easier, conceptually simpler, and may be more >secure Right now, you need to arrange things with another party if you are going to have secure communication. If Clipper catches on the way the government wants, you may be able to assume that someone you want to contact has an encryption device compatible with yours. If Blaze's hack can be used by the initiator of a communication to defeat key escrow without the cooperation or knowledge of the other person, then Clipper will have made it more difficult for law inforcement, since then criminals and other people with privacy concerns will be able to have secure communication with people who are not part of their pre-arranged secure communications system. That, the defeat of traffic analysis, and the avoidance of the attention one could draw by using non-LEAFed encrypted traffic, are the advantages of Blaze's result. -- sidney <sidney(a)taurus.apple.com>

1 0

A black eye for whom?
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Fri, 3 Jun 1994 21:48:53 UTC an5877(a)anon.penet.fi (deadbeat) wrote - > I won't ask why the big deal is being made about all of this -- the > agenda surrounding Clipper and friends is clearly a political one, not > a technical one, so it is no surprise to hear even the technical voices, > i.e., this list, trumpeting Blaze's paper as though it were a dagger in > the heart of SKIPJACK. But let's all acknowledge the technical weight > and importance of Blaze's result for what it is: minuscule. Bullshit. _Any_ pitfall in key escrow system or the Clipper technology itself is far from "miniscule." _______________________________________________________________________________ Paul Ferguson US Sprint Enterprise Internet Engineering tel: 703.904.2437 Herndon, Virginia USA internet: paul(a)hawk.sprintmrn.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLe+x15RLcZSdHMBNAQFgCAQAs6HdAdxs6wVnv2ScKd5cR9jVdz+rVyNn gceOqi/BaOq8utu2lIPvO74qvMufCTycVBrSBPzFIZzfdzGKcwhmKIikpHMCy3f3 II1iM++P6+3HLzVGJUrTca7qMVS8H6fyPda7IufmYDOjqy8KEFfwwkoCXrnTBNY0 VHPYg2HYd3Y= =yI2v -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAiuk0/8AAAEEALqlLc+x9lmgiJCRSpu/aPhQdi0hMjwiGlN2B/GJQqgZPhTb pR+u5/blGogqT+WwcXZ2XfEdIV19FrJY4BXGGn4+4TjdVN3XuuCHuueoygBAmOQD IloU6SJuDqJa0kFA5X/i/1ELn86I5+8A4Hx88FiYJIVUBR6SApRLcZSdHMBNAAUR tCdQYXVsIEZlcmd1c29uIDxwYXVsQGhhd2suc3ByaW50bXJuLmNvbT60JVBhdWwg RmVyZ3Vzb24gPGZlcmd1c29uQGljbTEuaWNwLm5ldD4= =rtcO -----END PGP PUBLIC KEY BLOCK-----

1 0

Rperkins remailer
by rperkins＠amtsgi.bc.ca 17 Dec '03

17 Dec '03

Just a note to let you know that the rperkins remailer is back in business. This is available via: rperkins(a)nyx.cs.du.edu rperkins(a)nox.cs.du.edu rperkins(a)nyx10.cs.du.edu Sorry it was down for so long, but I lost net connections for a while. I'm still not back on the list, but for those who don't know me, I used to be known as ub075(a)freenet.victoria.bc.ca. Have fun.

1 0

Black eyes heal
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

Its important to realize what was really gained by this revelation- - some PR value - several months before fixed Clipper/Tessara chips become available I have no doubts that the problem that was revealed will be corrected. I'm not sure it was a good idea to reveal the weakness. Imagine how much worse it would be (in terms of PR) if lots of phones had been deployed before the flaw was found? On the other hand, it's possible the weakness was known and would have been (is being) corrected quietly. So, there is a small window in which to take advantage of the PR, and the delay in revised chip availablility. Unless there are some major defections in Congressional support because of this, I don't think much will change; Clipper will become a reality. A competing product could devastate it- yes, government subsidies & requirements might form the nucleus of support, but having to deal with NSA restrictions and sole sourcing of the chip makes it a real, expensive pain to turn it into a product. I don't think the revision will be completely trivial, either. The way these chips are built means a much more extensive verification process must be used- not just reburning a PROM. A standard micro and a standard encryption chip on the side (don't have the references here, but at HotChips there will be a paper on a 100kbit/sec Single Chip Modular Exponentiation Processor from Holger Orup of Aarhus Univ. Denmark) could make a viable, competing product. Note that I'm not volunteering or suggesting that one of you should go out and implement my great idea- just making predictions. ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, MS/305-3B * * 1 Infinite Loop * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

3 2