December 2003 - cypherpunks-legacy

Re: PGP bastardization (fwd)
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

From: Mike Duvos <mpd(a)netcom.com> > He has no legal comeback I'm not so sure. The code was released under the GPL. The names PGP, Pretty Good Privacy, and Phil's Pretty Good Software were not. People can make anything they want out of the code, as long as they also release it under the GPL and call it something else. Doesn't seem like a major artistic limitation. Yes, I agree with everyone who says prz has the right to insist that tr changes the name of the program. But prz's mail was *much* stronger than that and he was demanding editorial control of the code and the manner in which it was used. (Reread his letter if you missed that bit). That's what I'm saying he has lost by issuing the code under the GPV. (I'm not gloating - I wish he *could* have the right to do what he likes with his code, I'm just pointing out the facts - it's too late.) G

1 0

How broad are PKP's patents?
by solman＠MIT.EDU 17 Dec '03

17 Dec '03

Or more specifically, I'm interested in how broad PKP thinks they are. I understand that they claim all public-key systems, but am I correct that that claim is based entirely on the Diffie-Hellman patent expiring in April, 1997? Is Shamir's three-pass protocol as presented on page 376 in applied cryptography covered? If you you used his protocol with the RSA-like symetric algorithm suggested, is it covered under the RSA patent? Would an elliptic analog of this be secure? Are there other cryptographically secure communtative symetric ciphers that could be used in Shamir's three pass protocol? Being able to use this without infringing on any patents would effectively obviate the need for public key cryptography outside of authentication. What about probabilistic encryption using a BBS generator? Does RSADSI claim that because it too depends on the computational hardness of factoring? Thanks in advance, Jason W. Solinsky

1 0

INFOBAHN PANEL SEES WORLD THROUGH [..] BLINDERS
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

A recent fax from The Center for Strategic and International Studies' International Communications Studies and Political-Military Programs: topic: encryption wars on the global information highway: beyond the clipper chip battle. This introductory discussion will take place on July 14th, 1994, at CSIS, 4th floor conference room, 1800 K St., N.W., DC from 9:30am-12noon. Dr. Michael Nelson, Special Assistant, White House Office of Science and Technology, and Mr. Kent Walter, Counsel to the Deputy Attorney General, will lead off the morning, followed by diverse industry and expert views. Since this by invitation only, please RSVP to Craig Johnson by Monday, July 11 at either Fax: (202) 775-0898, or e-mail: csis-ics(a)clark.net. [Included with the fax was the following ILA report reproduced here with permission from the author. Is anyone on this list invited to the above mentioned meeting? - jm] -------------------------- What's Left Unsaid And Undone INFOBAHN PANEL SEES WORLD THROUGH NARROW COPYRIGHT BLINDERS Lehman Panel Leaves Later How To Deal With Other Issues The best way to understand the recently released government report on protecting intellectual property is to look at the credentials of its primary author: Bruce Lehman, patent commissioner. Don't be misled by his title. Lehman is a copyright lawyer and legislative aide by training. His report reflects these points of view: If there is an emerging problem, as the economy enters the digital age, when information can be quickly, easily, and secretly copied, then the solution is to tinker with the law. A patch here, and a new subsection there, and Humpty Dumpty will be put back together again. "We tried to fine tune the dials of public policy," says Lehman, who emphasizes that the report benefited from hundreds of sets of eyes, not his alone. The draft report was issued by a working group underneath the Clinton Administration's National Information Infrastructure Task Force. And while its recommendations on changes to copyright law received wide attention earlier this week, the report is only one arrow in a quiver to deal with the theft of intellectual property. Faith in the rule of law is a good thing, in other words, but it won't be enough. Just ask anyone who has watched his or her copyrighted work flung through the Internet in a seamless chain of infringement. Or a software company that discovers 300 copies of a program at a corporation and only one sale. The working group's recommendations by themselves won't break the chain any more than stiffer laws and penalties have cured the drug crisis. But there are other arrows to shoot. Next week, for example, a different wing of the NII task force will hold a public hearing on the "security, integrity, and reliability" of information that travels through digital networks. Yet another wing, headed by Arati Prabhakar, director of the National Institute of Standards and Technology, is at work on applications and technology. GOTTA START SOMEPLACE Nearly everyone (except those who don't believe in intellectual property) seems to think the law is a good place to start. "Lehman has done an excellent job bringing focus to this issue," says Henry Perritt, Jr., a professor at Villanova Law School, who nonetheless has concerns about some of the specific proposals. Among the major recommendations, which are all subject to change (Possible objections mentioned by critics are in parenthesis): It would be illegal to tamper with devices or methods used to protect copyrighted material. (What happens when the work is no longer subject to copyright? If it is held in a technological envelope that is unlawful to break, the work cannot enter the public domain, as other works do upon copyright expiration.) Transmissions that may be considered both a performance and a distribution, such as when a recipient listens to a recording as it is being downloaded, would be considered a distribution, if that was the transmission's primary purpose. (Would this give more protection to the creator than the consumer than now exists in the law?) Recipients of digital transmissions of copyrighted works would not have the freedom to redistribute the material. Normally, under the so-called "first sale doctrine," if Ted sells a book to Alice, she can then turn around and sell or rent that book to Fred. This recommendation would prohibit Alice from reselling that book, if it is in digital form. The theory is that in a digital environment Alice can keep the book and distribute it, thereby destroying Ted's market. (The first sale doctrine was meant to limit the copyright monopoly so that the holder of the copyright gives up control once he or she has obtained economic benefit. The proposal may unhinge that balance. If the prior proposal is a "look but don't touch" rule, this would be a "touch but don't sell" rule, says Perritt.) Recording artists and record companies would receive royalties on sound recordings that are transmitted digitally. It is an anomaly of existing law that sound recordings don't have a so-called "public performance" right, as do plays, dances, and movies. Without this change, consumers could simply download top-quality recordings from specialized digital services, bypassing the retail purchase. (The broadcasting industry will put its full lobbying force behind blocking this measure, arguing that airplay is a form of free publicity.) A conference will be held on how to preserve the "fair use" concept of copyright law under which consumers are allow to use small portions of copyrighted work without fear of infringement. As more information becomes available on line, the ability to browse through material in libraries and schools for free will be curtailed. It will be possible to meter every usage of a work, even those that heretofore were protected by fair use doctrine. (Some copyright holders feel that fair use developed only because the transactional costs of charging for small uses outweighed any remunerative benefit. If advanced metering systems reduce transactional costs, then why not charge for all uses?) BALANCING ACT Lehman calls these changes "very modest" and built upon practices proven in other areas. For example, it is already unlawful to tamper with the encryption devices that scramble cable signals. And computer software has an exemption from the first-sale doctrine. Otherwise, to use the prior analogy, Alice could rent out the software to Fred and his 15 best buddies, who would then produce perfect copies for their own use. At the same time, the working group tried to balance the interests of creators, by suggesting modifications in first-sale and distribution language, and consumers, by holding the fair use conference. After all, copyright law is meant to protect the works of creators for the overall benefit of society. Prior to becoming patent commissioner, Lehman was at Swidler & Berlin. He cut his teeth on the Hill as the chief legal advisor during the drafting of the 1976 Copyright Act and 1980 Computer Software Amendments. That experience, he says, shaped his belief in being responsive to all sides of a debate. "If I was the general counsel of McGraw Hill, I might be less inclined to hold a conference on fair use," Lehman said. Still, he recognizes that the law can only do so much. "The most you can expect out of the copyright system is to prevent hemorrhaging," Lehman said. "It cannot prevent leakage," such as casual pirating of software for home use. That function falls to the marketplace to develop technologies that can envelop copyrighted material so it can only be opened by rightful recipients and to educators, according to Lehman. While the working group did not delve seriously into technological solutions, it will sponsor a second conference on education. The conference will explore course work that can be used in schools and libraries. Just imagine: Intellectual Property Education 101. It's hard to envision the course being as popular as driver's ed. Agencies Participating In Intellectual Property Rights Working Group Advanced Research Projects Agency Commerce Department Council of Economic Advisors Energy Department General Services Administration Justice Department National Institute of Science and Technology National Library of Medicine National Science Foundation National Security Agency National Telecommunications and Information Administration Office of Consumer Affairs Office of Management and Budget Office of Science and Technology Policy Office of the U.S. Trade Representative Patent and Trademark Office State Department Treasury Department --- *********************************************************** Information Law Alert ||||||||| || |||| * a voorhees report * || || || || * * || || || || * 718-369-0906 * || || ||||||||| * voice * || || || || * 718-369-3250 * || || || || * fax * ||||||||| |||||||| || || markvoor(a)phantom.com* *********************************************************** 411 First St., Brooklyn, NY 11215-2507 July 8, 1994 ****************************************************** * PLEASE KEEP THIS BOX ATTACHED TO NEWSLETTER * ****************************************************** Information Law Alert (ISSN-1068-8129) is published 20 times a year by Voorhees Reports, 411 First Street, Brooklyn, NY 11215-2507. Subscription rates: E-mail subscriptions are available for $195 a year. $550 a year for print newsletter. For information, call 718-369-0906 or 800-369-4840, or fax 718-369-3250. E-mail address: markvoor(a)phantom.com. On line: Information Law Alert is available electronically to subscribers of NewsNet (800-952-0122); Dialog (800-334-2564); and Dow Jones News Retrieval (800-522-3567). E-mail subscriptions are also available through Counsel Connect (800-952-0122) under the Resources section. Back issues and bundles of stories are available at Marketplace.Com. Gopher to Marketplace.Com or use the URL http://marketplace.com. Copyright 1993 Mark Voorhees. Unauthorized duplication prohibited by law. ********************************************************* Anybody know where I can get a copy of the Lehman Panel report? Jim_Miller(a)suite.com

2 1

PGP Bastardization
by Stuart Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>If you read the "Snake Oil" section of the PGP User's Guide, then you >>know how I feel about amateur cryptographer's encryption algorithms >>that have not been subjected to extensive peer review. >Well, It is true that I am _not_ being paid for this software. It >is my hobby. And I don't care how you feel about my hobby. >Please feel free to make any constructive comments about the >algorithm. The time for constructive comments about a new algorithm such as yours is *before* you release code. IDEA and RSA were already well respected ciphers before PGP was released. >I believe that you may by misinformed. I hope that I have made my >position clear. You relesased the pgp program under the "Copyleft" >License. I have the right to change the software or use pieced of it. >I am protected from you trying to deny me those rights. You may be correct in that Phil Zimmermann has no legal recourse, but I counldn't say for sure. I am more concerned with the ethical issues. What have you called your new super-duper pgp? If you make it abundantly clear that it is *your* hack of pgp, and not supported in any way by RSA, MIT, or prz, I personally wouldn't have a problem with it. It is my feeling that cryptographic software is an entirely different beast from other software released under such free licenses. If I improve or port some one's mail reader for instance, out of *common courtesy*, the first thing I would do is contact the author to let him know. Any bugs in such a program would make themselves readily apparent and users would quickly learn whether or not my version was really an improvement. How is a user to know that his data has less of a chance of being compromised using super-kool-pgp than prz's own version? The people reading his compromised mail certainly aren't going to tell him that his cryptographic software has a bug in it. I think a lot of this issue has less to do with the law and more to do with courtesy to fellow software authors. - -- Baba baby mama shaggy papa baba bro baba rock a shaggy baba sister shag saggy hey doc baba baby shaggy hey baba can you dig it baba baba E7 E3 90 7E 16 2E F3 45 * 28 24 2E C6 03 02 37 5C Stuart Smith <stu(a)nemesis.wimsey.com> -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLiU/DKi5iP4JtEWBAQGpYAP+MD+AcoHHcfpOA+SFzWmOCZ1U1KVXt1zP js1vq6v3tmbA5tXBJzHptnSDIIdPWwuiNL/4rgD8eXVVdaeCVloqz38U1Gk5KWnZ N4C8X2opaiOG6azU58upqzeEnmHJXvD2K0Mr3nZZMMhvu+ANdAxdVxSNuj5WaJoH dJq596n4gpk= =716m -----END PGP SIGNATURE-----

1 0

Re: New National ID Card Proposal
by aims＠ext.jussieu.fr 17 Dec '03

17 Dec '03

Received here in Germany. Many thanks, Olivier

1 0

RE: PGP bastardization
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Philip Zimmermann <prz(a)acm.org> wrote: > Accordingly, I do not approve of anyone modifying the cryptographic > characteristics of PGP. PGP and Pretty Good Privacy are my trademarks, > and their good name is trusted the world over because of the care that > I have exercised in selecting its algorithms. [comments deleted] > cc: Curtis Karnow > Landels, Ripley, and Diamond My copy of PGP (v2.3a) came with the following notice: > Pretty Good Privacy version 2.3a - READ ME FIRST > Notes by Perry Metzger > Edited for 2.3a by Colin Plumb [intervening material deleted] > PGP is distributed under the terms of the GNU General Public > Licence, a copy of which is included. In brief, this states that > PGP is freely distributable, subject only to the condition that ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > if you make a modified version and choose to distribute it, you ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > must make it freely distributable as well. See the file COPYING ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > for details. What are your LEGAL grounds for attempting to retain "editorial control" over PGP, as commendable as your desire to maintain its integrity undoubtedly is? The notice distributed with PGP itself seems to say otherwise -- only that modifications must also be freely distributable. So why CC: your letter to what appears to be a legal firm? Does the legal term "in terrorem" apply here? <g>

2 1

Re: ID card from hell
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May I basically agree with Duncan's noble sentiments. I just don't think it likely that the "What about the tourists?" argument will stop the national ID juggernaut once it begins to move. .............................................................. And I can imagine be that tourists, especially, would be the special focus for ID cards and databases, since they evoke all sorts of fears of foreigners - not only the problems which Tim mentioned, but also of international crime, espionage, terrorism, etc. It could easily become very important to establish databases to maintain records on people who have ever entered the U.S., so that that there would be a reference for any questionable activities requiring this kind of info. I know some of these things are already in existence, but not yet like the kind which would be set up if the nationalization of IDs became accepted. And if governments become very concerned about commercial protectionism, they might accept the idea of ID cards for control of traffic, from their competing national interests. This is a great interest of mine, regarding the package deals which are a part of being an automatic member of a country/political system - the national "identity" which makes one subject to whatever system of operations the ruling class decides to implement. If one could make oneself "irrelevant" to the location where one was at the time - either from having an established residence elsewhere, or from having no declared membership/citizenship anywhere, I would think this would eliminate some of the regional, political administrations of policy which would otherwise apply. But with IDs and databases and closed door protectionist policies, this appears impossible. I haven't read "The Shockwave Rider", but I shall; hopefully it will have imaginative (& realistic) scenarios on these possibilities (many sci-fi books are too remotely far off in fantasy-time than realizable in a near-future time scale.) Blanc

1 0

Re: NATIONAL SECURITY PORN RISK
by frissell＠panix.com 17 Dec '03

17 Dec '03

>Is it time to move out of here? Does anyone have any suggestions of >countries where things are better, not likely to get much worse as the U.S. >decides to spread its brand of "democracy" even more universally, and which >have not closed their doors to refugees from America? > > -- sidney markowitz <sidney(a)apple.com> > [In a pretty down mood at the moment] Heinlein said it was time to move when some place instituted mandatory IDs. This month's Money mag has an article on the increase in expatriation by native-born US citizens as well as increasing interest in same. Some places are more bureaucratic than here and some are less. The best place to move to in "nowhere". That is, don't spend too much time in any one country. Local rules bite less on those who are just passing through. Slick Willy will need congressional action on a mandatory ID although he may be able to deploy a "US Card" for "Federal Benefits" administratively. The risk is that Congress is currently debating mandatory ID legislation without mentioning it. The Health Security Act (and some of the current variations) includes a mandatory "Worker's ID" card that you will need to work for someone else. Slick Willy even proudly held it up on TV. So we may get mandatory ID without any Congressional debate. The largest group of US citizens who will not be covered by any proposed health plan: non-resident US citizens. A word to the wise. DCF Desperately seeking libertarian New Hampshire resident for commercial transaction. Desperately seeking HTML expert for (paid) consulting and handholding.

1 0

Re: Source Code
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

I have myself speculatively created a PGP with 4096 bit keys, but not distributed it, I just wanted to investigate the speeds of RSA operations on 4096 bit keys. I personally think that it is time for PGP to move on to larger keys, the arbitrary limit of 1024 or 1264 or whatever seems restrictive. You should be able to use as much security as you need without having to resort to hacked versions. I have heard the figure of 3000 bits RSA being as hard to break as 128 bit IDEA, however I understand that IDEA is a relatively new algorithm and has not seen nearly as much exposure to analysis as DES. For this reason I think that the proposed 3DEA code is probably in line with going to 4096 bit keys. If you were one of the people using DES under the impression that it was good for many years you should be worried now as the cost of breaking DES has been estimated at $1m. No doubt in 10 years time this figure will be achievable for much less cost. How would you feel when it gets to the stage that your messages could be cracked overnight on a bit of spare workstation time? For this reason I think that the next version of PGP should have the ability to specify n IDEA rounds, and arbitrary RSA key sizes. That should get the problem overwith once and for all. The attitude that 1024 bits should be good for the hundreds of years seems nieve and similar to IBMs 640k limit on DOS at the time 640k no doubt seemed like a *huge* ammount of memory, I'm now typing in a text editor which has a binary of 1.8Mb, on a m/c with 80Mb main memory. One more thing, I think that it should be developed *outside* of the US, at least until that ITAR thing gets thrown out. The argument that it would take a googol years to break PGP with current hardware doesnt hold either as RSA is not proven to be equivalent to factoring, and better factoring algorithms are presumably still possible. However for the people in the US there are still problems with sorting out a license from PKP which allows unlimited key lengths, and for these reasons it may be worth waiting to see if this can be achieved. Adam

1 0

Security is not free
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

I think that a lot of people have forgotten that security is not free. Sometimes the cost is economic, sometimes it is mental. Even using encryption with GNU Emacs's mailcrypt package is not free, because it takes time to verify that you're using signatures and encryption and keys correctly. And, without a certain amount of paranoia, you're going to do something stupid. I think the NSA is forgetting that security is not free. They're restricting American companies from exporting encryption. Yes, this increases America's security by some amount. However, the cost of doing this means that overseas encryption is going to overseas companies, not US companies. And this amounts to several billion dollars per year. I think we need to make sure that Congress knows it is spending several billion dollars of someone else's money, in return for the very small amount of security gained by keeping American encryption products out of the worldwide market. -russ <nelson(a)crynwr.com> http://www.crynwr.com/crynwr/nelson.html Crynwr Software | Crynwr Software sells packet driver support | ask4 PGP key 11 Grant St. | +1 315 268 1925 (9201 FAX) | What art thou doing about it? Potsdam, NY 13676 | LPF member - ask me about the harm software patents do.

1 0