December 2003 - cypherpunks-legacy

Enhanced One-time pad available:
by jpinson＠fcdarwin.org.ec 17 Dec '03

17 Dec '03

Greetings Cypherpunks. After a lengthy test period, I am releasing the first official version of OTP-PC (there is no change from the beta version). The file otp-10.zip may be found on: wuarchive.wustl.edu /pub/MSDOS_UPLOADS/cryptography (the same directory as Secdev) I have also posted the file to the cypherpunks directory on soda.berkeley.com. Attempts to find out when/where otp will be posted on soda have not been answered. (My cypherpunks mail has stopped, so there may be a problem there) If you problems finding otp-10.zip, please send me a message and I will send it to you via PGP ASCII-armor. If any one can provide a FTP site for me to post OTP-PC, please let me know. Description: ------------- This is the first public release of OTP-PC, which is a MS-DOS implementation of the one-time pad or Vernam Cipher. The one-time pad is the only encryption method proven to be unbreakable. Complete source, of course! OTP-PC features: -Automatic compression of plain text messages prior to encryption. Compression reduces consumption of the pad, and masks the size of the original document. (compression can be overridden) -Automatic wiping of the pad (codebook), to prevent reuse on both encryption and decryption. -Wiping and deletion of intermediate compressed files. -Two stage cipher text headers. The first stage header is un- encrypted, and contains information needed to start decryption. The second stage contains sensitive information (CRC etc), and is encrypted. -A 32 bit CRC stored in the encrypted header verifies reconstruction of the original file. -A verbose mode which displays encryption/decryption statistics. Thanks, Jim Pinson -Galapagos jpinson(a)fcdarwin.org.ec

1 0

Tessera, National ID card
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I have recently started exchanging e-mail with the Technology Writer for the Dallas Morning News (Tom Steinert-Threlkeld). He is interested in new angles for Clipper/Tessera articles. He is currently looking for opinions on whether Tessera (or a sibling) will be/could be used in the U.S. Card mentioned in yesterday's RISK column. If you have anything you would like to say about this, send it to me. I will collect the replies and forward them to Tom. Indicate in your reply if you want me to withhold your name/eaddr. Jim_Miller(a)suite.com

1 0

State Dept Response to my second CJ request
by Phil Karn 17 Dec '03

17 Dec '03

United States Department of State Bureau of Politico-Military Affairs Office of Defense Trade Controls Washington, DC 20522-0602 May 11, 1994 [stamped] In reply refer to ODTC Case: CJ 081-94 YOUR LETTER DATED: March 9, 1994 REQUEST FOR COMMODITY JURISDICTION DETERMINATION FOR: "Applied Cryptography Source Code Disk" Your commodity jurisdiction (CJ) request was referred to the Departments of Commerce and Defense and the National Security Agency for their review and recommendations. As a result, the Department of State has determined that the subject source code disk is subject to the licensing jurisdiction of the Department of State in accordance with the International Traffic in Arms Regulations (22 CFR 120 through 130). This article is designated as a defense article under category XIII(b)(1) of the United States Munitions List. Licenses issued by this office are required prior to export. The text files on the subject disk are not an exact representation of what is found in "Applied Cryptography." Each source code listing has been partitioned into its own file and has the capability of being easily compiled into an executable subroutine. The subject disk contains source code listings for each of the following cryptographic algorithms: Vigenere, Beauford, Enigma, DES, Lucifer, NewDES, FEAL-8, FEAL-NX, REDOC III, LOKI 91, IDEA, N-HASH, MD5, Secure Hash Algorithm (SHA), and Secret Sharing. Also, the subject disk contains source code listings for certain algorithms that would not be exportable if they were incorporated int a product. The intended use of this source code disk, as stated in your CJ request, is to provide code for those who wish to incorporate encryption into their applications. There are fourteen (14) separate source code files that amount to thousands of lines of easily executable code contained on the subject disk. This is certainly an added value to any end-user that wishes to incorporate encryption into a product. Should you require further assistance on this matter, please contact Tom Denner at (703) 875-7041. Sincerely, [signed] William B. Robinson Director Office of Defense Trade Controls Phil Karn 7431 Teasdale Ave San Diego, CA 92122

11 16

So what do you think...
by lile＠netcom.com 17 Dec '03

17 Dec '03

about this letter? Would you sign it? -lile ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lile Elam | "Remember... No matter where you go, there you are." lile(a)netcom.com | Un*x Admin / Artist | Buckaroo Banzai ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ---------- Forwarded message ---------- Date: Wed, 11 May 1994 12:37:27 -0400 (EDT) From: Michael Ward <mike(a)Essential.ORG> To: niiregional-l(a)rain.org Subject: Letter to NSF re: Internet Pricing Distributed to TAP-INFO, a free Internet Distribution List (subscription requests to listserver(a)essential.org) TAXPAYER ASSETS PROJECT - INFORMATION POLICY NOTE May 7, 1994 - Request for signatures for a letter to NSF opposing metered pricing of Internet usage - Please repost this request freely The letter will be sent to Steve Wolff, the Director of Networking and Communications for NSF. The purpose of the letter is to express a number of user concerns about the future of Internet pricing. NSF recently announced that is awarding five key contracts to telephone companies to operate four Internet "Network Access Points" (NAPs), and an NSF funded very high speed backbone (vBNS). There have been a number of indications that the telephone companies operating the NAPs will seek permission from NSF to price NAPs services according to some measure of Internet usage. The vBNS is expected to act as a testbed for new Internet pricing and accounting schemes. The letter expresses the view that metered pricing of Internet usage should be avoided, and that NSF should ensure that the free flow of information through Internet listserves and file server sites is preserved and enhanced. jamie love, Taxpayer Assets Project (love(a)essential.org; but unable to answer mail until May 15). Until then, direct inquires to Michael Ward. If you are willing to sign the letter, send the following information to Mike Ward of the Taxpayer Assets Project (mike(a)essential.org, fax: 202/234-5176; voice: 202/387-8030; P.O. Box 19367, Washington, DC 20036): Names: ___________________________ Title: ___________________________ (Optional) Affiliation: ____________________________________ (for purposes of identification only) Address: ______________________________________ City; St, Zip ________________________________ Email Address: _____________________________________ Voice: __________________________________ for verification) the letter follows: Steve Wolff Director Division of Networking and Communications National Science Foundation 1800 G Street Washington, DC 20550 Dear Steve: It is our understanding that the National Science Foundation (NSF) and other federal agencies are developing a new architecture for the Internet that will utilize four new Network Access Points (NAPs), which have been described as the new "cloverleaves" for the Internet. You have indicated that NSF is awarding contracts for four NAPs, which will be operated by telephone companies (Pac Bell, S.F.; Ameritech, Chicago; Sprint, NY; and MFS, Washington, DC). We further understand that NSF has selected MCI to operate its new very high speed backbone (vBNS) facility. There is broad public interest in the outcome of the negotiations between NSF and the companies that will operate the NAPs and vBNS. We are writing to ask that NSF consider the following objectives in its negotiations with these five firms: PRICING. We are concerned about the future pricing systems for Internet access and usage. Many users pay fixed rates for Internet connections, often based upon the bandwidth of the connection, and do not pay for network usage, such as the transfer of data using email, ftp, Gopher or Mosaic. It has been widely reported on certain Internet discussion groups, such as com-priv, that the operators of the NAPs are contemplating a system of usage based pricing. We are very concerned about any movement toward usage based pricing on the Internet, and we are particularly concerned about the future of the Internet Listserves, which allow broad democratic discourse on a wide range of issues. We believe that the continued existence and enhancement of the Internet discussion groups and distribution lists is so important that any pricing scheme for the NAPs that would endanger or restrict their use should be rejected by the NSF. It is important for NSF to recognize that the Internet is more than a network for scientific researchers or commercial transactions. It represents the most important new effort to expand democracy into a wide range of human endeavors. The open communication and the free flow of information have made government and private organizations more accountable, and allowed citizens to organize and debate the widest range of matters. Federal policy should be directed at expanding public access to the Internet, and it should reject efforts to introduce pricing schemes for Internet usage that would mimic commercial telephone networks or expensive private network services such as MCI mail. To put this into perspective, NSF officials must consider how any pricing mechanisms will change the economics of hosting an Internet electronic mail discussion groups and distribution lists. Many of these discussion groups and lists are very large, such as Humanist, GIS-L, CNI-Copyright, PACS-L, CPSR-Announce or Com-Priv. It is not unusual for a popular Internet discussion group to have several thousand members, and send out more than 100,000 email messages per day. These discussion groups and distribution lists are the backbones of democratic discourse on the Internet, and it is doubtful that they would survive if metered pricing of electronic mail is introduced on the Internet. Usage based pricing would also introduce a wide range of problems regarding the use of ftp, gopher and mosaic servers, since it conceivable that the persons who provide "free" information on servers would be asked to pay the costs of "sending" data to persons who request data. This would vastly increase the costs of operating a server site, and would likely eliminate many sources of data now "published" for free. We are also concerned about the types of accounting mechanisms which may be developed or deployed to facilitate usage based pricing schemes., which raise a number of concerns about personal privacy. Few Internet users are anxious to see a new system of "surveillance" that will allow the government or private data vendors to monitor and track individual usage of Information obtained from Internet listserves or fileserves. ANTI-COMPETITIVE PRACTICES We are also concerned about the potential for anti- competitive behavior by the firms that operate the NAPs. Since 1991 there have been a number of criticisms of ANS pricing practices, and concerns about issues such as price discrimination or preferential treatment are likely to become more important as the firms operating the NAPs become competitors of firms that must connect to the NAPs. We are particularly concerned about the announcements by PAC-Bell and Ameritech that they will enter the retail market for Internet services, since both firms were selected by NSF to operate NAPs. It is essential that the contracts signed by NSF include the strongest possible measures to insure that the operators of the NAPs do not unfairly discriminate against unaffiliated companies. Recommendations: As the Internet moves from the realm of the research community to a more vital part of the nation's information infrastructure, the NSF must ensure that its decisions reflect the needs and values of a much larger community. 1. The NSF contracts with the NAPs operators will include clauses that determine how the NAP services will be priced. It is important that NSF disclose and receive comment on all pricing proposals before they become final. NSF should create an online discussion list to facilitate public dialog on the pricing proposals, and NSF should identify its criteria for selecting a particular pricing mechanism, addressing the issue of how the pricing system will impact the Internet's role in facilitating democratic debate. 2. NSF should create a consumer advisory board which would include a broad cross section of consumer interests, including independent network service providers (NSPs), publishers of Internet discussion groups and distribution lists, academic networks, librarians, citizen groups and individual users. This advisory board should review a number of policy questions related to the operation of the Internet, including questions such as the NAP pricing, NAP operator disclosure of financial, technical and operational data, systems of Internet accounting which are being tested on the vBNS and other topics. 3. NSF should solicit public comment, though an online discussion group, of the types of safeguards against anticompetitive behavior by the NAPs which should be addressed in the NSF/NAPs contracts, and on issues such as NAPs pricing and Internet accounting systems. --------------------------------------------------------------------- TAP-INFO is an Internet Distribution List provided by the Taxpayer Assets Project (TAP). TAP was founded by Ralph Nader to monitor the management of government property, including information systems and data, government funded R&D, spectrum allocation and other government assets. TAP-INFO reports on TAP activities relating to federal information policy. tap-info is archived at ftp.cpsr.org; gopher.cpsr.org and wais.cpsr.org Subscription requests to tap-info to listserver(a)essential.org with the message: subscribe tap-info your name --------------------------------------------------------------------- Taxpayer Assets Project; P.O. Box 19367, Washington, DC 20036 v. 202/387-8030; f. 202/234-5176; internet: tap(a)essential.org ---------------------------------------------------------------------

3 2

No Subject
by norm＠netcom.com 17 Dec '03

17 Dec '03

There was a long article in April 11, 1994 Forbes: "AUCTIONING THE AIRWAYS", by George Gilder". It had a supprising amount of technical information about a new technology similar to spread spectrum. The article has a "too cheep to meter" flavor that I do not agree with but it does present some interesting information and ideas. It is about 43k bytes and is available via anonymous ftp at netcom.com:/pub/Silk/auction.txt

1 0

PGP 2.5 for Intergraph Clipper available
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Below is an announcement I posted to ingr.general. For those of you who are outside the firewall, drop me an e-mail and I'll forward the archive to you. And, as always, "Clipper" is a registered trademark of Intergraph Corporation. - -Paul Date: 11 May 94 19:36:10 GMT Message-ID: <paul.768684970@poboy> Newsgroups: ingr.general Subject: PGP 2.5 for Clipper available Thanks to MIT & RSA Data Security, Version 2.5 of Pretty Good Privacy (PGP) is now fully legal in the United States. Since it's now legal in the US, there's no excuse for you to have insecure e-mail from now on out. Here's how you can get it: CLIX - ---- * via newprod to my desktop CLIX box; look under "Security" newprod -n newprod(a)poboy.b17c.ingr.com * via my PGP page at http://www.ingr.com/pgp.html DOS/Windows/Windows NT - ---------------------- * via ftp to poboy.b17c.ingr.com in /pub/pgp25/.stuff * via the PGP page at http://www.ingr.com/pgp.html In either case, you should read the RSAREF 2.0 license file before downloading PGP 2.5. If you agree with the license terms, have at it; if you don't, please don't download the software. This software may be export-controlled under US law. Do not export it. If you aren't a US citizen, do not download it from these sites. - -Paul - -- Paul Robichaux, KD4JZG | Out the 10Base-T port, through the router, perobich(a)ingr.com | over the leased line, off the bridge, past Intergraph Federal Systems | the firewall... nothing but net. Of course I don't speak for Intergraph. -----BEGIN PGP SIGNATURE----- Version: 2.5 iQCVAgUBLdE1Jqfb4pLe9tolAQGCtQP6A4u7+l7bchEWNWEb9Zn+JkCJ4hA/Jyfr WamcxN8PgNH1eHX6viws/nzb6AJpnX95YGc2/4imugx9M0T07/2FJy5+UgFcje7c LkZdqKMFmg3sNZMu3pCF+I5Jq63cWHqgtJoNCQRAMPtcjKR3OGlMlvsMnMbqpQHY Ei+Utpg84bQ= =uPf0 -----END PGP SIGNATURE-----

1 0

Re: Another sensationalist Newsweek Article
by Tom Allard 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > The May 16th newsweek has an article on comparing women and men is > cyberspace. It's blatantly biased, portraying men as sex-starved, > war-mongering, unsensitive geeks, and women as the perfect example of > what society should REALLY be. Maybe you otta forward them something from Barbera Abernathy. And just how, might I ask, did they determine the sex of various posters. Heck, as far as you know I'm another Mark Ethan Smith. And there are LOTS of users with logins like fd9465 and the like. Heck, I can't always determine gender in *real* life! > I'm growing tired of these sensationalist articles in the popular press, > that serve to only alienate the denizens of cyberspace and scare off the > civilians. I've also noticed several notorious loons being quoted in the mainstream. Dave Hayes & John Palmer jump to mind, and you can just bet that Detweiler is talking to these people, although probably using a different name each time. rgds-- TA (tallard(a)frb.gov) I don't speak for the Federal Reserve Board, they don't speak for me. pgp fingerprint: 10 49 F5 24 F1 D9 A7 D6 DE 14 25 C8 C0 E2 57 9D -----BEGIN PGP SIGNATURE----- Version: 2.5 iQCVAgUBLdE1C6AudFplx0TNAQFl2wP+O+tt+IKuSREeP2k7Zx6LC8SMEwTDtU8e Dbia4SLd6oHv0meMifwDHtO6/x+eWmbib+8TQrNWGcJW3C991ycM39Z0PLK2rW1B sl/tYbp1cUPztsoj60tRGjogFE9ZkOaiQCv8C3fUG1Y/U8+5yN9UZtNmLJG01ysC SozS2AfavVs= =YP1X -----END PGP SIGNATURE-----

1 0

PGP 2.5 available from Electronic Frontier Foundation ftp site
by Stanton McCandlish 17 Dec '03

17 Dec '03

With the early May announcement of the availability of the new version of PGP (Pretty Good Privacy) a free encryption program for email and other files, EFF has decided to provide PGP and other cryptographic material to users of the Internet. EFF applauds and congratulates the PGP development team, MIT (who initially made PGP 2.5 available), and RSA Data Security (patent holders of the RSA and RSAREF encryption code) for coming to an agreement and providing this new version of the most popular email encryption program in the world - a free version that is finally legal in the US. Previous versions of PGP arguably violated US patent law, with the exception of ViaCrypt's commercial PGP 2.4, but the new 2.5 is built upon the free RSAREF encryption functions, rather than the previous RSA functions which required a special licensing arrangement for use in applications like PGP. Despite the patent & licensing issues being resolved, PGP is still not legally exportable from the United States (except to Canada), due to ITAR export restrictions which categorize cryptographic materials as weapons of war. Thus, EFF can only make PGP and other crypto tools and source code available to US and Canadian nationals currently residing in the US or Canada and connecting to EFF's site from a US or Canadian site. PGP and similar material is available from EFF's ftp site in a hidden directory, and only to Americans and Canadians. Access to this directory can be obtained by reading and following the instructions in the README.Dist file at: ftp.eff.org, /pub/Net_info/Tools/Crypto/ gopher.eff.org, 1/Net_info/Tools/Crypto gopher://gopher.eff.org/11/Net_info/Tools/Crypto http://www.eff.org/pub/Net_info/Tools/Crypto/ PGP can only be obtained from EFF via ftp currently. Gopher and WWW access to the material itself is not supported at this time. Only the DOS and Unix versions of PGP 2.5 have been released so far. The Unix version is in source code form, and so can be readily ported to VMS, NeXT and many other operating systems. A Macintosh version has yet to be released. If you would like to see US export restrictions on cryptography removed, please send a message supporting Rep. Cantwell's export reform act (bill HR3627) to cantwell(a)eff.org, ask your Representatives to co-sponsor this bill, and ask your Senators to co-sponsor Sen. Murray's companion bill (S1846) in the US Senate. Congress contact information is available from ftp.eff.org, /pub/EFF/Issues/Activism/govt_contact.list -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994 -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994 -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994 -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994 -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994 -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

Re: Here they come...
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

>From: mpd(a)netcom.com (Mike Duvos) >Date: Wed, 11 May 1994 10:33:33 -0700 (PDT) >> At my company, it is considered to be sexual harrassment if a female finds >> out that I have a pornographic gif on my computer, even if I never display >> it. Apparently, just the knowledge that this material exists creates a >> "hostile" environment. > >Does the GIF have to portray a person of the female persuasion in order >for the "hostile" environment to be created, or will any sexually >oriented image suffice? Anything that suggests that anyone could be naked and having fun at the same time, I think. tw

1 0

Re: Patents on RSA will expire soon....
by fnerd＠smds.com 17 Dec '03

17 Dec '03

> The algorithm that factored RSA129 takes about exp(sqrt((log n)(log log > n))) steps. > Indeed 10^17 instructions is just about how much work was required to > factor RSA129--. > That formula gives about 10^29 for a 1024 bit number. If computers double > in speed every 18 months then they will be only 32 times as fast when the > patents expire. If that rate of speedup held long term, and no significantly better factoring algorithms showed up, it would be 60 years until a 1024 bit number were as easy to factor as RSA129 was this year. -fnerd - - - - - - - - - - - - - - - and i dreamed i was flying high up above my eyes could clearly see the statue of liberty sailing away to sea --Paul Simon -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

2 1