December 2003 - cypherpunks-legacy

PRZ Wins One
by John Young 17 Dec '03

17 Dec '03

PRZ is awarded a 1995 Chrysler Award for Innovation in Design, says a $40,000 full-page ad in The NYT today, with a brief citation: Philip Zimmermann is the designer of Pretty Good Privacy (PGP), an E-mail encryption software. Thanks to the algorithms of PGP, which was released to the public as free software in 1991, E-mail messages can be sent securely all over the world without the risk of interception by any third party. No mention of the free-world leader's sword poised to decapitalize the public-spirited designer to protect IC hegemony.

1 0

Zimmermann wins Chrysler Award
by dmandl＠panix.com 17 Dec '03

17 Dec '03

There's a full-page ad on page A9 of today's Wall Street Journal announcing the winners of the "1995 Chrysler Award of Innovation in Design." One of the six winners is Phil Zimmermann. I quote: "Philip Zimmermann is the designer of Pretty Good Privacy (PGP), an E-mail encryption software. Thanks to the algorithms of PGP, which was released to the public as free software in 1991, E-mail messages can be sent securely all over the world without risk of interception by any third party." In case you're interested: "For the past three years, Chrysler Corporation has been honoring outstanding designers. By showcasing great innovations in fields such as graphic, interactive, product, architectural, and environmental designs, Chrysler strives to bring well-deserved attention to those designers whose common attribute is a passionate commitment to their vision." Among the other winners: the hip graphic design group Reverb and "carceral" architect Frank Gehry. --Dave. -- Dave Mandl dmandl(a)panix.com http://wfmu.org/~davem

1 0

Re: Purple Boxes vs. Native Signal Processing
by Steve Bryan 17 Dec '03

17 Dec '03

At 8:58 pm 8/15/95, Timothy C. May wrote: [snip] >The trend is away from having two chips when one will suffice. Thus, the >Macintosh 840av and 660av had a Motorola 68040 _and_ a Motorola 56000 DSP [snip] >Pushing DSP functions into the CPU can be taken too far. Apple, for >example, had/has a "Geo Modem," or something like this, which does modem >funtions in the CPU of some machines. Last I heard it was stuck at being >too slow, with no software updates, and effectively is being abandoned. [snip] My apologies if this is being too compulsive but for reasons of accuracy it should be pointed out that the DSP in the Mac 660av and also the 840av is the AT&T 3210. The other point I'd make is more a matter of opinion. The Geopod and associated software has been excellent and revisions have just recently been released by Apple and Cypress Research. The phone capability is particularly well designed. This is in marked contrast to the demo program called ApplePhone which was mistakenly treated as an attempt at a finished product when it was just intended as a technology demonstration. It took an unusually long time for MegaPhone, the finished product from Cypress Research, to finally appear. As far as speed is concerned there is impatience about the 14,400 bps limit and that remains the major shortcoming. But even that may be corrected by Apple before too much longer. Personally, I'm more than willing to accept the tradeoff in order to have the tight integration of the three capabilities (data, fax and phone). I still have a funky NuBus card from SuperMac (with three RJ11 connectors and an RS232 connector that was designed to combine these capabilities, it was a prototype) sitting in a drawer while my Quadra and PowerMac are smoothly providing the services. The next step will be to integrate PGPFone with the other three functions so that one could handle data, fax, phone, and secure phone all with the same phone line and without requiring a rocket scientist to set up and use it. +---------------------------------------------------------------------- |Steve Bryan Internet: sbryan(a)maroon.tc.umn.edu |Sexton Software CompuServe: 76545,527 |Minneapolis, MN Fax: (612) 929-1799 |PGP key fingerprint: B4 C6 E2 A6 5F 87 57 7D E1 8C A6 9B A9 BE 96 CB +----------------------------------------------------------------------

1 0

BUY_lou
by John Young 17 Dec '03

17 Dec '03

8-16-95. NYPaper: "The F.B.I. and Ruby Ridge." [Editorial] Since the paranoid days of J. Edgar Hoover, the F.B.I. has been struggling to free itself of an institutional incapacity to admit its mistakes and punish wrongdoing by senior officials. Mr. Freeh, who was entrusted with this task, seems to have put misplaced confidence in a longtime friend and associate. Mr. Freeh is said to be infuriated that his trust was abused. Well he should be furious -- especially at himself. "Separatist Family Given $3.1 Million From Government." The Government agreed today to pay $3.1 million to the family of a white separatist whose wife and teen-age son were killed three years ago by Federal agents in a standoff on a remote Idaho mountainside. The decision to give Mr. Weaver and his children any money was particularly stunning, since Federal prosecutors tried two years ago to have him convicted in the killing of a Federal marshal at Ruby Ridge, and sought the death penalty. Federal investigators involved in the case were rebuked by the judge who presided over the trial. The case has also taken on political dimensions. Some conservative groups have cited the shootout, along with the 1993 F.B.I. assault on the Branch Davidian compound near Waco, Tex., as examples of Government abuse of power. BUY_lou

2 1

DSP's, Purple Boxes, Etc...
by Alan Patterson 17 Dec '03

17 Dec '03

For those interested in design of these purple boxes, etc., you might want to check out a couple of magazines that are FULL of advertisements and specs on DSP's, CPU's, communications design equipment, etc: Data Communications (800) 525-5003 and Computer Design Circulation Director (918) 832-9287 email paulw(a)pennwell.com Both magazines are free. Alan Patterson (lep(a)wsnet.com) PGP public key available at MIT keyserver. WSNetwork Communications Services, Inc. Fngpt: 41D0F61B496FECC09FABECF686AB2AIC Montgomery, Alabama (334) 263-5505 (800) INET-750 PGP Encrypted Email Preferred

1 0

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Peter Wayner 17 Dec '03

17 Dec '03

I don't think that there is any serious worry for Netscape. Their security is fine-- it's just crippled by the US Government. They could probably start distributing binary versions of their software that used full 128 bit keys in several hours. It's just that the Government gets pissed off about these things. In general, it just adds more flames to the fire started by the letter written by Microsoft, IBM and Lotus. Their point is bolstered by this easy attack. -Peter

3 2

Re: SSL challenge -- broken !
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Damien.Doligez(a)inria.fr (Damien Doligez) > This is to announce the solution of the SSL challenge posted by Hal > Finney on July 17, 1995 (message-ID: <3u6kmg$pm4(a)jobe.shell.portal.com>), > also found at: <URL:http://www.portal.com/~hfinney/sslchal.html> Although it is hardly necessary, I can confirm the accuracy of the decryption found, and I extend my congratulations for this achievement! Ironically, I understand that an independent effort coordinated by Adam Back also discovered the key at approximately the same time. In addition, Eric Young had done a search starting at 8000000000 and upwards; unfortunately the key value of 7ef0961fa6 was only about one percent below his starting point. Hopefully Adam will supply more information. It will be interesting to see what the fallout is from this accomplishment. It should provide ammunition for the current effort by Microsoft and other companies to try to persuade the government to allow the export of full 56 bit DES. Knowing the tendency of the media and the net to oversimplify, this will probably come out as "SSL is broken" just as the RSA-129 result led to "RSA is broken" stories. This would not be as egregious an oversimplification as in the RSA case, but in fairness it should be recognized that SSL as a spec provides support for much stronger ciphers than the intentionally weakened RC4-40 which was broken here, but Netscape was constrained by the government to supply browsers with only the weak encryption. I am a little alarmed by the suggestion that this news could have some marked impact on the Netscape stock price. From our perspective this was certainly an unsurprising result (not to take anything away from Damien and others who worked on it). It is a useful reminder that the things we work on here can have profound consequences. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBMDIuehnMLJtOy9MBAQHQbwH+I0YL1ewcCbXOGw8yYvKXIJMg15O0jmqW wMb6SKrethbJzpWXJBpC1oKrl8wVzPvqBCLJtfJFWcN9xD4pTOluhA== =0GPy -----END PGP SIGNATURE-----

7 7

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| Subject: Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken ! | From: Peter Wayner <pcw(a)access.digex.net> | | I don't think that there is any serious worry for Netscape. Their | security is fine-- it's just crippled by the US Government. They | could probably start distributing binary versions of their software | that used full 128 bit keys in several hours. It's just that the | Government gets pissed off about these things. The netscape client already has these capabilities built in. During the negotiation stage, the client talks to the server, which announces which strength to use. For exported versions of both the client and the server they are limited to 40 bit RC4. For US versions, all available strengths are supported with an option to enable them. Pull up Netscape, and for the URL type: "about:". It will tell you which algorithms are used, but not their key bit length. When you configure their Commerce server, you have the option to enable any of the supported bit lengths and algorithms, including RC2 and RC4, IDEA, 40 -> 128 bits, 64 -> 192 for DES. Netscape's server, since it must service foreign requests, probably doesn't even waste its time asking for >40 bit, since that would add to the time it takes to negotiate a common scheme. If anyone has any insight into this, please fill me in. I just wanted to clarify a few things. Steve -- Steve Champeon Technical Lead, Imonics Web Services

1 0

Re: SSL challenge -- broken !
by Alex de Joode 17 Dec '03

17 Dec '03

Hal sez: [..] : I am a little alarmed by the suggestion that this news could have some : marked impact on the Netscape stock price. From our perspective this was : certainly an unsurprising result (not to take anything away from Damien : and others who worked on it). It is a useful reminder that the things we : work on here can have profound consequences. Just to bad Ecash and the ON-Line Stock/Options Broker [TM] aren't available, would be a good time to buy some put options on Netscape Communications. -- Alex de Joode Fear Uncertainty and Doubt, Inc.

1 0

Re: SSL challenge -- broken !
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 1:45 PM 8/16/95, Hal wrote: >I am a little alarmed by the suggestion that this news could have some >marked impact on the Netscape stock price. My apologies for causing alarm. I was merely making a too-subtle joke about hysteria in the press and the capital markets for Netscape, and its inevitable backlash. Madness of crowds and all that... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0