December 2003 - cypherpunks-legacy

Re: copyrighting algorithms
by Wolfgang Roeckelein 17 Dec '03

17 Dec '03

Hi, From: Bill Trost <trost(a)cloud.rain.com> > >Wolfgang Roeckelein writes: > >I wasn't aware that you could copyright an algorithm. Patent, > >yes, but not copyright. Intellectual property meens secret, > >right? Aren't there any precendence cases involving propriety > >schemes that are reverse engineered? > > Game cartridges (I think sega was involved) > >You might be referring to Nintendo vs. Galoob, which was used as a >sample case in an January 1994 article in the Communications of the >ACM titled "Copyright's Fair use Doctrine and Digital Data". The >article states No, I was referring to a case, where a third party game cartridges manufacturer reverse engineered the specifications of the game cartridges slot for producing his own cartridges for this game. Unfortunatly, I have lost the reference and the names of the companies, but this is the main case cited when it comes to reverse engineering propriety schemes. Maybe I can dig this out, or another member of the list has details available. Wolfgang --- Dipl.-Wirtsch.-Inf. Voice: +49 261 6509 173 Wolfgang Roeckelein Fax: +49 261 6509 179 WHU Koblenz E-Mail: roeckelein(a)wi.whu-koblenz.de Burgplatz 2 (NeXTmail ok) D-56179 Vallendar WWW: http://www.whu-koblenz.de/~wolfgang/ Germany --rsa--------------------------------8<------------------------------------- #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) -------------------------------------8<------------------------------------- TRY: echo squeamish ossifrage | rsa -e 3 7537d365 | rsa -d 4e243e33 7537d365 Residents of the USA & France *MUST NOT* include this .sig if following up! *** Residents of France & Russia *MUST NOT* make any use of this -sig ! ***

1 0

Re: Java, Netscape, OpenDoc, and Babel
by merriman＠arn.net 17 Dec '03

17 Dec '03

> > Just a quick note to chime in. The OSF just did a deal with Sun >to port Java to several platforms. The OSF is opening a "web mall" >where you can grab software objects and run them. Still tentative, or is there a Web address? Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: copyrighting algorithms
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Wolfgang Roeckelein writes: > No, I was referring to a case, where a third party game cartridges > manufacturer reverse engineered the specifications of the game > cartridges slot for producing his own cartridges for this game. Sounds like _Sega v. Accolade_, 977 F.2d 1510 (9th Cir., 1993). I don't have it in front of me, but Terry Carroll's Copyright FAQ (ftp://rtfm.mit.edu/pub/usenet/news.answers/law/copyright/faq/part2) cites it for the proposition that dissasembly of a copyrighted work can be fair use if there is no other way to reach noncopyrightable (functional, not expressive) elements of an existing work. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMBicgX3YhjZY3fMNAQFULwQAgvWmS1+p5BbN/C3wnVl21jqVjTL/tQIN SMITIXhXTLaNmdGtlnPANC6brOYXb/17d2zHBwR0BcUWiH/AFjBsTLIxwroOx5np kRSOk7dmw4jifrw4tMJw6Pe/pi7zs+IwT94ToEIKxcXRMs1lPruGdu2HM+kS+4ds mCF+FKmP89E= =UDoU -----END PGP SIGNATURE-----

1 0

"Encryption" IRC script?
by wmono＠Direct.CA 17 Dec '03

17 Dec '03

C'punks.. I was just DCC'ed this rather cryptic IRCII script. The author, nickname george.. /whois george 311 George ~root original.netwest.com * :000-System Admin-000 312 George irc.escape.com :[198.6.71.13] Escape - New York City (I highly doubt he's really the root there - no identd running?) claims that it's an encryption routine in IRC. I don't know how to read that script language, and I'm most certainly not a crypto expert, so I've attached the script in hopes that someone can tell me if this guy is a whacko and whatnot. (Sorry for those not interested - the file was small, so I figured that not too many people will mind. It is ASCII with some nonprintables contained within.) I warn that I haven't tested the script, and as with all untrusted scripts, DO NOT RUN IT until it's confirmed by someone that it's safe! I-CODE.IRC -- William Ono <wmono(a)direct.ca> PGP 2902B621 fingerprint = 51 6B BC 81 57 D8 FF 6A 5A A1 A4 6B 9A E3 E5 EE = fingerprint PGP-encrypted mail welcome! Witty Quote Goes Here

1 0

Re: "Encryption" IRC script?
by Donald M. Kitchen 17 Dec '03

17 Dec '03

Yes, there are scripts that implement des encryption of IRC sessions, using RSA to swap keys. (the encrypted lines always start with "clipper:" on mine. I don't think it's the same as the one you've got, but yes, they are out there. (See what you miss when you can't find people on the #crypto channel!?!) The channel that was used to coordinate against a recent spam attack of remailers turned into a rather interesting chat about several subjects. (Including digicash) It was about two months worth of cpunks... (without the normally-cooresponding year's worth of alt.conspiracy reposts!!) Maybe it would be fun to actually use the #crypto channel. (Unless there's a #cpunk channel I don't know about?) Don Sorry I haven't been signing lately, but I've been replaced by a double.

1 0

NSA and the NCSA/Apache web servers
by Amir Y. Rosenblatt 17 Dec '03

17 Dec '03

I was flipping through the Apache http Server Project's web site <http://www.apache.org/> when I came across the following note: Note: We were informed by NCSA that the NSA (The US National Security Agency - yes, the folks who in 1994 said "we're only 10 years behind schedule") considered the hooks to encryption in NCSA's httpd to be in violation of the munitions export law, thereby making its distribution to foreign sites illegal. For various reasons, we decided to remove the -DPEM_AUTH code completely. This was followed by a pointer to http://www.apache.org/nopgp.html from which the following text was taken: On May 17th, 1995, we were asked by a representative of NCSA to remove any copies of NCSA httpd prior to 1.4.1 from our web site. They were mandated by the NSA to inform us that redistribution of pre-1.4.1 code violated the same laws that make distributing Phill Zimmerman's PGP package to other countries illegal. There was no encryption in NCSA's httpd, only hooks to publicly available libraries of PEM code. By the NSA's rules, even hooks to this type of application is illegal. Wow -- hooks to encryption are unexportable -- now THAT's bullshit. Sheesh. -Amir /\ Set the controls for the heart of the sun. -Pink Floyd ______/ \ ___________ __ __ _ _ _ _ . . . axon(a)neuron.net \ / \/ For PGP 2.6 key send mail with subject: SEND PGPKEY

7 9

NYT on SuperGrassley
by John Young 17 Dec '03

17 Dec '03

The New York Times, July 28, 1995, p. A26. [Editorial] Senator Grassley's Surf Police An academic study suggesting that the Internet is awash in bestiality, pedophilia and other kinky sex turns out to have been seriously flawed. Politicians like Senator Charles Grassley who waved the study around as an argument for intrusive regulation have stopped doing so. But Mr. Grassley and his allies have not backed off from their drive to draft unnecessary legislative restrictions on computer communications. Earlier this summer, Senator James Exon attached an amendment to the Senate version of a telecommunications bill that would impose Federal penalties on those who made available material deemed unsuitable for children. The unreliable study that did much to spur this bad legislating was conducted by Marty Rimm, then an undergraduate at Carnegie-Mellon University. It was reprinted in the Georgetown Law Journal and served as the basis for a credulous Time magazine article early this month. Mr. Rimm's academic supervisors have since made clear that the study had serious defects. The likelihood that children will be accidentally deluged with sexually charged computer graphics is much smaller than Mr. Rimm and his promoters suggested. Furthermore, to the extent that any problem exists, the best response is not through heavyhanded, constitutionally dubious legislation but parental education and discretionary user controls. Mr. Rimm's study looked at the computer habits of adults. He focused not on generally accessible areas of the Internet but on separate, commercial adult bulletin board services that require special procedures to find and use. This, critics note, is like visiting an adult bookstore and using the percentage of gamey titles to generalize about the contents of all bookstores. He also looked, less carefully, at specialized areas of the Internet that would be hard to stumble upon by accident. By Mr. Rimm's own calculations, less than 1 percent of all material on the Internet itself is raunchy, although this tiny percentage is unusually popular among the adults he surveyed. Another Carnegie-Mellon study, focusing on families with high school children, suggests that sexually explicit material is much less popular among these users. To be sure, sexually explicit material that would be offensive to some users can be found on the Internet. It is within the reach of computer-literate children using the networks without parental supervision. But the problem is being exaggerated to create a pretext for restricting the material available to adult users of computers. Some members of Congress, out of political greed or ignorance, want to censor what can be put on the Net and prosecute those who post legal but raunchy material. The approaches being advocated by Mr. Exon and Mr. Grassley are unwarranted and unconstitutional. They are also impractical. Material posted to the Internet in foreign countries, beyond the reach of American law, is as available to users as domestically posted material. Items can also be posted through anonymous mailers that make it impossible to identify the original source. Censorship would also have the unwelcome effect of restricting adults to reading and viewing material deemed suitable for children, and would stunt the future of the networks as a medium for artistic expression. Parents who want to restrict what their children are able to call up on their computers can avail themselves of software now available on the market that can block out unwanted material. Filtering out such material at the user end is a more practical, and far less objectionable, approach than limiting a nation of computer users to baby talk. Such devices are not foolproof, of course. The surest defense is for parents to try to teach their children the kind of healthy values that would make them uninterested in, or immune to, sexually exploitative material. [End]

1 0

Banks and Crypto - Again
by KDAGUIO＠aba.com 17 Dec '03

17 Dec '03

I apologize for the earlier transmission error/offense. Our server has been down intermittently so I have not received many flames yet. The meeting mentioned has already taken place resulting in significant progress toward our goals. The server is now up. Flame away my friends. ...kawika... ****************************************************************** CONTACT: Sonia Barbara FOR IMMEDIATE RELEASE (202) 663-5469 (1995) ABA REAFFIRMS SUPPORT FOR PRIVATE-SECTOR CONTROL OF CRYPTOGRAPHY Association Recommends a 10-year Extension for the Data Encryption Standard WASHINGTON, July 21 -- The Data Encryption Standard (DES) should be recertified for at least 10 more years to allow interested financial institutions adequate time to convert to any new cryptography standard, the American Bankers Association said in a policy statement issued today. Encryption is the process whereby sensitive data communications, such as wire transfers, credit card and automated teller machine transactions, are protected by secret codes to protect their confidentiality. DES, released in 1977, is the primary method used by financial institutions to encrypt information. Critics say that the longer DES is used, the more likely its code could be broken. While realizing this could limit its life span as a government certified standard, ABA warned that requiring banks to convert to a new standard by 1998 (the year DES's certification expires) could be prohibitively costly due to the high level of electronic funds transfers secured by DES. ABA therefore encouraged the National Institute for Standards and Technology (NIST) to continue to endorse DES as a Federal Information Processing Standard (FIPS) for use by the financial community. There has been an ongoing debate regarding who should control the development and support of private-sector computer security standards: the government or the private sector. ABA strongly recommends that the U.S. government work with the private sector and Congress in an open forum to develop a comprehensive policy on the commercial use of cryptography. In its newly-revised policy statement on cryptography, ABA proposed alternatives to DES and outlined other criteria that must be met before changes in cryptographic standards can be accepted by the banking industry. These criteria -- which will be presented next week to representatives of the White House, U.S. Department of Commerce, National Security Agency (NSA) and federal banking agencies -- were developed following a two-day meeting held in June of bankers, vendors and crypto experts concerned about the federal government's direction regarding private-sector information security. Specifically, ABA recommended: * The financial services industry be allowed to continue to use DES based on risk assessment (e.g. value of the transaction) and the business application involved. * A security framework encompassing a family of commercially available algorithms, including DES, be developed. This framework should include a process for negotiated algorithm selection based on the level of risk and other business requirements. * Opposition to government mandated key management systems for financial applications where keys would have to be stored outside the financial institution (e.g. key registration/surrender or the mandatory escrow of cryptographic keys). Instead, banks should continue to be responsible for key management and continue to cooperate with government for law enforcement purposes, as required by law. * Export of cryptography for financial applications must not be restricted. * Full participation of Congress and the private sector before establishing a U.S. policy for the commercial use of cryptography, instead of being carried out solely by Executive Order. [Note: These recommendations were summarized. For the full statement, please call Sonia Barbara at 202/663-5469.] The American Bankers Association is the only national trade and professional association serving the entire banking community, from small community banks to large bank holding companies. ABA members represent approximately 90 percent of the commercial banking industry's total assets, and about 94 percent of ABA members are community banks with assets less than $500 million. ###

1 0

Re: copyrighting algorithms
by Wolfgang Roeckelein 17 Dec '03

17 Dec '03

Hi, >Wolfgang Roeckelein writes: >> No, I was referring to a case, where a third party game cartridges >> manufacturer reverse engineered the specifications of the game >> cartridges slot for producing his own cartridges for this game. > >Sounds like _Sega v. Accolade_, 977 F.2d 1510 (9th Cir., 1993). >I don't have it in front of me, but Terry Carroll's Copyright FAQ >(ftp://rtfm.mit.edu/pub/usenet/news.answers/law/copyright/faq/part2) >cites it for the proposition that dissasembly of a copyrighted work >can be fair use if there is no other way to reach noncopyrightable >(functional, not expressive) elements of an existing work. Yes, thank you for pointing this out. I'm glad that I was right with Sega... Wolfgang --- Dipl.-Wirtsch.-Inf. Voice: +49 261 6509 173 Wolfgang Roeckelein Fax: +49 261 6509 179 WHU Koblenz E-Mail: roeckelein(a)wi.whu-koblenz.de Burgplatz 2 (NeXTmail ok) D-56179 Vallendar WWW: http://www.whu-koblenz.de/~wolfgang/ Germany --rsa--------------------------------8<------------------------------------- #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) -------------------------------------8<------------------------------------- TRY: echo squeamish ossifrage | rsa -e 3 7537d365 | rsa -d 4e243e33 7537d365 Residents of the USA & France *MUST NOT* include this .sig if following up! *** Residents of France & Russia *MUST NOT* make any use of this -sig ! ***

1 0

Re: Java, Netscape, OpenDoc, and Babel (NewsClip)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Responding to msg by merriman(a)arn.net (David K. Merriman) on Fri, 28 Jul 3:24 AM >Still tentative, or is there a Web address? The mall will be accessible July 31 from a pointer at http://www.org.com . ---------- OSF Opens Software Web Mall For Java Cambridge, MA, July 26 (NB) -- In a teleconference today, the Open Software Foundation (OSF) unveiled plans to open an Open Software Mall on the Web on July 31, and to start distributing software there this fall that will include Java Ports technology for the Web, DCE (Distributed Computing Environment) Web, and Microkernel Unification Specification, a new technology for building cross-platform applications. At the teleconference, which was attended by Newsbytes, Dr. Ira Goldstein, chief scientist and executive VP, said that the OSF sees the Open Software Mall as a place for users to access and help to beta test new technologies like Java Ports, DCE Web, and Microkernel Unification -- being sponsored by the OSF in conjunction with major vendors -- as well as software from universities and other research collaborators, and eventually, outside "open systems" efforts that are "germane to core OSF technology." Java Ports, a series of ports of Sun's Java technology for the Web, is being produced by the OSF with Sun, Hewlett-Packard, and Novell, Goldstein told the journalists and analysts. The technology will be available on the Open Software Mall in September, he added. DCE Web, an application designed to provide the Web with DCE mechanism for encryption, access control, and naming, is a collaborative project from the OSF, Hitachi, HP and AT&T. DCE Web is "consistent with HTTP and secure HTTP," but able to provide additional services to DCE sites, according to Goldstein. Microkernel Unification -- from the OSF, Hitachi, HP and IBM -- is a technology for building cross-platform databases and other applications by writing directly to a standard, common microkernel application programming interface (API). IBM plans to produce a product that is "mostly compliant" with the new specification in the product's first release, and "completely compliant" in its second release, Goldstein noted. Digital Equipment Corp. might also be participating in the Microkernel Unification specification project, Goldstein reported, adding that he expects to have an answer on this from Digital within a week. >From the OSF's Open Software Mall, users will be able to browse, download, and comment on software executables and software, documentation plans, design documentation, specifications, and commentary in hypertext format, according to Goldstein. The Web mall will also provide Web links to "relevant products, services, education and consulting available from the community," he told the teleconference participants. Java, DCE Web, and Microkernel Unification will each have their own Web stores on the Open Software Mall's ATO (Advanced Technology Offering) Plaza. ATOs are software technology projects, which may or may not lead to productization, where participants seek to minimize risk by obtaining feedback from users, noted the OSF's Peter Shaw. ATO development costs typically range from $300,000 to $600,000. For ATO technologies that become productized, licensing rights are estimated at $25,000 per licensee. The OSF also sponsors other vendor efforts, known as PSTs, in which vendors are closer to "productization" of their work, and development costs tend to be higher, said Shaw. Current PSTs include DCE 1.2 and Motif/CDE (Common Development Environment). In addition, four potential PSTs are "being actively pursued," Shaw maintained. "We expect to have some announcements on these later this week," he added. The PSTs will also be given their own area on the Open Software Mall, to be known as PST Plaza. Aside from the stores for Java, DCE Web, and Microkernel Unification, the ATO Plaza will also include "Web pages for a potpourri of (other) ATOs," according to Goldstein. Additional areas of the Open Software Mall will include "Research Plaza," the Motif/CD Store, and areas for tools, training, and consulting. The mall will officially open next Monday, Goldstein said. Initial offerings will include an explanation of its goals and activities, and the opportunity for user commentary. The mall will be accessible from a pointer at http://www.org.com . (Jacqueline Emigh/19950726/Reader Contact: Open Software Foundation, 617-621-8700; Press Contact: Jane Smeloff, OSF, 617-621-8997)

2 1