December 2003 - cypherpunks-legacy

Re: Netscape to patch shareware version
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:00 PM 9/12/95 +0200, you wrote: >>| Netscape said it received word last week that the State Department had >>| cleared that version for release on the Net, but only within the U.S., >>| owing to current export laws banning the export of encryption schemes >>| stronger than 40 bits. THe company could provide no details by press >>| time on how it would ensure that the 128-bit version wouldn't leak beyond >>| U.S. borders. >> >>Ok, any bet on how long it will take? > >It's already been exported. Evidently, one of those who bought the commercial >version sent it to Europe as soon as it was out. The Netscape "personal edition" was available in Europe on some store shelves soon after it's release. (The PE edition of netscape has the 128 bit encryption.) As for what Netscape will do in this case... They had made plans to release the 128 bit version in a method similar to what MIT uses, but they found that they could actually get people to buy a copy if they kept that one as only available by ordering it. (Who says that people will not pay for encryption?) Now all they need to do is come out with a version with a bigger key. (Hint, hint...) I will keep my personal feelings about Netscape to a minimum here. There are certain things that they do well and there are others they do not. But those problems will continue to be forwarded to Dave Null... Well, on to more profitable things. > >I note the site removed it, however, probably because Netscape Comm. Inc. requested that they do so. Netscape generally objects to anyone else carrying their browser (.edu sites with prior permission excepted). > > > > | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

Re: An alternative to remailer shutdowns
by jim bell 17 Dec '03

17 Dec '03

At 02:12 AM 5/27/96 -0400, Black Unicorn wrote: >On Sat, 25 May 1996, jim bell wrote: > >> > Why the first in chain? If the anti-traffic-analysis provisions are >> >working properly, it should be impossible to prove that a given first remailer >> >was the first remailer for any particular message. I had thought that even >> >civil courts required that you be the person who committed some act, not the >> >person who _might_ have committed some act. Otherwise, all the remailers are >> >in danger. This is even if someone tries an entrapment by sending through some >> >illegal material - if the courts accept that they should be allowed to do this, >> >then all the remailers they chained are going to be hit. >> >> Likewise, I don't see why the first address in the chain is vulnerable, as >> long as the message subsequently passes through at least one trustworthy >> remailer, and probably a temporary output address. > >I repeat, all it takes is one person to send through only one remailer >(perhaps even a Co$ plant) and the first in chain remailer is toasted. > >Think before you type please. You should take your own advice. The mere fact that the first link in the chain is "known" doesn't mean that it is provably involved. Without a substantial amount of bugging that the COS hasn't the resources to do, there is a big difference between them _believing_ that a given message originated there, and being able to prove it in court. And notice my caveat: "As long as the message subsequently passes through at least one trustworthy remailer, and probably a temporary output address." Jim Bell jimbell(a)pacifier.com

2 1

Re: Java Crypto API questions
by jim bell 17 Dec '03

17 Dec '03

At 11:44 AM 5/31/96 -0400, Moltar Ramone wrote: >On Fri, 31 May 1996, Lucky Green wrote: >> Where does this leave foreign vendors? Will Sun sign the 3DES package of a >> foreign vendor? > >Probably. But they won't be able to export the signed 3DES package :) >It leaves foreign vendors in trouble, is where. But why can't they just export the SIGNATURE, if it is detached from the software itself? Jim Bell jimbell(a)pacifier.com

2 1

new info-sec mailing list
by fc＠all.net 17 Dec '03

17 Dec '03

Info-sec heaven is introducing a new mailing list. Unlike many of the Internet's mailing lists, this is not an open forum for people on the Internet to exchange ideas. Rather, it is a monthly mailing used to inform readers of new information that can be found in info-sec heaven. If you would like to be informed of new information, services, search capabilities, protection software, articles, books, and other information that appears in info-sec heaven without having to come in periodically and look for yourself, please let us know by sending email to fc(a)all.net and we will add you to our monthly list. Thank you for your time. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

Re: DCSB: Electronic Commerce: The State of the Art
by geoff＠commtouch.co.il 17 Dec '03

17 Dec '03

The signature on the message attached below did not verify. Pronto Secure has the neat feature of doing signature checking on the fly. In the process of testing PSecure I have collected from the keyservers, the keys of most people on the list who pgp sign their messages. (Another neat feature of PSecure makes this a one click task) I could quite easily perform the service of bouncing messages with bad signature back to the list. Please let me know if people agree that this would be a useful service, or is it inappropriate ? My experience over the past few months is that around 10% of all signed traffic on the list checks with a BAD SIGNATURE! Geoff Klein Pronto Secure Product Manager.

3 2

Cash Is Dying
by jya＠pipeline.com 17 Dec '03

17 Dec '03

6-14-96: NYT ad for The New York Times Magazine: Cash is dirty. Cash is heavy. Cash is quaint. Cash is expensive. CASH IS DYING. "You believe in banks don't you? That's good, because ultimately money is backed by nothing but your own confidence, habit and faith -- a form of faith as powerful and essential to modern life as any religious belief. The coming digital era will make this plain to everyone, as never before." (Continued on Sunday) From "Dead as a Dollar" by James Gleick ...the cover article in this week's issue. --------- Yes, the James Gleick whose co-founded Pipeline is near dead as a dollar. Hope his multi-million-dollar PSI-buyout lives.

5 5

No Subject
by A5113643667＠attpls.net 17 Dec '03

17 Dec '03

Dear Cypherpunks and Tom, The ones I've heard about are SKIP, Photurus and ISAKMP(sp?). Peace --- NOTICE: This message originally included graphics and/or sounds which can only be received by AT&T PersonaLink(sm) subscribers. You received only the text portion(s) of the message. Please contact the sender for information that was deleted. To learn how to send and receive graphics, voice and text messages via AT&T PersonaLink Services, call 1-800-936-LINK. ---------------- Received: by attpls.net with Magicmail;12 Sep 95 10:34:32 UT Date: 12 Sep 95 13:05:43 UT Sender: owner-cypherpunks(a)toad.com (owner-cypherpunks) From: owner-cypherpunks(a)toad.com (owner-cypherpunks) Subject: Re: draft key mgmt props To: peace(a)acm.org (Tom Jones) cc: cypherpunks(a)toad.com (Cypherpunks) Message-Id: <199509121024.GAA15929(a)frankenstein.piermont.com> In-Reply-To: <Your message of "Tue, 12 Sep 1995 07:15:16 -0000." <3E79EDD0>> Reply-To: perry(a)piermont.com (perry) X-X-AUTHENTICATION-WARNING: frankenstein.piermont.com: Host localhost didn't use HELO protocol X-X-REPOSTING-POLICY: redistribute only with permission Tom Jones writes: > Does anyone here feel like explaining the situation between the three > key management proposals now at the internet draft stage? Which ones are you refering to? .pm ----------------

2 1

Re: Elliptic Curve Public Key Crypto available
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> Previous to the availabilty of 100 MHz processors this method of > public key crypto was ridculously slow. The only versions were > laboratory curiosities implemented in ASIC hardware. Code, if it > exists, is not in the public domain. What about NeXT's Fast Elliptic Encryption (FEE)? Their research guy, Richard Crandall, came up with major speedups to elliptic curve encryption. In fact, there was a simple cryptosystem that shipped as a demo with NeXTSTEP 2.0. What was most interesting about this system was that it didn't store any keys anywhere; your public/private key pair was generated _on the fly_ from your passphrase every time you encrypted or decrypted....on a 25mhz 68040 too... and it was fast! It wasn't that great of an implementation (you _really_ need a lot of bits of entropy in that passphrase, and you can't change your passphrase without changing your PK), but it shows how fast NeXT's speedups are. And this was in 1990... I'm not sure if the speedups are patented, but you could try a literature search. If it really is fast then it could mean good things for servers that need to do a lot of enrcyption/decrption for interaction with clients. andrew

2 1

Re: Alternic.net (was domain zapping)
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

At 05:54 AM 6/26/96 -0400, you wrote: > >William Knowles writes: >> With all the talk about InterNIC zapping domains, there should be >> some talk about other registries, Alternic.net : http://www.alternic.net >> is offering an alpha test for registering new TLD's and the prices >> are considerably less expensive than the Internic. > <snip crap> > >They can offer to sell you anything they like, of course, and you can >pay them, but you don't get anything at all for the money. Domains >registered with them don't appear in the real DNS. > >.pm Perry, What constitutes "real DNS"? DNS server administrators need only add one line to their named.boot file to resolve .nic hosts. secondary nic 204.94.42.1 db.nic It's that easy! The concept of centralized name resolutions is flawed and only exists out of habit. J.

3 2

Degaussing a pile of 5.25" media
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I have 3 bags full of 5.25" diskettes (in NYC). Can someone please let me use their degausser before I get rid of them? (Anyone who wants them after they're degaussed is welcome to them :-) --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1