December 2003 - cypherpunks-legacy

Re: Cylink
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

> WSJ, Sept 19, 1995. > > Cylink Claims Right To Key Technology Involving > Encryption > > ... > > Sunnyvale, Calif. - A Silicon Valley company asserted a > legal claim to a key technology for protecting electronic > commerce, following an arbitration ruling. > > ... The arbitrators > ruled that RSA hasn't had the right to sublicense the > Stanford patents since 1990. > > Cylink said it would seek royalties from companies that > have licensed software code from RSA and are > redistributing it, arguing that they are infringing the > Stanford patents. > This was reported in the San Jose Mercury News today, as well. They reported that Cylink licenses the patents for $50,000. I'm assuming that the main patent in question is the Diffie-Hellmann patent (only 1 year and 7 months to DH Freedom Day!). Since PKP (and Bidzos, now president of RSA) always said that DH covered all public key encryption, it would seem that any RSA licensee would also need a license from Cylink. The Merc article said that RSA's and Cylink's interpretation of the arbitrators' ruling were completely opposite. I haven't seen a copy of the ruling. The Merc says that "Outside observers tend to take RSA's view of things." I'm stunned that an arbitrator could make a uniterpretable ruling on something so cut and dried, but then, IANAL. I've called both PKP and RSA, I haven't been able to talk to anybody about it yet. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-8624

1 0

Crypto hearings via C-SPAN
by Greg Broiles 17 Dec '03

17 Dec '03

The Senate Judiciary Subcommittee on Technology, Terrorism, and Government Information held hearings this afternoon on encryption; audio is available now at <http://www.c-span.org/>, I don't follow C-Span so I don't know how long they'll make the recording available. I haven't finished listening to the recording, but it so far has featured Senator Leahy and Louis Freeh reminscing pleasantly about their early-morning walks near Sen. Leahy's farm in rural Vermont, and Freeh talking about how the situation prior to the enactment of Digital Telephony looked bleak - but with the helpful intervention of Congress, a "balance" was achieved between privacy and law enforcement which has made everyone happy. Ahem. Key escrow is being compared to airbags in cars; they're discussing forcing crypto software authors to include key escrow in their software, and allowing users to "choose" to use it or not. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto.

1 0

NetManage - Cylink Press Announcement
by Bob Williams 17 Dec '03

17 Dec '03

There are quite a few open issues regarding the reliability, interoperability, and licensing of public key technology. All parties interested in access to code for testing and comment please respond to this email address. Thanks Bob ------------ NETMANAGE, Inc. Press Release FOR IMMEDIATE RELEASE Contact: Donna Loughlin, NetManage, (408) 973-7171 Donna(a)netmanage.com NetManage Licenses Public Key Cryptography from CYLINK The Two Firms to Promote an Open Interface for Internet Security which Corrects Flaws and Eliminates Financial and Interoperability Barriers for Cryptography. Cupertino, California - September 19, 1995- NetManage, the leader in TCP/IP Applications for Windows and Internet productivity software, announced today that is has signed a licensing agreement with CYLINK Corporation for technology which incorporates the fundamental patents covering public key cryptography. NetManage will be providing support for public key authentication and data encryption as a fundamental component of its Chameleon Enterprise strategy. The two firms further announced that they plan to provide support for an open interface for Internet security which will address recent flaws found in cryptographic implementations used by Netscape Communications and other unpublicized security holes in existing Internet security protocols. The standard is further intended to eliminate the financial and interoperability barriers that have been holding back widespread use of public key cryptography on the Internet. In a separate announcement released yesterday, CYLINK announced that it had prevailed in a patent lawsuit with RSA Data Security which found that RSA had infringed U.S. patents held by CYLINK which cover all known implementations of public key technology. About Internet Security ----------------------- Establishing a secure Internet connection requires any computer software program to perform two functions: Authentication of the user, and bulk encryption of data. The Authentication phase allows two computers to verify that each party is who they claim to be, and that they are authorized to enter into a secure communications session. This is done via 'public key' technology, which was developed and patented originally by Stanford University and licensed exclusively by CYLINK Corporation. During the authentication phase the two computers also agree upon the encryption method to be used for bulk data transfer during the time the two computers are communicating data between one another. These ciphers can be implemented in either software or hardware, including PCMCIA cards. Popular encryption ciphers include DES, Triple-DES, SAFER, IDEA, Skipjack, RC-2 and RC-4 and are available from a variety of software and hardware vendors. Limitations of Current Internet Security Standards -------------------------------------------------- Current implementations of security protocols proposed as standards by Netscape Communications and RSA Data Security, Inc. include security flaws and fail to fully accommodate open and interoperable secure communications between computers which use different bulk encryption ciphers. These problems have limited the adoption of Internet security as a widespread interoperable feature of all Internet software and hardware products including end-user applications, servers, firewalls, and secure routers. NetManage and CYLINK, along with other major software and hardware developers, will be announcing next week the release of a publicly available security implementation which allows for plug & play interoperability for users of Internet security, and the endorsement of protocol extensions which improve the reliability of current proposed Internet security standards. This open implementation will not lock software or hardware developers into the use of encryption technology from any one vendor. Related APIs, key exchange technology, and encryption will be made publicly available to other software and hardware developers. Licensing will include source code and no per-copy royalty fees. About NetManage --------------- NetManage Inc., the fastest growing software company in the United States, develops markets and supports an integrated set of Internet-based applications, servers and development tools for Microsoft Windows, Windows 95 and Windows NT. NetManage software allows corporations to facilitate communication, sharing of information and collaboration between workgroups using Internet technology. The company's award winning products include Chameleon, Internet Chameleon and ECCO. NetManage is a public company, whose shares are traded on the NASDAQ under the ticker symbol NETM. Its products are sold world-wide by NetManage's direct sales force and authorized channel partners. About CYLINK ------------ CYLINK Corporation is the worlds largest provider of enterprise-wide network information security products and wireless communications. CYLINK is the exclusive holder of the fundamental patents which broadly claim the invention of public-key cryptography (Diffie-Hellman, Hellman-Merkle, and Helman-Pohling) and which were originally developed at Stanford University. Headquartered in Sunnyvale, California, CYLINK serves Fortune 500 companies, financial institutions and government agencies. Licensees of CYLINK technology include CISCO Systems, and other prominent hardware and software developers. # # #

1 0

Unlicensed net.psychotherapy
by Damaged Justice 17 Dec '03

17 Dec '03

[somewhat snipped from raw lynx dump] Daily Double Scoop Graphic Just enough Net news. By John Motavalli Is Psychotherapy On The Net Legal? HOW DOES ONE OFFER PSYCHOLOGICAL HELP ONLINE? Very cautiously. The issue of whether the practice of psychology or psychiatry online is legal still appears to be a bit unclear. Psychologists have to be licensed to practice in each state. If they're doing psychotherapy over the Internet, and they're offering therapy to people in states where they're not licensed, are they breaking the law? Sacramento psychologist Ronald L. Mann, Ph.D., has a [8]site, allowing a visitor to "e-mail a question (about anything from relationships to career changes)." This service costs you $20 a question. Dr. Mann, who is licensed in California only, said he's not breaking the law because he is not offering psychotherapy online. "Technically, psychotherapy is about exploring unconscious thoughts and feelings and making interpretations about these earlier memories, feelings, and linking them to present circumstances," Mann said. "I'm uncomfortable (professionally and personally) doing psychotherapy on the Internet. I think people need a personal face-to-face relationship that will provide emotional support when they get into intense powerful emotional material. I can't offer that through e-mail. What I can offer is good sound educational advice and point them in a good direction." Doug Fizel, deputy director of public affairs at the [9]American Psychological Association in Washington, D.C., said the question of the legality of online psychiatry is under study. "That really has not been worked out yet within the APA," he said. "It does really raise a lot of good questions, as to whether someone in California can legally offer therapy to someone in New York. You also have to ask whether someone can truly enter into a genuine therapeutic relationship online." Mann noted a recent correspondence he had with a young man who has some personal problems. "He is in college, and he has very poor self-esteem. He's really anxious in his relationships with other people, he has trouble sustaining relationships. We talked (by e-mail) about what it takes to have comfortable relationships with other people, and early childhood issues." I said this sounded like psychotherapy. "I know it's not psychotherapy," Mann replied. "I could have said, 'Why don't we do this [a treatment process]. I didn't. I actually think psychotherapy wouldn't work very well via e-mail." Adds Fizel, "It's more a question of ethical practice -- the difference between law (which a state would determine) and ethical practice (determined by an organization like ours)." He concludes that "So far, the questions have been raised, but the answers haven't been found." 8. http://www.ronmann.com/ 9. http://www.apa.org/

1 0

Unabomber ?
by John Young 17 Dec '03

17 Dec '03

Bill, Both the Times and Post report that only the Post is publishing the FC-piece. I'm scanning it now and will offer it in a while -- it's a long, long pole. I'll ask by this post if someone wants to offer it FTP, I can only do multiple e-mail bites from this hole.

3 2

Re: NSA and Netscape Crack
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim wrote: >> If the "flaws" are being found by our group, as John notes, just what is >> the NSA doing in the _second_ role it is supposed to have, it's "COMSEC," >> or communications security, role? and then Thomas wrote: >Gee Tim, NSA is "helping" us out by creating Clipper and new key escrow >mechanisms ;) > >"I'm from the NSA, I'm here to help your crypto..." In the relatively short time I've been on this list, Cypherpunks have bruted, and then found a weakness in, two kinds of Netscape software. [A fine public service, IMO. Congrats to all involved.] I don't expect to know NSA's specific brute-force capability, but does anyone know if the NSA has *ever* found a glaring weakness in software and then told its author(s) or owner(s) about it? Do "we" perform the "COMSEC" role Tim was speaking of better than the NSA? JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMF9VHW1lp8bpvW01AQFZkwQAiQWJMfdP+5v0CozYH59ZGWUhpaKxgX15 vdVCdSzHgaN6sj5aLVL4yRI0bkVe/6nJ8I4Nj9cYS5K5AgbcmiRDLvEulc0Y+mwr B9rQBUcX7hM6lA+tEk2UpiGmR1xdh2U0Qpu93zT8T7MZtIc5dRReKeT21OXl4W96 NX4iONaceGY= =2nmI -----END PGP SIGNATURE----- Regards, Jim Ray "Censorship reflects society's lack of confidence in itself. It is a hallmark of an authoritative regime." -- Justice Potter Stewart ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

1 0

KEEP YOUR EYES ON YOUR MAILBOX ....
by rewards＠t-1net.com 17 Dec '03

17 Dec '03

/////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. //////////////////////////////////////////////////////////////////////////////// I have been a business owner for over 30 years, involved in various things, and I have found different strategies for making money, working at home.... I thought you might like to know, this really works, if you will only try it... For more information send e-mail to max(a)answerme.com

1 0

http://www.c2.org/hacknetscape/critique.phtml
by sameer 17 Dec '03

17 Dec '03

My response to netscape's press release. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Accept Major Credit Cards...Online Merchant Accounts!
by cag1465＠onestopshop.net 17 Dec '03

17 Dec '03

Hi there, Credit Cards are the universal currency of the Internet, and, if you want to do business online, you need to be able to Accept Visa, Mastercard and American Express cards on your Web site. Trouble is, many banks wont give merchant status to businesses that are new, home-based or located in cyberspace instead of a real-world storefront or mall. Thats why were pleased to present a special offer from USConnect, a major merchant account provider thats helping companies like yours get merchant status on the Net. The benefits include: * 2% Discount Rate * No Monthly Minimum Billing Fee * No Statement Fee if No Sales Made for the Month * Money Available in 2 Business Days * Windows-Based or Macintosh Compatible Credit Card Processing Software (Available) * Shopping Cart System To Take Orders Securely Right On-Line (Available) * Referral Program - $100-$200 Rewards For Each Referred Account *And Much, Much More. . . .! I invite you to browse our website for more information and registration: Go to: Accept Credit Cards Online Apply now and start your cash flowing today! If you wish to be removed from our mailing list, please click "PLEASE REMOVE" and type REMOVE in the subject field.

1 0

Re: Crypto + Economics + AI = Digital Money Economies
by szabo＠netcom.com 17 Dec '03

17 Dec '03

I wholeheartedly agree with Tim that economics should play an important role in analyzing cryptographic protocols. It lets us step back and ask what features are important, and in general what we are trying to accomplish: usually something very different than the military uses of cryptography that have given rise to the current methodologies. To economics, especially game theory, I add a vast body of knowledge about human relationships, especially those involving commerce, that civilization has accumulated over the years: law, especially business law. If we step back and look at what many cypherpunks are trying to achieve, a major idealistic theme is a Ghandian cyberspace where violence can only be make-believe, whether in Mortal Komat or "flame wars". Cypherpunks want our telephone networks, Internet businesses, etc. to be both protected from force, and not dependent on force for their existence. Our 20th century information commerce systems, from publishing to credit cards, have often been very dependent on the threat of violence, usually law enforcement, to protect intellectual property rights, deter fraud, collect debts, etc. There is no utopia in sight where such threats can be completely eliminated, but we can recognize that they exist and carefully work to reduce our dependence on them. In a far more practical vein, the dawn of international commercial networks that criss-cross hundreds of jurisdictions with complex, obscure, and often contradictory regulations, gives rise to a vast market opportunity for substituting, where possible, network security mechanisms for law enforcement dependencies. The recent discoveries in cryptographic protocols provide us with a rich toolbox for solving these problems. Perhaps the most fundamental building block of business law is the contract. Strongly related to Tim's ontology of money is an area I have developed quite extensively called _smart contracts_. The terms of contractual relationships can often be formalized and standardized, and then performed via network-based protocols. These protocols, along with economic incentives, protect the performance of the contract from both fraud by the principals and attack from third parties. This is also the basic task of law enforcement in commercial law; thus smart contracts when successful reduce dependence on law enforcement as well as losses to fraud and cracking. Of special interest to cryptologists is that the principles of contract provide us with a methodology for the use of cryptography that is very different from, and potentially far more lucrative than, the traditional military paradigm. I have much more to say about these things in my essays under http://www.digicash.com/~nick/, and in a forthcoming article for _Extropy_. Nick Szabo szabo(a)netcom.com

1 0