December 2003 - cypherpunks-legacy

SAIC bought InterNic, but who is SAIC? A spook contractor!
by John Gilmore 17 Dec '03

17 Dec '03

Forwarded-by: gordoni(a)base.com (Gordon Irlam) Thought you might find this interesting. I don't know if you have thought about it or not, but control over the root name service plus some funky software is all that it takes to be able to selectively snoop on all the packets addressed to any host on the net. DNS is currently the achilles heel of a secure internet... gordoni From: Wes Thomas <wes(a)ora.com> The press recently reported that the National Science Foundation has turned over Internet Domain Name registration to Network Solutions, Inc. (NSI) of Herndon, VA. The press failed to note some interesting connections. Tomorrow morning (Sept. 26), Web Review, a biweekly online magazine (see Special Report at http://gnn.com/wr/) will reveal that NSI was purchased in May by Scientific Applications International Corporation (SAIC) of San Diego. SAIC is a $2 billion company indicted by the Justice Department on ten felony counts for fraud in managing a Superfund toxic cleanup site (SAIC pleaded guilty) and sued by the Justice Department for civil fraud on an F-15 fighter contract. SAIC's board members include Admiral Bobby Inman, former NSA head and deputy director of the CIA; Melvin Laird, Nixon's defense secretary; and retired General Max Thurman, commander of the Panama Invasion. Recently departed board members include Robert Gates, former CIA director; William Perry, current Secretary of Defense; and John Deutch, the current CIA director. Current SAIC government contracts include re-engineering information systems at the Pentagon, automation of the FBI's computerized fingerprint identification system, and building a national criminal history information system. "At the very time the Internet community is struggling with the issues of encryption and privacy, I'm more than a little uneasy to find this bunch of ex-spooks sitting at the very entry point of the Net," says Jim Warren (a leading activist in making government records accessible) in the article, which was written by investigative journalist Stephen Pizzo, Web Review Senior Editor and co-author of the book Inside Job, an expose on the savings & loan looting. Web Review is produced by Songline Studios, an affiliate of O'Reilly & Associates.

2 1

STT_???
by John Young 17 Dec '03

17 Dec '03

9-28-95. W$Japer: "Infighting Unravels Alliance Seeking Standard to Protect Internet Purchases." The consortium brought together such top players as credit-card rivals Visa International and MasterCard International Inc., software titan Microsoft Corp. and Internet upstart Netscape Communications Corp. But this week, the alliance split because of tensions between Visa and MasterCard and their respective technology partners -- Microsoft and Netscape. Regarding Netscape, Mr. Dent of Microsoft said the firm's security deficiencies that have recently come to light have "tainted" electronic commerce on the Internet. Mr. Dent also noted that Microsoft yesterday introduced new security technology, including means to verify a user's identity, that is much stronger than Netscape's. STT_??? (6 kb)

5 5

GSSAPI compliant Apps
by Rev. Ben 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm interested in writing a GSSAPI compliant app, but I have been so far unsucessful in finding an example of GSSAPI compliant code to use as a baseline. Does anyone have any pointers? Thanks Ben. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed with Bryce's Auto-PGP v1.0beta3 iQB1AwUBMGtcgL5ALmeTVXAJAQElIQL+JzyPIvta+NRiU6id45o557kvaxGvti4A cREqsyn1oJPXS44GW9/RzdzJMjN7ofnMKqNt/TbKGgMni+XYCc/OAxLauDoKl8vm 4v/tTtfgVWGoS1jEB03SAB7Z2U49HxWv =35YV -----END PGP SIGNATURE-----

2 1

Anon Http web Proxy V2.1
by Laurent Demailly 17 Dec '03

17 Dec '03

I fixed the IOs, it now works a lot faster, play with it on http://hplyot.obspm.fr:6661/ (no abuse plz) and get the source package on ftp://hplyot.obspm.fr/tcl/www/tclhttpdsh-0.4beta.tgz dl -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept smuggle FSF terrorist $400 million in gold nuclear Serbian Clinton

1 1

Crypto hardware (was: Using sound cards to accelerate RSA?)
by cman＠communities.com 17 Dec '03

17 Dec '03

[Tim May writes about why crypto h/w acceleration using DSPs, and DSPs in general, are likely doomed niche markets.] I pretty much agree with Tim, except it's important to realize that a for a _server_ that is doing a lot of RSA operations, the difference between a 3.2 second encryption and a 1.9 second encryption is significant. Peak transaction volume for any public key-based payment system is going to be a factor of how many RSA ops you can do per second. It seems clear though that what's desired for this scenario is good, dedicated hardware based on ASICs. I've been trying to buy a sample board from Uti-Maco in Belgium, which looks ideal for this sort of thing, but have finally given up in the face of communications problems, their fear of RSA Labs, new Belgian export controls they haven't tried to work with yet, and their belief that I need a US crypto import license, which I can't persuade anyone to admit _exists_. Anyhow, for personal use, the only dedicated hardware we're likely to see will not be focused on speed, but rather on security. Stuff like the various PCMCIA cards from Nat Semi and Telequip, the "decoder rings" and "decoder keychain do-dads" and so forth that have security and conveniece benefits.

2 1

Re: Ray Cromwell: Another Netscape Bug (and possible security (fwd)
by sameer 17 Dec '03

17 Dec '03

Forwarded message:

2 1

Re: awards for hacking microsoft
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> What else, Chaum's Digicash. If you are unwilling to part with > any of your own, perhaps you can collect contributions, or maybe > the Digicash people will pony-up some extra cyberbucks for a good > cause. After all, they are worth the paper they're printed on. > :-) Don't tell that to the people on the ECM mailing list! People there have been trading cyberbucks for RealMoney. The last successful trade I saw was 100 cyberbucks for 4 UK pounds... andrew

2 1

53 of the FAX No's. are GOOD!
by carolann＠censored.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- 53 of the Fax numbers were good. About 15 were no good, and the rest turned in no answers. I will update this URL tomorrow, when I can completely check the list; http://www.c2.org/~carolann/enda001.html is where the list is at on the WWW. Love Always, Carol Anne -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGt9S4rpjEWs1wBlAQE5iQP/e74RL+Rmui47LgWT9hk4LNlfISGkHYS2 fdVsut/mbLF/FrRIeETecaSJOOxOBXBr84OYzRLicka+Lm01ciW32pbXYvILftLS vNs7ppWoIs+C343cd3TOZx0p2Q8QuSZSUSGSYCEk1dwZTl/rd1iHTU3DW2ALZ66P xOTLPUV8p1Y= =dJpK -----END PGP SIGNATURE----- -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Subject: Re: 25 Crays a Year to Break STT > Although no encryption system was totally secure, Mr Dent > estimated it would take "25 Cray supercomputers a year" to > break the STT codes. Is it just me, or does someone need to be humbled? STTbruter anyone?

3 2

Q&A on the RSA/Cylink legal dispute
by baldwin 17 Dec '03

17 Dec '03

Here is RSA's Question & Answer sheet on the arbitration. It is available on our web site, www.rsa.com. --Bob ______________________________ Forward Header __________________________________ [RSALogo] --------------------------------------------------------------- Q&A ON THE RSA/CYLINK LEGAL DISPUTE This page contains general questions that have been brought up to us regarding the legal dispute between RSA and Cylink. We are providing these answers in hopes that you may better understand the issues. ---------------------------------------------------------------------------- September 25, 1995 Q. How did RSA's legal disputes with Cylink begin? A. It began in April of 1994 when Cylink filed an Arbitration Demand seeking to have a panel rule that Cylink was entitled to a retroactive patent license to RSA, also called the MIT patent. That was the extent of their Arbitration Demand at that time. The dispute was precipitated by RSA's discovery that Cylink had entered into a secret deal to provide products incorporating the patented MIT technology - even though Cylink knew it did not have a license. ------------------ Q. Why didn't PKP/RSA just sell them one? Isn't that their business? A. We offered them one several times. They wanted to pay essentially nothing for it. Although Cylink denied it, the fact that we offered them a license was confirmed by the Arbitrators in their ruling. ------------------ Q. Patents are routinely licensed and royalties routinely paid; why did Cylink go to the extraordinary length of suing RSA Data Security to obtain a license? A. We learned that in April of 1994 Cylink had won, over other bidders, a very substantial business deal with SWIFT (an international banking consortium) to provide X.25 encryption units for use by SWIFT on a worldwide basis. SWIFT had insisted that these products use the RSA patented technology for key management and authentication. Cylink had represented to SWIFT in their April 1994 contract that Cylink had a license to provide RSA technology. But they didn't. Cylink chose to sue us to win a retroactive license rather than simply admit what they had done and pay for a license. Cylink never informed us of their use of RSA or the representation to SWIFT. They never paid a penny to PKP or RSA for their unlicensed use of the RSA technology. They never even put any royalties aside. None of these facts are in dispute and are all a matter of public record. ------------------ Q. How did the litigation go beyond a limited Arbitration over a license? A. We didn't understand it at the time, but it's obvious now. While more claims and counterclaims were added to the Arbitration demand, Cylink knew of their SWIFT problem and other similar problems; we didn't. We believe that they were desperately trying to cover their unlicensed use of RSA by trying to litigate us into submission before it was discovered. It didn't work. ------------------ Q. What were the additional claims by each side? A. Charges were made by each RSA and Cylink that the other had breached the exclusive licensing authority of PKP among other wrongful acts. This brought a second set of issues for the Arbitrators. Finally, both parties asked to have PKP dissolved as we obviously could not continue as business partners; this was the third issue to be decided. It's quite clear in the Arbitration Panel's ruling that there were only three issues to be decided: (a) is Cylink entitled to a retroactive license to use RSA; (b) did either party breach the Partnership Agreement; and (c) should PKP be dissolved. The answers were no, no, and yes. ------------------ Q. If that's true, then how does Cylink claim that the Panel's ruling determined that RSA software customers are infringing the Stanford patents? A. The Arbitration Panel did not determine that the use of RSA software by RSA licensees or that the practice of RSA infringes the Stanford patents. It is most certainly true that the ruling was very limited; the Ruling itself starts out by stating the questions. The Panel did not, under any interpretation, rule on patent validity or determine that anyone was infringing. Cylink's claims to the contrary, along with their claims that somehow Cylink can rely on the Ruling to prove infringement is simply not true and ignores many other facts. ------------------ Q. What other facts? A. The Panel's ruling was very specific. Everything it said about third parties, including RSA customers who use software, refers to their need for patent licenses. If you bought software from RSA and RSA itself had the rights to make that software and license it to you, you don't need a separate patent license; rights to the patents came with the product. The Ruling also states, "RSA has a right to license its software." ------------------ Q. Under what circumstances would you need a separate patent license? A. If you want to make your own product -as opposed to buying one, such as RSA's software- you need a patent license. If you bought a software product but didn't use it, meaning you wrote your own, or re-wrote it, then you may need a separate patent license to do that. We believe the Panel was simply making it clear that just because you bought software from RSA, that fact alone doesn't mean you are free from the need for a separate patent license if you're not using the RSA software and making your own. You didn't get an explicit patent license with the software, you got rights under the patents as necessary to use the software. If you're using RSA's software -you didn't write your own- you don't need a separate patent license under either the MIT or Stanford patents. ------------------ Q. Are there other relevant facts that Cylink has ignored? A. Perhaps the most important fact that Cylink is carefully ignoring is that Cylink knows RSA did indeed have rights to make products under the MIT and Stanford patents. Cylink, for over five years, knowing full well what RSA sold and how, has not only referred customers to us, but in some cases where the customer was being cautious, Cylink confirmed to them in writing at their request that no separate patent licenses were necessary if they licensed RSA software. In other words, prospects of RSA's went to Cylink and said, "We're going to license this software from RSA. Do we need separate patent licenses from Cylink or PKP?" Cylink confirmed the answer - no. (And those companies then did in fact license our software. Cylink didn't turn around and sue them.) This alone should deter Cylink from bringing infringement suits against RSA customers. Nothing in the Panel's ruling changes any part of these facts. In fact, Cylink acknowledgment that RSA had such rights came out in the Arbitration proceeding itself. It's a matter of record. Cylink would also not like anyone to be aware that a suit was filed in Federal Court in 1994 to invalidate the Stanford patents, and that a ruling is due in December. ------------------ Q. How is RSA protecting its customers from action by Cylink? A. We have filed a Declaratory Relief Action in Federal Court. In that action, we have essentially said that Cylink is estopped -prevented- from taking action against anyone for infringing the Stanford patents for several reasons. The main reason is that companies who licensed software from RSA Data Security rather than "build their own" software do not need separate licenses to the MIT or Stanford patents. Since Cylink has confirmed this many times since 1990, they should not sue anyone for infringement. Another reason is that the Stanford patents are unenforceable and/or invalid. This action by RSA means that any suit brought by Cylink against anyone for infringement of the Stanford patents should be stopped until the resolution of the Declaratory Relief action, and Cylink will have to prevail on all the points above before they can assert any infringement. We have also indemnified our customers against claims such as those implicitly threatened by Cylink. RSA intends to stand behind these indemnity agreements fully. Anyone can bring a lawsuit for just about any reason. If Cylink tries to sue an RSA customer, RSA has both the determination and the resources to defend any such action. Read the Cylink press release carefully. Cylink huffs and puffs a lot, but is not directly threatening to sue anyone -that would mean they would be forced to fight the virtually impossible battle of prevailing on every point in our Declaratory Relief action- but instead are saying that buying a license can eliminate any risk. ------------------ Q. Has anyone else challenged the Stanford patents? A. A suit was filed in Federal Court last year by Roger Schlafly to invalidate the Stanford patents. A ruling is due in December. From what we've seen, Schlafly's claims raise disturbing questions about the Stanford patents. This whole business of the Stanford patents may be moot in a few months. There may be no risk - and no need to try to get any money back from Cylink. ------------------ Q. What will be the significance of PKP being dissolved? A. The most important change we see is that licenses to the MIT patent will be available for the first time in over five years without Cylink interference. * There is a tremendous amount of pent-up demand, and we are very busy filling it. Many of the largest companies in Europe, Asia, and the US are purchasing licenses to bring RSA-based products to market, including many low-cost chips and smart cards. We have already licensed a number of large and small companies that are bringing RSA-based electronic commerce, access control, and Internet security systems to market; we expect many, many more. ------------------ Q. Why can't RSA and Cylink simply settle their differences? A. That's a good question. The fact is that RSA recognizes this litigation is not beneficial to anyone and has offered to settle the dispute by granting Cylink a license to the MIT patent. Cylink has consistently overestimated the strength of its legal position and has refused all reasonable offers. Cylink now finds itself in the unenviable position of trying to sell its security products without RSA technology - which is the de facto industry standard. No amount of "spin doctoring" in press releases by Cylink changes that fact. ------------------ * During its existence from April of 1990 until September of this year, PKP could not grant any license without the approval of both partners. As a result of PKP's dissolution, the rights to the Stanford patents were returned to Cylink, and the exclusive right to license the MIT patent (RSA) was returned to RSA Data Security, Inc. Cylink currently has no rights to sell any products incorporating the MIT patented technology. ---------------------------------------------------------------------------- (C) 1995 RSA Data Security, Inc. All rights reserved. Permission granted for unlimited reproduction and distribution unmodified.

3 2