December 2003 - cypherpunks-legacy

Cylink
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

WSJ, Sept 19, 1995. Cylink Claims Right To Key Technology Involving Encryption Sunnyvale, Calif. - A Silicon Valley company asserted a legal claim to a key technology for protecting electronic commerce, following an arbitration ruling. Closely held Cylink Corp. said the ruling gave back to the company control over two key Stanford University patents regarding public-key encryption, a technique for scrambling data from theft or eavesdropping. A panel of three arbitrators, asked to settle a dispute between Cylink and RSA Data Security Inc., dissolved a five-year partnership between the two that pooled their encryption patents. RSA, a closely held company based in Redwood City, Calif., is the dominant supplier of encryption software, with users that include Microsoft Corp., Novell Inc., Netscape Communications Corp., Apple Computer Inc. and International Business Machines Corp. The arbitrators ruled that RSA hasn't had the right to sublicense the Stanford patents since 1990. Cylink said it would seek royalties from companies that have licensed software code from RSA and are redistributing it, arguing that they are infringing the Stanford patents. -----

1 0

Financial Services Technology Consortium
by rah＠shipwright.com 17 Dec '03

17 Dec '03

A friend found this... Cheers, Bob Hettinga --- begin forwarded text Bob: I was looking for a web site for Shawmut/Fleet Bank and could not find one. But I did come across this which I thought might be of particular interest to you... http://www.llnl.gov/fstc/index.html It is the Financial Services Technology Consortium (FSTC), which is a consortium of financial services providers, national laboratories, universities, and government agencies who sponsor and participate in non-competitive collaborative research and development on interbank technical projects. Cheers, Will --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: ASCII unabomber paper attribution and FTP address (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: lmccarth(a)cs.umass.edu (L. McCarthy) > Subject: Re: ASCII unabomber paper attribution and FTP address > Date: Tue, 19 Sep 1995 15:10:48 -0400 (EDT) > > Actually it's: > > ftp://ftp.ai.mit.edu/pub/users/misc/unabomber > > It isn't as of 4:28 Central...:( Anyone got a clue as to where it has flow to? Jim

1 0

Una FTPaper 2
by John Young 17 Dec '03

17 Dec '03

ftp.hacktic.nl/pub/incoming/unabomb.txt

1 0

Netscape responds.
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

Netscape now has an article on their home page about the latest break in their security. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Re: Netscape's random numbers
by sharborth＠hai-net.com 17 Dec '03

17 Dec '03

Congrats, nice job! The Netscape license explicitly prohibits decompiling (except where such prohibition is illegal). When this hits the media it will be important to avoid being tarred with the "hacker breaks rules and breaks in" brush. More subtly, it's probably a bad idea to call into question the overall business model of client binaries on the net. So. At least they're honest and let everbody know. Instead, emphasize importance of open code, public reviews, ability to link in your own code that meets public specs, etc. All of these things the Internet was designed to do, and U.S. ITAR regulations are designed to prohibit (globally, anyway). And also that the bad guys will never play by the rules. And re-emphasize that solutions are possible, just that the U.S. government prevents them from being deployed in a global economy. Here, here! Perhaps draw parallels to the recent Microsoft Word virus. /r$ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-= W.S. "Skip" Harborth Manager & Senior Engineer Information Systems Security Engineering Houston Associates, Incorporated 4601 North Fairfax Dr, Suite 1001 Arlington, Virginia 22203 USA (703) 284-8732 812-5099 (fax) sharborth(a)hai-net.com The opinions expressed are my own and have no relation to my employer. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=

1 0

Re: Cylink
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

> WSJ, Sept 19, 1995. > > Cylink Claims Right To Key Technology Involving > Encryption > > ... > > Sunnyvale, Calif. - A Silicon Valley company asserted a > legal claim to a key technology for protecting electronic > commerce, following an arbitration ruling. > > ... The arbitrators > ruled that RSA hasn't had the right to sublicense the > Stanford patents since 1990. > > Cylink said it would seek royalties from companies that > have licensed software code from RSA and are > redistributing it, arguing that they are infringing the > Stanford patents. > This was reported in the San Jose Mercury News today, as well. They reported that Cylink licenses the patents for $50,000. I'm assuming that the main patent in question is the Diffie-Hellmann patent (only 1 year and 7 months to DH Freedom Day!). Since PKP (and Bidzos, now president of RSA) always said that DH covered all public key encryption, it would seem that any RSA licensee would also need a license from Cylink. The Merc article said that RSA's and Cylink's interpretation of the arbitrators' ruling were completely opposite. I haven't seen a copy of the ruling. The Merc says that "Outside observers tend to take RSA's view of things." I'm stunned that an arbitrator could make a uniterpretable ruling on something so cut and dried, but then, IANAL. I've called both PKP and RSA, I haven't been able to talk to anybody about it yet. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-8624

1 0

FBI calls for mandatory key escrow; Denning on export ctrls
by Declan McCullagh 17 Dec '03

17 Dec '03

All encryption products sold or distributed in the U.S. must have a key escrow backdoor "like an airbag in a car," law enforcement agents advised a Senate panel this afternoon. FBI Director Louis Freeh also told a Senate Judiciary subcommittee that "network service providers should be required to have some immediate decryption ability available" permitting agents to readily descramble encrypted messages that pass through their system. This marks the most aggressive push to date for mandatory domestic key escrow (or "key recovery"), which means someone else other than the recipient can decipher messages you send out. Now, the easiest way to win such a political tussle in Washington is to control the terms of the debate. And nobody understands that rule better than Sen. Jon Kyl (R-Arizona), chair of the Judiciary subcommittee on technology, terrorism, and government information. Kyl opened today's hearing not by saying its purpose was to discuss crypto in a balanced manner, but that he wanted "to explore how encryption is affecting the way we deal with criminals, terrorists, and the security needs of business." Then he talked at length about "criminals and terrorists" using crypto, and child pornographers "using encryption to hide pornographic images of children that they transmit across the Internet." Kyl also stacked the three panels. Out of seven witnesses, five were current or former law enforcement agents. No privacy or civil liberties advocates testified. Some companies including FedEx apparently dropped out when told they'd have to pay lip service to key escrow if they wanted to speak. Dorothy Denning, a Georgetown University professor of computer science, did testify. Kyl made a point of asking her if she still supported key escrow systems (two recent articles by Will Rodger and Simson Garfinkel said she was changing her mind). "I think key recovery offers a very attractive approach," Denning said. What about export controls? "In the absence of any controls, the problem for law enforcement would get worse," she replied. But when Sen. Dianne Feinstein (D-Calif) asked if Denning would support a *mandatory* key escrow system, the computer scientist said she wouldn't. "No, because we don't have a lot of experience we key recovery systems... a lot of people are legitimately nervous." (Keep in mind that although Feinstein supposedly represents Silicon Valley, she's no friend of high tech firms. She opposes lifting export controls; in fact, she says that "nothing other than some form of mandatory key recovery really does the job" of preventing crime. Of course, Feinstein doesn't have a clue. She talks about whether businesses would want "a hard key or digital key or a key infrastructure." Yes, folks, this is in fact meaningless blather.) Marc Rotenberg, director of the Electronic Privacy Information Center in Washington, DC, says, "Simply stated, the Senate train is headed in the wrong direction. But of course this doesn't answer the question of what will ultimately be resolved by Congress? There's a very popular measure in the House right now that's heading in a different direction." Rotenberg is talking about Rep. Bob Goodlatte's SAFE bill, which is much more pro-business than S.909, the McCain-Kerrey Senate bill that Kyl supports. Now, S.909 doesn't mandate key recovery; it only strongly encourages it by wielding the federal government's purchasing power to jumpstart a key recovery infrastructure. But Kyl would go further. At a recent Heritage Foundation roundtable on encryption, I asked him, "Why not make key recovery technology mandatory -- after all, terrorists, drug kingpins and other criminals won't use it otherwise. Kyl's response? Not that it would be a violation of Constitutional due process and search and seizure protections or a bad idea. Instead, he told me he simply didn't have enough votes... -Declan

3 4

Crypto hearings via C-SPAN
by Greg Broiles 17 Dec '03

17 Dec '03

The Senate Judiciary Subcommittee on Technology, Terrorism, and Government Information held hearings this afternoon on encryption; audio is available now at <http://www.c-span.org/>, I don't follow C-Span so I don't know how long they'll make the recording available. I haven't finished listening to the recording, but it so far has featured Senator Leahy and Louis Freeh reminscing pleasantly about their early-morning walks near Sen. Leahy's farm in rural Vermont, and Freeh talking about how the situation prior to the enactment of Digital Telephony looked bleak - but with the helpful intervention of Congress, a "balance" was achieved between privacy and law enforcement which has made everyone happy. Ahem. Key escrow is being compared to airbags in cars; they're discussing forcing crypto software authors to include key escrow in their software, and allowing users to "choose" to use it or not. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto.

1 0

NetManage - Cylink Press Announcement
by Bob Williams 17 Dec '03

17 Dec '03

There are quite a few open issues regarding the reliability, interoperability, and licensing of public key technology. All parties interested in access to code for testing and comment please respond to this email address. Thanks Bob ------------ NETMANAGE, Inc. Press Release FOR IMMEDIATE RELEASE Contact: Donna Loughlin, NetManage, (408) 973-7171 Donna(a)netmanage.com NetManage Licenses Public Key Cryptography from CYLINK The Two Firms to Promote an Open Interface for Internet Security which Corrects Flaws and Eliminates Financial and Interoperability Barriers for Cryptography. Cupertino, California - September 19, 1995- NetManage, the leader in TCP/IP Applications for Windows and Internet productivity software, announced today that is has signed a licensing agreement with CYLINK Corporation for technology which incorporates the fundamental patents covering public key cryptography. NetManage will be providing support for public key authentication and data encryption as a fundamental component of its Chameleon Enterprise strategy. The two firms further announced that they plan to provide support for an open interface for Internet security which will address recent flaws found in cryptographic implementations used by Netscape Communications and other unpublicized security holes in existing Internet security protocols. The standard is further intended to eliminate the financial and interoperability barriers that have been holding back widespread use of public key cryptography on the Internet. In a separate announcement released yesterday, CYLINK announced that it had prevailed in a patent lawsuit with RSA Data Security which found that RSA had infringed U.S. patents held by CYLINK which cover all known implementations of public key technology. About Internet Security ----------------------- Establishing a secure Internet connection requires any computer software program to perform two functions: Authentication of the user, and bulk encryption of data. The Authentication phase allows two computers to verify that each party is who they claim to be, and that they are authorized to enter into a secure communications session. This is done via 'public key' technology, which was developed and patented originally by Stanford University and licensed exclusively by CYLINK Corporation. During the authentication phase the two computers also agree upon the encryption method to be used for bulk data transfer during the time the two computers are communicating data between one another. These ciphers can be implemented in either software or hardware, including PCMCIA cards. Popular encryption ciphers include DES, Triple-DES, SAFER, IDEA, Skipjack, RC-2 and RC-4 and are available from a variety of software and hardware vendors. Limitations of Current Internet Security Standards -------------------------------------------------- Current implementations of security protocols proposed as standards by Netscape Communications and RSA Data Security, Inc. include security flaws and fail to fully accommodate open and interoperable secure communications between computers which use different bulk encryption ciphers. These problems have limited the adoption of Internet security as a widespread interoperable feature of all Internet software and hardware products including end-user applications, servers, firewalls, and secure routers. NetManage and CYLINK, along with other major software and hardware developers, will be announcing next week the release of a publicly available security implementation which allows for plug & play interoperability for users of Internet security, and the endorsement of protocol extensions which improve the reliability of current proposed Internet security standards. This open implementation will not lock software or hardware developers into the use of encryption technology from any one vendor. Related APIs, key exchange technology, and encryption will be made publicly available to other software and hardware developers. Licensing will include source code and no per-copy royalty fees. About NetManage --------------- NetManage Inc., the fastest growing software company in the United States, develops markets and supports an integrated set of Internet-based applications, servers and development tools for Microsoft Windows, Windows 95 and Windows NT. NetManage software allows corporations to facilitate communication, sharing of information and collaboration between workgroups using Internet technology. The company's award winning products include Chameleon, Internet Chameleon and ECCO. NetManage is a public company, whose shares are traded on the NASDAQ under the ticker symbol NETM. Its products are sold world-wide by NetManage's direct sales force and authorized channel partners. About CYLINK ------------ CYLINK Corporation is the worlds largest provider of enterprise-wide network information security products and wireless communications. CYLINK is the exclusive holder of the fundamental patents which broadly claim the invention of public-key cryptography (Diffie-Hellman, Hellman-Merkle, and Helman-Pohling) and which were originally developed at Stanford University. Headquartered in Sunnyvale, California, CYLINK serves Fortune 500 companies, financial institutions and government agencies. Licensees of CYLINK technology include CISCO Systems, and other prominent hardware and software developers. # # #

1 0