December 2003 - cypherpunks-legacy

Re: Netscape's random numbers
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Congrats, nice job! Yes, well done. >The Netscape license explicitly prohibits decompiling (except where such >prohibition is illegal). When this hits the media it will be important >to avoid being tarred with the "hacker breaks rules and breaks in" brush. >More subtly, it's probably a bad idea to call into question the overall >business model of client binaries on the net. > >Instead, emphasize importance of open code, public reviews, ability to >link in your own code that meets public specs, etc. All of these things >the Internet was designed to do, and U.S. ITAR regulations are designed >to prohibit (globally, anyway). And also that the bad guys will never >play by the rules. And re-emphasize that solutions are possible, just >that the U.S. government prevents them from being deployed in a global >economy. Before we go to the news, perhaps we should demonstrate the exploitation of this hole. It would certainly make selling this story a whole lot easier. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMF27PHIf3YegbdiBAQGI7AJXY5d2Su52MWXrh6tP20vOai/Rsbd6+oqx urWUP34wPv5dqMv1Mw6XDlstX5Q3KmOMeTOjAwcjuJXY5Z3RhkL0gi0nMBUS/IdZ b/GN =vhHo -----END PGP SIGNATURE----- Dietrich Kappe | Red Planet http://www.redweb.com Red Planet, LLC| "Chess Space" | "MS Access Products" | PGP Public Key 1-800-RED 0 WEB| /chess | /cobre | /goedel/key.txt Web Publishing | Key fingerprint: 8C2983E66AB723F9 A014A0417D268B84

5 4

Re: Stay issued; modified stay to follow (fwd)
by Cypherpunks Maintenance Account 17 Dec '03

17 Dec '03

----- Forwarded message from Bob Kohn ----- >From cpunks Fri Aug 29 04:41:12 1997 Message-Id: <3.0.2.32.19970829010600.038952dc(a)mail.pgp.com> X-Sender: kohn(a)mail.pgp.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.2 b3 (32) Date: Fri, 29 Aug 1997 01:06:00 -0700 To: Cindy Cohn <Cindy(a)mcglashan.com> From: Bob Kohn <kohn(a)pgp.com> Subject: Re: Stay issued; modified stay to follow Cc: sadams(a)forbes.com, telstar(a)wired.com, plotnikoff(a)aol.com, Ewasserman(a)sjmercury.com, dang(a)cnet.com, steven(a)echo.net, abate(a)ccnet.com, wendyg(a)cix.compulink.co.uk, amy(a)netcom.com, courtm(a)cnet.com, alan.boyle(a)MSNBC.COM, declan(a)well.com, sep(a)cbsnews.com, kenc(a)cwi.emap.com, arb(a)well.com, exp(a)mk.ibek.com, bransten(a)interactive.wsj.com, TomBemis(a)pacbell.net, sam.perry(a)reuters.com, jimevans(a)aol.com, ljflynn(a)aol.com, wendyl(a)ljx.com, bernstein-announce(a)toad.com In-Reply-To: <199708290123.SAA24903(a)gw.quake.net> Reply-To: Bob Kohn <kohn(a)pgp.com> Sender: owner-cypherpunks(a)toad.com Precedence: bulk [text/enriched is unsupported, treating like TEXT/PLAIN] Too bad. Prof. Bernstein was perfectly positioned to become a great -- and the only legal -- exporting reseller of PGP software. (no, this is not off the record) Bob At 06:21 PM 8/28/97 -0700, Cindy Cohn wrote: >During a conference call with counsel today, Judge Patel issued a stay of >the injunctive relief issued in her Opinion of August 25, 1997, effective >until September 8. > > On September 8 (or sooner if we get the papers to her) the Court she will >issue a formal Stay Pending Appeal which will stay the injunctive relief >issued in her Opinion of August 25, 1997, except that an injunction shall be >reinstated to prevent the prosecution of Professor Bernstein for the >"unlicensed export" of Snuffle 5.0 (which includes Snuffle and Unsnuffle) >and any later versions of that program which he has developed. > >This eliminates, at least for the meantime, the injunctive relief granted to >Bernstein as to any other computer programs which he may have developed or >otherwise wished to publish. It also eliminates the protections for persons >other than Professor Bernstein. > >The government has said that it may still challenge this more limited stay >in the 9th Circuit. Professor Bernstein may also seek relief from the stay >from the 9th Circuit. > >Cindy >************************ >Cindy A. Cohn >McGlashan & Sarrail, P. C. >177 Bovet Road, 6th Floor >San Mateo, CA 94402 >(415) 341-2585 (tel) >(415)341-1395 (fax) >Cindy(a)McGlashan.com >http://www.McGlashan.com > > > Robert H. Kohn Vice President, Business Development PRETTY GOOD PRIVACY, INC. 2121 S. El Camino Real, 9th Floor San Mateo, California 94403 Direct: (415) 524-6220 Cellular: (415) 297-6527 Main: (415) 572-0430 Fax: (415) 572-1932 kohn(a)pgp.com PGP Home Page: http://www.pgp.com Personal Home page: http://www.kohnmusic.com/people/bkohn.html <smaller>"If all the personal computers in the world - ~260 million computers - were put to work on a single PGP-encrypted message, it would still take an estimated 12 million times the age of the universe, on average, to break a single message." -- William Crowell, Deputy Director of the National Security Agency, testifying before the U.S. Congress on March 20, 1997</smaller> ----- End of forwarded message from Bob Kohn -----

1 0

Public Key Partners Dissolved!!!!!
by Standing Turtle 17 Dec '03

17 Dec '03

CYLINK CLAIMS SHARE OF RSA TECHNOLOGY An arbitration ruling has awarded Cylink Corp. control over two Stanford University patents on public-key encryption technology used by RSA Data Security Inc. following the dissolution of the companies' five-year partnership. Cylink says it plans to seek royalties from companies that have licensed the software code from RSA and are redistributing it. The arbitrators ruled that RSA's right to sublicense the software expired in 1990. (Wall Street Journal 19 Sep 95 B7)

1 0

Re: FBI calls for mandatory key escrow; Denning on export ctrls
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

September 4, 1997 Encryption Tops Wide-Ranging Net Agenda in Congress By JERI CLAUSING The word encryption traditionally conjures images of spies and sophisticated international organizedcrime rings. But with the dawn of the Internet, it is also the key to private communication and secure business transactions. And while Clinton on July 1 took a very public stand for a tax-free, self-governed Internet, his administration is pushing to create a key-recovery system that would keep encrypted codes on file for law enforcement officials to access. Translation~~These ratfuckers are trying to keep a low profile until they can get all of their draconian legislation passed, at which time the sheeple will find out why the "rubber boots" rider was attached to the legislation. How long before the Great InterNet Tax Avoidance Crisis (TM) requires them to access the records of all companies and individuals in order to make certain that the royal "we" are not "cheated" by our evil fellow citizens. "Law enforcement needs to have a system for immediate decryption" when a judge determines it is likely that crime is being or is about to be committed, Freeh told the Subcommittee on Technology, Terrorism and Government Information. "We should also look at whether network service providers should have a system for immediate decryption." Translation~~"Just as we need to be able to beat the citizens and shove toilet plungers up their ass if we have reason to suspect that they have knowledge of a crime in their mind." Freeh wants to make certain that the citizens don't have the same ability as the Whithouse, the Department of Justice, Congress, etc., to LIE to the courts, to the people, to each other. So if _we_ steal a private company, murder members of a religious sect, get filthy fucking rich on inside deals, then _we_ will go to jail. TruthMonger "What part of 'Nuke the Bastards!' don't they understand?"

1 0

Netscape on randseed issue
by Stephan Somogyi 17 Dec '03

17 Dec '03

Netscape has put up an official response to the randseed issue: <http://home.netscape.com/newsref/std/random_seed_security.html> Most interesting to me was the para: "Netscape has also begun to engage an external group of world-class security experts who will review our solution to this problem before it is sent to customers. These experts will validate Netscape's solution and insure that it is complete and effective in solving this vulnerability. The group will be used on an ongoing basis to work with Netscape's internal security experts to review the design and implementation of security in Netscape's products and to provide an additional measure of assurance that these products implement the highest levels of security possible." Anyone know anything about this group, or is this a reference to the RSADSI source review that Andrew Loewenstern mentioned earlier today? ________________________________________________________________________ Stephan Somogyi Think Tank Grenadier Digital Media

1 0

Change of address {No crypto content}
by Michael Froomkin 17 Dec '03

17 Dec '03

Just to announce that I have a new address. No more VAX/VMS, hello Unix. Donations of nice procmail files, and unix hints for the re-clueless (I last had an account on a Unix machine in 1980), most welcome. If you send me mail in the next few days and I don't reply, it's either because I fiddled wrong, or because I couldn't find a terminal in Pittsburg. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | PLEASE NOTE NEW E-MAIL: U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | Coral Gables, FL 33124 USA | It's hot here. A HOME AT LAST: http://viper.law.miami.edu/~froomkin

1 0

Re: FBI calls for mandatory key escrow; Denning on export ctrls (fwd)
by Lucky Green 17 Dec '03

17 Dec '03

Sometimes these guys can still surprise even me. That statement below is about as blatant as it gets: [Freeh] There are a number of ways that that could be implemented, but what we believe we need as a minimum is a feature implemented and designed by the manufacturers of the products and services here that will allow law enforcement to have an immediate lawful decryption of the communications in transit or the stored data. That could be done in a mandatory manner. It could be done in an involuntary manner. But the key is that we have the ability. -------------------------------------------------------------- Let me get this straight: they need *as a minimum* instant access to all cleartext. So what is the "more than minimum" they truly desire? And the two alternatives Freeh proposes to obtain this *minimum* are either "mandatory" or "involuntary". What a choice! --Lucky

2 1

Stand up and be heard!
by dr261＠cleveland.Freenet.Edu 17 Dec '03

17 Dec '03

Yes, I'm still working on a magazine, I still need authors! Write about cryptography and coverups and clipper and whatever else you find interesting, and write about it! Become rich and famous! (ahtoughalthough the rich and famous part won't be a result of writing for TCW...) I also need reporters to write blurbs about things that happen. If interested, mail me privately at dr261(a)cleveland.freenet.edu.. not on the list. -- Tobin Fricke (aka LightRay) The Digital Forest BBS (714)586-6142 dr261(a)kanga.ins.cwru.edu KE6WHF Amateur Radio, 1:103/925 fido

1 0

Re: Anonymous WWW proxies
by James Caldwell 17 Dec '03

17 Dec '03

On 17 Sep 95 at 11:24, Aleph One wrote: > Points taken. But I belive the are (or will be patches) for CERN to > d SSL. Check the SSLeay ssl-user mailing list. > While we talking abut anonymous proxies. I always wanted to set up > an IP anonymous proxie using Linux IP tunnel and maybe also IP > Masquareding. This would allow people to have anonymous Web Servers, > etc. (But as anything it would probably be abused for hacking, etc > at no end). Any commments? You can add a bit of protection for yourself to this, just some way of preventing the unwanted from using the service and terminating abusers.

1 0

STRATEGIES FOR MARKETING ONLINE
by dbmkts＠kryan.com 17 Dec '03

17 Dec '03

Greetings, I'm responding to your posting online and was wondering if you would like a free copy of my informative article " PROPER E-MAIL STRATEGIES FOR MARKETING ONLINE". Just e-mail me back and ask for a free copy. Thank you, Donald Bass

1 0