December 2003 - cypherpunks-legacy

Re: NSA and Netscape Crack
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:46 PM 9/19/95, Jim Ray wrote: >In the relatively short time I've been on this list, Cypherpunks >have bruted, and then found a weakness in, two kinds of Netscape >software. >[A fine public service, IMO. Congrats to all involved.] > >I don't expect to know NSA's specific brute-force capability, but >does anyone know if the NSA has *ever* found a glaring weakness in >software and then told its author(s) or owner(s) about it? Do "we" >perform the "COMSEC" role Tim was speaking of better than the NSA? Indeed, Jim is underscoring the point I was making, facetiously, that the NSA has abandoned all pretense of helping to actually secure commercial transactions (and no, I wasn't referring to Clipper...rather, I was facetiously referring to the short-lived Commercial COMSEC Endorsement Program, circa 1988-89). As I said in my message, I don't _want_ the NSA or NIST (the same, really) to be vetting commercial encryption. But I also don't want them claiming a role in securing commercial encryption when they clearly are not even doing as much as the Cypherpunks are doing. By the way, if we count our own Matt Blaze's work on exposing weaknesses of the Tessera/Skipjack/Clipper (they blur together) card as a "Cypherpunks achievement," then the Cypherpunks have actually played a dominant role in cracking these recent standards. (Not to mention the RC4 code postings, the various Cypherpunks involved in the RSA-129 and "BlackNet" factorizations, etc.) Well done, of course! --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Please send me SSL prob
by Joe Tardo 17 Dec '03

17 Dec '03

Reply to: RE>>Please send me SSL problems... Jeff: The name chosen for SSL was, perhaps, unfortunate and misleading, but should not get in the way of the kind of service it provides. I keep combing the spec looking for socket-like api's, and so far have not found any :-). > I've looked at >what it takes to make some existing protocols work with SSL, and I'm not >convinced that its always appropriate. For example FTP and RCMD use >multiple connections, which is a royal pain. Doesn't HTTP use a new connection for every GET? > If a secure IP standard emerges that is widely deployed and provides >similar services, I don't see why SSL couldn't just go away (this is my >opinion, not an official position of netscape). The ipsec people are currently debating what it means to do replay detection on an unreliable datagram service, what it means to authenticate individual users in a layer that only knows how to name host endpoints, how a protocol specification deals with how policy would be set for mixed encryption service requirements, etc. This is not the first time these points have been debated in the history of the universe, nor the first attempt at a 'one size fits all' security protocol. I, personally, would not be too quick to expect IP security to solve all of your problems, but it will do a better job on, say, host-to-host disclosure protection. It will, however, require new kernel code or low-level driver or hardware hacks, which simultaneously provide the better protection and a barrier to security deployment for a product like Netscape's. Now, how about fixing SSL's keying so it has perfect forward secrecy? -Joe

1 0

Re: Patents and trade secrets was: Encryption algorithms used in PrivaSoft
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

> But don't they have to put something on the patent application? Can they > claim trade secret status for something that was on a patent application, > but rejected? That seems like they're getting it both ways. At this point, in this country, a patent is secret until it is issued. It is interesting to note that the process of issuing a patent can take an indefinite period, and to some extent it is in the control of the person seeking the patent. The typical slimy thing to do is to file for a patent, and keep it a trade secret too. Delay the issuance until somebody discovers your secret, then allow the patent to be issued. This is called a "submarine" patent. It allows the best of both worlds, and extends the patent as far in to the future as possible (17 years from issue date, in this country, regardless of filing date). You can delay the patent's issuance by continuing to file amendments to it. Gilbert Hyatt's recent patent on microprocessors is the classic example. Now, this is all expected to change, to become more harmonious with the rest of the world. The changes that I've heard are 1) Go to first-to-file instead of first-to-invent 2) Life is 20 years from filing date, instead of 17 years from issue date 3) Publicize patents some fixed time from filing date, say 1 year As you can imagine there are armies of lawyers on both sides of the issue, so I don't think that you'll see any changes in the law any time soon, but you never know. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-8624

2 1

Re: GAK patents, anyone?
by Sean Roach 17 Dec '03

17 Dec '03

At 01:34 AM 9/9/97 +0200, Anonymous wrote: ... >----- >http://www.uspto.gov/web/offices/com/sol/notices/terrog.txt >----- > >Petitioning to Make Special Patent Applications Relating to >Inventions For Countering Terrorism > >New patent applications are normally taken up for >examination in the order of their effective United States >filing date. However, the Commissioner may provide that a >patent application will be advanced out of turn for >examination if a petition to make the patent application >special under 37 CFR 1.102(c) or (d) is granted. > >On July 31, 1996, Vice President Gore stated that "[i]t is >imperative that those seeking to prevent terrorist >activities have all of the tools necessary to accomplish >their task." In view of the importance of developing >technologies for countering terrorism and the desirability >of prompt disclosure of advances made in these fields, the >Patent and Trademark Office is establishing a new category >for petitions to accord "special" status to patent >applications relating to counter-terrorism inventions. >International terrorism as defined in 18 U.S.C. 2331 is >"activities that >(A) involve violent acts or acts dangerous to human life >that are a violation of the criminal laws of the United >States or of any State, or that would be a criminal >violation if committed within the jurisdiction of the United >States or of any State; (B) appear to be intended (i) to >intimidate or coerce a civilian population; (ii) to >influence the policy of a government by intimidation or >coercion; or (iii) to affect the conduct of a government by >assassination or kidnaping." ... Back up just a minute. Aren't inventions protected if the patent is pending? If not, why do such well known companies who undoubtly have savvy legal council produce products stamped "patent pending"? Is this just a way of forcing those who take this special treatment to bow to additional government restrictions? An action which they would have to do as if they didn't, a competitor might get the inventors idea patented before the inventor? Sounds more like a manner to place certain inventions that are crucial to "national security" under tighter regulations. How long before they expand the definition? Because, if they impose additional contractual conditions upon the advanced patent, this could mean that crypto could be regulated constitutionally in the future by regulating who the inventor could share it with.

1 0

Government filed 9th Circuit Bernstein brief asking for full stay
by John Gilmore 17 Dec '03

17 Dec '03

Today the Government filed a 22-page brief arguing to the 9th Circuit Court that it would be so injurious to the national security for Prof. Bernstein to be able to publish his Snuffle 5.0 software on the Internet, that a complete stay of Judge Patel's injunction is needed. They also propose that the entire appeal be done on an expedited basis. The brief is accompanied by two seven-page personal declarations, one from William P. Crowell, Deputy Director of NSA, and one from William A. Reinsch, Under Secretary for Export Administration. These will be up as page images on the Web shortly, under http://www.eff.org/pub/Privacy/ITAR_export/Bernstein_case/Legal/ John Gilmore

1 0

Re: Removing Tyranny from Democracy (Part II), was Democracy is the true enemy...
by Brian B. Riley 17 Dec '03

17 Dec '03

>Democracy is as tyrannical as any other system if rights aren't respected. >In those cases where limited government might have to make a decision >concerning all, and there is time to debate the issue, democracy (either >representative or direct) is the most just method. I see what we have at the moment is a tyranny over the majority by the tiny minority of the population that happen to hold the reigns of power ... look at what Freeh et al. is trying to do ... shoving it right down our throats ... as we all used to say after Nam ... BOHICA! Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys - Send Email Subject "Get PGP Key" "...if you drink much from a bottle marked 'poison,' it is almost certain to disagree with you, sooner or later" -- Lewis Carroll

1 0

Re: Gao's Chaos Cryptosystem Algorithm
by Sean Roach 17 Dec '03

17 Dec '03

At 10:28 PM 9/8/97 PDT, Nobuki Nakatuji wrote: > >> >>I will just repeat Prof. Choate's question, how do you generate Ch. >> >> >Ch generate > >begin >Xn+1=aXn(1.0-Xn) >return Xn+1 >end > >Do you understand Japanese ? >If you understand Japanese, >I will send theis of Gao's Chaos Cryptosystem to you. > I don't understand Japanese, barely got through discrete structures, and hate calculus. But I'd like to see the source for the aXn() function.

1 0

Re: Government shows its hand...good news!
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May wrote: > > At 8:12 PM -0700 9/9/97, Declan McCullagh wrote: > >Let me clarify my earlier comments. The language sez Defense & Commerce > >together can veto crypto exports, and: > > > >"Decisions made by the Secretary of Commerce with the concurrence of the > >Secretary of Defense with respect to exports of encryption products under > >this section shall not be subject to judicial review." > > Then this is _not_ the sense in which you seemed to be implying that the > Supreme Court would be precluded from declaring the law unconstitutional. Read it and think about it... This kind of bureaucratic dildo is a subtle way of affording the Lying Nazi Fucks (TM) in power a way to _interpret_ the law unconstitutionally without having it subject to "judicial review." Ipso facto, you are mucho fuckedo by an unconstitutional interpretation of a constitutional law. Add to the above, the fact that unelected semi-secret committees of administration appointees will be exchanging bum-buddy favors with the people doing the interpreting, and you will find a set of 'established' procedures--from the White House down to the lowly clerk that stamps "Denied" on your application to speak your native tongue during overseas phone calls--which will _support_ the fascist's case if you ever _do_ manage to get them into court. (Much like the post of our Cpunk avon lady who sent the CFA post down showing how the Alberta lawyer got suckered into comparing his stance against gun registration to an 'established' unconstitutional law against handgun registration.) The deciding factor in a case such as this, from my experience, is when the government whines about the terrible burden they would be placed under if they were forced to go out and by an "Accepted" rubber-stamp, at which point the judge decides that this would take away from the available funds for nuclear warheads, and then National Security would be compromised. Ruling: Citizens, assume the position. PositionMonger

1 0

Re: House National Security committee guts SAFE, worse than no b
by Declan McCullagh 17 Dec '03

17 Dec '03

Michael, you once again fail to note the important political issues here. Sometimes civil liberties, freedom, and constitutional rights must be ignored in favor of pragmatism. It is important at all costs to remain a player in the game. Instead of opposing bad crypto legislation, we should instead work inside the process, to gain a seat at the table. That is why it is highly significant that both Commerce and FBI want to rid us of our freedom but would do it in subtly different ways. -Declan On Tue, 9 Sep 1997, Michael Sims wrote: > Jonah Seiger wrote: > > > None the less, this is much bigger than a quibble over details, > > IMHO. There are important policy implications of this language. And > > politically, it is extremely significant that Reinsch would be > > critical at all, considering that the Committee voted to > > substantially undercut the bill (one of Reinsch's top priorities). > > Perhaps you missed this nuance. > > Well, I know that *I* feel much better now that I know about this > nuance. Knowing that the rulers of this country have significant > differences about who should control the universal key management > and encryption infrastructure once it's in place (who gets the Power) > really eases my concerns. Thank you. > > > -- Michael Sims >

1 0

Re: FBI calls for mandatory key escrow; Denning on export ctrls (fwd)
by Brian B. Riley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We have batted this around and around ... I am curious though what the more legal-oriented among us feel the current wording portends for us ... say it gets passed ... just what will be the legal status of the use of non-GAKked crypto? There is little question that steganography will be raised to a high art form under these proposals. That not withstanding, I would just like to get a feel for exactly where it leaves the current PGP et al. community? -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNBYbJsdZgC62U/gIEQKB+ACgplZ/gmiKJEQgM5syzV2u1ls1LpsAn3Th 7veoktJjakAcKVzXTi8m0L+9 =ws+o -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys - Send Email Subject "Get PGP Key" "Civilization is the progress toward a society of privacy. The savage's whole existence is public, ruled by the laws of his tribe. Civilization is the process of setting man free from men." -- Ayn Rand - The Fountainhead (1943)

1 0