December 2003 - cypherpunks-legacy

Re: not a flame please read and think about this
by Rich Salz 17 Dec '03

17 Dec '03

>I was kind of wandering if it would be necessary to patent something >just to ensure someone else did patent *your* idea, if you came up >with one. Nope. >Or can you publish, and then say that's prior art, so no one else can >go patent your idea. This works. IBM used to have publish a monthly journal (I forget the name, it came out of one of their Yorktown labs) that did exactly this kind of thing for exactly this kind of reason. ACtually, they wrote about stuff that they thought was 5-10 years away. >> even phil zimmerman is selling the rights to pgp. what about all the >> people who contributed code (like me) ... . ask phil >> about me and when i asked about sharing profits from the code i >> conrtibuted. also about the deal with r.f... Mr/Ms. Anonymous is lying. His/her name appears nowhere in the credits, and his/her code appears nowhere in any PGP release. Don't waste any neurons on it. /r$

1 0

Re: You really do want to volunteer, don't you?
by Tim May 17 Dec '03

17 Dec '03

At 12:12 AM -0700 9/2/97, Greg Broiles wrote: >At 11:38 PM 9/1/97 -0700, Tim May wrote: >>This was an actual case, heard by the Supreme Court several years back. Bus >>passengers were given the opportunity to volunteer, as noted. Failure to >>volunteer was construed as probable cause that contraband was present. >> >>(No, I don't know the name of the case. My recollection is that it took >>place in Florida or one of the Carolinas. Nor do I recollect how the >>Supremes decided the case... > >This sounds like _Florida v. Bostick_, 501 U.S. 429 (1991), on the web at ><http://www.findlaw.com/scripts/getcase.pl?court=US&navby=case&vol=501&invol >=429>. > >Bill Stewart's summary of the case looked like a good one to me. Thanks, I guess, to all of you who sent further information on this case. I'm chagrinned at this repetitive pattern, though: all it takes is a "I don't remember" for a thread to be completely dominated by helpful comments, clarifications, etc. (Ditto for any question even remotely impinging on financial or tax advice, which is why I almost always include requests that helpful tax advice not be sent to me. I can't seem to mention tax issues without a bunch of helpful souls sending me their ideas on how to beat taxes by incorporating myself in Andorra and then hiring myself as a consultant to the Andorran embassy in California, or whatever.) One strategy I've considered is to never, never, ever admit that I don't know something, as this will forestall the corrections, expansions, clarifications, and citings. Or to express things more elliptically. It pays to be Young. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Senate Bill 974?
by David Neal 17 Dec '03

17 Dec '03

Haven't seen it discussed here, but the August 28, 1995 issue of Lan Times covers Sen. Charles Grassley's (R-IOWA) Senate Bill 974. Frankly, you should probably read the text of the bill itself, because the article doesn't seem to get the facts straight. The article asserts first that the bill may outlaw any non-GAK encryption, but then quotes the senator as saying ``All my bill does is say you can't use computers to steal, to threaten others or conceal criminal conduct.'' Perhaps concealing criminal conduct is considered using non-GAK. The quote from the bill itself reads like the ITAR; it is illegal to ``distribute computer software that encodes or ecrypts electronic or digital communications to computer networks that the person knows, or reasonably should know, is accessible to foreign nationals and foreign governments, regardless of whether such software has been designated as nonexportable." The article also says that up to 64 bit keys may now be allowed in exportable software, but that ``some experts'' suggest that those keys may have to be GAK. I've never heard anything BUT the keys would have to GAK. David Neal <dneal(a)usis.com> - GNU Planet Aerospace 1-800-PLN-8-GNU Unix, Sybase and Networking consultant. "...you have a personal responsibility to be pro-active in the defense of your own civil liberties." - S. McCandlish

2 1

RE: 64 bit crypto
by John A. Limpert 17 Dec '03

17 Dec '03

Couldn't we modify RC4 easily to provide the same security against brute-force attacks by just running the key-setup phase 65536 times instead of just once? Why would the attacker need to run the key setup 65536 times?

1 0

IP6_pi2
by John Young 17 Dec '03

17 Dec '03

IEEE Spectrum, September, 1995: Excerpt on Net security from "Upgrading the Internet," a roundtable discussion of the Internet Society on the next generation of Internet protocols, IP Version 6. Discussants: Vinton Cerf, Stephen Deering, Christian Huitema, Haruhisa Ishida, Larry Landweber, Eric Schmidt, Lixia Zhang. A most important aspect of the IPv6 is the somewhat controversial decision to require that all v6 implementations support strong privacy and strong authentication. At this level, all of the security problems won't be solved, but we can authenticate and maintain privacy of packets that flow from one machine to another. This will eliminate many security threats in the current Internet, such as source-address-spoofing, source-related routing attacks, password sniffing, connection hijacking, and so on. New Scientist, Sept 9, 1995: "Watching you, watching us." Companies that sell electronic surveillance equipment to repressive regimes face the prospect of being "outed" on the Internet this autumn. Two electronic watchdogs, the British group Privacy International (PI) and its American sister organisation the Electronic Privacy Information Centre (EPIC), are setting up an offshore Internet site that will name companies that sell electronic instruments of repression to governments with poor records on human rights. IPI-pair: IP6_pi2 (13kb)

2 1

NSA/NIST Security Lab
by John Young 17 Dec '03

17 Dec '03

NSA and NIST will set up a new lab for evaluation of information-security products, including crypto algorithms: http://jya.com/nsa-nist.txt The lab will coordinate with other nations. Plans include eventual shifting the evaluation to private testing labs once accreditation standards are set. With critiques by Bruce Schneier and Steve Walker, and a slap from NCSA, which now provides testing, "They've been talking about this stuff for years."

5 4

Re: Wearing RSA shirt to school
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim wrote: <snips throughout> >At 4:43 AM 9/4/95, Futplex wrote: >>I wrote: >>> With respect to possession within the U.S., there aren't any >>> laws stopping you from waving strong cryptography around wherever you like >>> (at least, not yet). >> >>---- >>...and in private email, Jim Ray pointed out that showing the shirt to a >>foreign national might technically violate ITAR... > >Nope, no more so than letting a foreign national read Schneier's book is a >violation of the ITAR. If you dispute this, ask whether Schneier's book is >banned from export (the book, not the optional diskette). It isn't. Nor are >other cryptography _books_ banned from export. The law doesn't have to be consistent, or to make sense, or be enforced evenhandedly. The law is, after all, not written, or interpreted, or enforced, by partisan Libertarians like me. My private email to Futplex said *may* violate... and I stand by it. [IANAL, though.] Whether or not a law as incontrovertably stupid as ITAR is enforced may depend on the timing of the next election, as we seem to be witnessing in the limbo-state of PRZ. >I'm not minimizing the issue of export of machine-readable code, as in >diskettes. But to claim that a blurry, printed on cotton "barcode" is even >remotely in the same class as exporting a workable set of cryptographic >system routines, or that letting a furriner merely "gaze upon" this blurry >barcode, is a violation of the ITARs is laughable. Yes, but *many* laws are laughable. >>Yeah, I suppose I overstated it a bit. It appears that if the ITAR do cover >>the shirt (unclear at present, AFAIK -- any news on the CJR, Raph ?), then >>flashing it at a furriner could constitute a violation. Thanks for the >>correction. Actually, it was less a correction than me pointing out (yet another) note of uncertainty. James Madison, in Federalist #62 said it best: "What indeed are all the repealing, explaining, and amending laws, which fill and disgrace our voluminous codes, but so many monuments of deficient wisdom." Now, many of us would be more than satisfied to get back to that level of government. I suggest that everyone go have a look at the entire Code of Federal Regulations, before the next election. <g> >the original questioner need not fret about his son wearing the >>shirt to school. I agree that wearing it through Customs on the way to Jamaica would be more problematic, but I live next to a US Customs agent, and he learned about ITAR from me. Here in Miami, Customs has plenty to think about with the various (occasionally venomous) inbound cargo. >It was this series of posts about whether wearing the "munitions t-shirt" >near schools was a crime or not that made me think the silly season had >arrived. It has, a long time ago. Ever watch C-SPAN? JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMEro1W1lp8bpvW01AQHKsgP/bhOcCUoksLvbGe/nAKxDqZU8KvibvRFm nQ++Xy3FjDDJrFg1/lgmivtrriuFK/xg4CvKdu+yQ6zJ72pH+92cLivsfHeg+ljZ MPSXfHftaOP7i1e4KajnlC3jBcYbWQnqZRdduIyPXZnfn5xK5bU99c5oceCABtSx UD/Hp9Poqbc= =7tMD -----END PGP SIGNATURE----- Regards, Jim Ray See, when the GOVERNMENT spends money, it creates jobs; whereas when the money is left in the hands of TAXPAYERS, God only knows what they do with it. Bake it into pies, probably. Anything to avoid creating jobs. -- Dave Barry ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James M. Ray <liberty(a)gate.net> ------------------------------------------------------------------------ Support Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf ________________________________________________________________________

3 2

Senate Bill 974
by David Neal 17 Dec '03

17 Dec '03

Senate Bill 974 The full text is difficult to interpret since it mostly just amends other law. Essentialy the law makes illegal: using a computer for racketeering purposes, threatening to destroy data, transferring of unlicensed software, using any method to hide illegal funds transfer, and exporting crypto software. (Relavent bits are included below). The law also expands wiretapping authority, and seems to allow electronic evidence found during a search to be introduced as evidence. You'll have to insert the text of the bill into the real laws to get full context. `(2) to distribute computer software that encodes or encrypts electronic or digital communications to computer networks that the person distributing the software knows or reasonably should know, is accessible to foreign nationals and foreign governments, regardless of whether such software has been designated as nonexportable; `(3) to use a computer or computer network to transmit a communication intended to conceal or hide the origin of money or other assets, tangible or intangible, that were derived from racketeering activity; and `(4) to operate a computer or computer network primarily to facilitate racketeering activity or primarily to engage in conduct prohibited by Federal or State law. `(b) For purposes of this section, each act of distributing software is considered a separate predicate act. Each instance in which nonexportable software is accessed by a foreign government, an agent of a foreign government, a foreign national, or an agent of a foreign national, shall be considered as a separate predicate `(c) It shall be an affirmative defense to prosecution under this section that the software at issue used a universal decoding device or program that was provided to the Department of Justice prior to the distribution.'. David Neal <dneal(a)usis.com> - GNU Planet Aerospace 1-800-PLN-8-GNU Unix, Sybase and Networking consultant. "...you have a personal responsibility to be pro-active in the defense of your own civil liberties." - S. McCandlish

1 0

Re: Information
by Ross Wright 17 Dec '03

17 Dec '03

On or About 2 Sep 97 at 14:27, Sandromar Ferreira wrote: > > >>>> > > > Information, please! > > >>>> > > Dont go swimming on a full stomach. > > >>>> > Don't "escrow" your keys. > > >>>> Don't take advice from strangers. > > >>>Don't ask, don't tell. > > >>Don't eat yellow snow. > > >Don't spit, just swallow. > > Don't touch anything. Don't play with that, you'll shoot your eye out. =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795

1 0

NIS&T Key Escrow Export kangaroo conference
by Bill Trost 17 Dec '03

17 Dec '03

Pat Farrell's summary of the NIS&T conference (thanks for the report, by the way!) discussed a bunch of "criteria" that an "acceptable" GAK system should provide, including a couple that are supposed to limit the ability of law enforcement to use keys beyond the bounds of the search warrant. Another criterium that needs to be brought up (although I'm not sure of how one would phrase in a way that is either clean or polite) comes out of a debate between Philip Zimmermann and Dorothy Denning I ran across at one point: "How can a GAK system be arranged so that some future Congress cannot destroy the protections of the split-"escrow" system by issuing a resolution like 'All key components of suspected Comm^H^H^H^H terrorists shall be provided to the House Committee on Unamerican Activities'?" The links to McCarthyism are important here. GAK proponents can't claim this kind of thing won't happen -- it *has* happened, and could easily happen again. Anyone who claims otherwise is either terribly naive or is being outright misleading. In some sense, this criterium goes to the very heart of the whole GAK question -- even if you believe in the allegedly legitimate power of law enforcement to look through people's love letters, the "safety mechanisms" for the keys are nothing more than a set of flimsy policies that Congress could toss aside the next time something scary comes along. The protections that the GAK proponents are proposing (and proponing (-: ) are frightfully ephemeral. By the way, I'm a few days behind, so sorry if this is "old mail".

1 0