December 2003 - cypherpunks-legacy

Roger Schlafly's court hearing today
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

Roger Schlafly had a brief hearing this morning in Judge Williams federal court on summary judgements with respect to the validity of the various public key patents, and alleged anti-trust and unfair trade practices. Bob Wells and I were the only pro-tossing-the-patents out people there, although sometimes-cypherpunk-meeting-attender Whit Diffie was there as well. The judge said right at the outset that he would not be making a decision today, that he wanted guidance from Roger and the other sides lawyers about the relevant issues, to help him wade through the tremendous amounts of documentation provided. I suppose that this could be expected, but the issues here seemed to me, at least, to be relatively clear-cut. There were basically four issues to be discussed, the Diffie-Hellman, Hellman-Merkle, and RSA patents, and these unfair trade practices. The judge had only allocated an hour for this discussion, and then showed up 20 minutes late, which proved inadequate. Still, I thought that everyone was remarkably clear and concise with their answers, and the judge asked reasonable questions. First discussed were the unfair trade practices, where the lawyer for what used to be PKP dragged in a lot of dirty laundry from the past, describing why Roger got interested in this in the first place. I don't understand what the complaint here was, the PKP lawyer said that since Roger didn't have a product, what was he complaining about, anyway? It seemed like an odd defense to me, but again, I don't know exactly what Roger's complaint was. Roger agreed with the judge that yes, everything he wanted to say was in his submission. Next discussed was the Diffie-Hellman patent. Roger stated that he had four clear instances where the an "enabling disclosure" was made about Diffie-Hellman; three were presentations to large audiences, and one was a pre-print of the famous "New Directions in Cryptography" paper. Roger actually had the viewgraphs that Diffie used in his presentations. These disclosures were all made more than 1 year before the patent was filed, which is the limit in the US. The lawyer from CalCan (something like that) handled this one. He said that the law specifically mentioned publication, and that none of these was a publication. I'm not sure what the law says, and Roger disputed the claim that that is what the law says. Disappointingly to me, it appears that neither Diffie or Hellman have any recollection of when, to whom, or how many preprints of the article were sent out. It's terrible how the law seems to cloud people's minds, isn't it? What little I do know about patent law tends to support Roger on this one, I think that it should be an open and shut case, but we'll see. Then we came to the Hellman-Merkle patent, which basically claims all of public-key cryptography. Roger's claim here was that the mechanism described doesn't work, because knapsacks don't work, that is, the invention is supposed to make generation of the decryption key infeasable, by a very specific description of infeasability in the claims of the patent. (10^30 arithmetic operation necessary) Well, that's not true. The same lawyer for the other side took this on two different ways: 1) that nobody knew that knapsacks were insecure at the time that the patent was filed, how could the patent be found invalid based on something that happened later 2) and some variations (dense, iterated knapsacks) might still be secure. Roger presented an analogy. Say someone was able to persuade the patent office that a drug cured cancer, and so he was able to obtain a patent on it. Later, it was found that the drug killed everybody who took it. Should the patent be valid, if it really didn't do what it said that it would? Roger could have gotten melodramatic, and said that bad cryptography could really kill people, and has many times, but he didn't; as I said, everybody was remarkably concise and to the point. Even so, we were out of time here, not having discussed the RSA patent or the Schnorr patent at all. The judge said that he will call another hearing if he feels that it is required. I thought, in my incredible naivete, that it went really well for Roger, although I didn't have time to hang around and ask him how he thought it went. I think that his arguements are good, and if the law is sensible he will prevail. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-2244

1 0

Re: Solution for US/Foreign Software?
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

> >> I'm not saying they are a "bypass" of the laws. Rather, I'm saying that >> if the goal is to: >> >> 1. Let companies like Netscape make foreign sales. >> >> 2. Still comply with the letter of the law. > >It takes more than one or two people to coordinate an international effort. >Once more than a few people know about it, it becomes "company policy" or >"corporate objective", in which case, the NSA/DoS will eventually figure it >out and start levying heavy fines and jailing the individuals. You miss the point! There will be no "international effort"! Here are the steps: 1. Write a program limited to keysize, carefully constructed to isolate those portions of the program which define key size, GAKedness, etc. 2. Get it export approved. Export it. THEN 3. Announce that a "US-only" version of the same program is being released, and include the minimal component which replaces the limited software. Release it, only in the US of course! >The main point is that there is no such thing as the "letter of the law". >What they enforce is much broader than that, and how they enforce it is much >more subtle than clear-cut criminal prosecution. Therefore, you cannot just >use literal loop holes just because it's not clear, because the law they are >enforcing is not clear either. The system I describe doesn't even violate the spirit of the rules. If anything, it bends over backward to implement a foreign version of the software which ALREADY is export-approved at the time it was, um, upgraded. True, it's possible to sneak the extra component out of the country, but hey, it's also possible to sneak an entirely new program out of the country. I'm not suggesting that the company who writes the component takes it out, it'll happen regardless. If the order of the versions was reversed, the USG might complain that the export version was "too similar" to the domestic version. That's why you wait for the export approval before you write the domestic version.

4 3

SKIP
by rogaski＠phobos.lib.iup.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Can anyone remember the URL for SKIP for Solaris, that little piece of paper has become a victim of the clutter ... - ----- Mark Rogaski 100,000 lemmings rogaski(a)phobos.lib.iup.edu aka Doc, wendigo can't be wrong! http://www.lib.iup.edu/~rogaski/ VMS is as secure as a poodle encased in a block of lucite ... about as useful, too. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMYNYx0c4/pqJauBAQHPFwQAoG6wtJJsq9QJB2MU02G08Vo436jK0sZs XscSvlpKUtYbyJORj4ETVdfDAAoyQdjZFQQTeH4vt413DPbmqgwKs+QnBrI49evv UjhmcGvxFMj8DpkxiL+5ANu6nrzLWM9smUDWlpKTa3HN59Kq5shlHIlp+yo6AH08 AIInsCZh+YU= =jUrp -----END PGP SIGNATURE-----

1 0

Cyberia-L Archive [was Re: ERA_sur]
by Rich Graves 17 Dec '03

17 Dec '03

As somebody pointed out to me, Cyberia-L, like cypherpunks, is archived on http://www.hks.net/ and the public news server nntp.hks.net. Now send them some of the money you're going to make from the stock market. -rich

1 0

Re: News on Congressional Debate on Exon
by tcmay＠got.net 17 Dec '03

17 Dec '03

This is a VERY positive idea! At 3:54 PM 12/6/95, Peter Trei wrote: >Actually, I've been thinking about this quite a bit recently. I'm building >an SSL enabled server, and clent-side authentication may provide >some help. I could see a user getting his or her public key certificate >signed with different CA keys which assert any number of conditions, >such as: > >Key holder was born before (some particular date). >Key holder has access to sales data for XYZ corp. >Key holder is an adult who takes the first amendment seriously. > >... and the server would recognize different CA signatures as permitting >different levels of access. This is something that could get two things done: 1. Protect ISPs and Web sites from claims they aren't taking any steps to block children. (I won't get into the "children should be allowed to appreciate the beauty of the human body" issue, just noting that an ISP or Web site could deny access to account holders under 18, or over 30, or whatever he wants to do.) 2. Get wider currency for the concept of digitally signed credentials, especially if these are _blinded credentials_, where the credential is for an age, say, and not an identity. (Standard Chaumian stuff, though likely to be nontrivial to implement.) >If your browser permitted you to select the key certificate used in >setting up the encrypted link (and different certs or sets of certs >could be protected with different passphrases), then Mom or Dad >could use their I-am-an-adult credential to read www.xxx.com, >while Junior could not. There *is* a loss of anonymity in this scheme, >however. There may be ways around the loss of anonymity. Ideally, with blinded credentials, But in the short term, through Web proxies and/or servers. For example, Sameer's c2.org could issue accounts to people who can prove they are over 18 (notarized copies of birth certif., passport, etc.). Sameer's system would then have a credential saying "this account name is over 18." (There is of course little that can be done about people who lend their accounts to minors, absent any effective biometric security measures. No current system, certainly not Exon-Coates, can deal with this.) >I realize that digital credentials are old hat on this list. The point I am >making is that the pieces for doing this are here - we just need to >assemble them. > >(This is not to suggest that I am in favor of Exon/Coates in any way - >I am not. ) I think this could be quite a good project, provided it is not trying to be all things to all people. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Civilizing Cyberspace (book note)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Forward: Steven E. Miller, a member of the national board of directors of Computer Professionals for Social Responsibility, has published a new book, *Civilizing Cyberspace: Policy, Power and the Information Superhighway* (Addison Wesley, 1995, 413 pages). This is the best book I have seen on the public policy debates surrounding the information superhighway. It covers all aspects of this debate, including democracy, citizenship, community networks, privacy, intellectual property, competing models of the NII, universal service, equity, freedom of expression, protecting the public interest, encryption, and so on. Highly recommended for anyone interested in this subject, or for use as a text in classes. Gary Chapman, Coordinator, The 21st Century Project LBJ School of Public Affairs, University of Texas, Austin

1 0

Press Release on Response to Microsoft Internet Announcements
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I just posted the following from stanford.edu; it probably won't be approved and propagated in time, though. By the way, alt.internet.media-coverage, to which someone pointed me, is explicitly *not* for press releases. I do not plan to utter the string "cypherpunks(a)toad.com" because I think there's enough noise here already (some from me). Apologies to sameer for being presumptuous, but I did say "hope," and I also think tomorrow would be a really good time to document the .PWL file bugs... - -rich - ---------- Forwarded message ---------- Date: Wed, 06 Dec 1995 14:39:23 -0800 From: Rich Graves <w95netbugs(a)aol.com> Newgroups: misc.news.internet.announce, misc.news.internet.discuss Subject: Info on Microsoft Internet Announcements Thursday, December 7, 1995 Please reply, if necessary, to the address in the current FAQ, because I very seldom actually log on to America "On Line." Before forwarding this along, please check whether this has already been done; and let me know after the fact. As has already been announced in the print press, Bill Gates, who works at a large software company, will hold a press conference tomorrow, December 7th (a date with some historical significance), to announce Microsoft's Internet strategy. For information on Microsoft-sponsored marketing events in your area, please see http://www.microsoft.com/events/ Approximately fifteen minutes after Mr. Gates begins speaking (anyone have the exact schedule? please phone me), we hope to release very significant updates to the following Internet sites: http://www.c2.org/hackmsoft/ [information on a few security problems with Microsoft products] http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html [canon URL; multiple DNS-load-balancing SPARCServers] http://www-dccs.stanford.edu/NetConsult/Win95Net/faq.html [use this mirror of the above if you have an old DNS server that barfs on the www-leland lbnamed tricks] news.answers, comp.answers, comp.protocols.tcp-ip.ibmpc, and several higher-traffic groups will receive a text rendering of the above. This will be the first approved and rtfm-archived posting; the news-answers folks got back to me last week. gopher://quixote.stanford.edu/1m/win95netbugs will get a text rendering of the above, and contains relevant messages from an email discussion list. An email autoresponder to be named later (finger llurch(a)elaine.stanford.edu in the morning). The various archives on http://www.hks.net/ have additional information for the technically minded. A PGP-signed copy of this announcement is available on request, but I don't want to confuse the unwashed masses unnecessarily. - -rich "A day that will live in infamy" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMYaz43DXUbM57SdAQEeDQP/a8ZccX4fpMbKCNa6Cllii0qWI6A8oUKH 30fdoGl1HvlgWVhsB0paVLsQS8tQGsVt/MzKJLasTsnKuYVJCmdgmXcj9nEE9YIY SxBEDn6yGno2ey7G1lXJSkeVAjB8o/fX+kZXGNKfOGKgNqjIl12jHbW7NX1bsIKi wQl/s4uikQs= =6Z1M -----END PGP SIGNATURE-----

1 0

Responding to Exon -- technology is not enough
by Bill.Humphries＠msn.fullfeed.com 17 Dec '03

17 Dec '03

Jason Burrell <jburrell(a)crl.com> writes: >*Sigh*. Are we really ready to go back to UUCP? It looks like we'll have >to. That is, if someone doesn't set up a couple cryptographically enhanced >subnets first, or come up with some better idea. Interesting prospect, >actually. Fine for the tiny subset of Net users who understand crypto enough to use it on a daily basis. I'm not one of people either. This crypto isn't user friendly stuff. Before you propose such as solution, better make sure people can use this stuff. >Anyone wish to comment on the prospect of a double blind server, set >outside U.S. borders, that can act as an interface to the rest of the >world, perhaps encrypting or stego'ing the data transfered between it and >the user? Basically, an anonymous remailer that acts as a cross between >an NNTP, POP3, and SMTP servers. How are you going to pitch this technology to all the people with AOL and Microsoft Network accounts who barely understand the net? These are the people who need exposure to all the uncensored expression they can get. Instead of figuring out how to build a new treehouse that excludes Exon and Hyde, how about fighting the damned bill in the courts? bill.humphries(a)msn.fullfeed.com | WisCon 20: Two Decades of Feminism & SF http://www.cs.wisc.edu/wiscon/ | Ursula K. Le Guin: Guest of Honor

3 2

Re: latest librand source now av
by an116512＠anon.penet.fi 17 Dec '03

17 Dec '03

In .cypherpunks, Matt Blaze <mab(a)research.att.com> writes: >[Sorry if this is a duplicate; my machine had a bogus sendmail.cf >when I first sent this.] > >Souce code for the latest version of librand (a random >number package based on event interval variations) for >Unix-like machines is now available in: > ftp://ftp.research.att.com/dist/mab/librand.shar > >There are no restictions on use or distribution of this >code, which was written by Matt Blaze, Jack Lacy, and >Don Mitchell. > >-matt > why the FUCK would anyone want to use random number code from at&t, (and mister nescape GAK apologist himself)? this the code that was broken by french student for christs sakes. and tell us the truth about the restrictions, next time, bozo. asshole. cypherpunks write code themselvess!!! --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

2 1

[NOISE] Re: PGP
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

> > you really ought to be more thoughtful about what and how you write on > > the cypherpunks list... ** Vast numbers of double spaces deleted ** > The how is referring to not double spacing isn't it. Sorry, > I've been up for the last couple of days and didn't even realize it. > What do you mean what I write about? He means that this is NOT alt.security.pgp - we are not here to teach you how to use a bloody C compiler or to summarise README notes for you. RTFM. > > anyway, the PGP code from MIT should compile on nearly all unix > > machines. i'm not sure it will compile with a g++ compiler though. all > > unix type machines should have uncompress, tar, (g)cc. just get the > > source from MIT. > > I am not an idiot. I must have downloaded PGP from about 20 million > different places. They are all either missing files, some times the > darn code won't compile, or when I "tar xvf" half of the files bring > up an error and the computer says it can not create the file. I'll try > the address that you've sent. Hopefully I will have better luck. You want help, but supply minimal information. Post your problem to the appropriate place - alt.security.pgp, and supply a bit of information - what version of the source are you trying to compile, what Unix platform, what version of the C compiler, etc. > In the persuit of constructing a stable cryptographic program > that uses PGP what features should be included. Obviously all of > the ones that PGP has and encrypting/decrypting e-mail but what else? ?

1 0