December 2003 - cypherpunks-legacy

Re: IPSEC == end of firewalls
by frantz＠netcom.com 17 Dec '03

17 Dec '03

>Bill Frantz writes: >> At least maybe I can avoid Perry's wrath for an off topic post :-). > >Just for reference, the topic of firewalls and whether cryptographic >tools render them obsolete is not off topic for cypherpunks. In fact, >its one of the rare topics that is actually totally proper here... Expressed that way, I must agree. However, I think we also agree that firewalls in general should be elsewhere. Bill

1 0

Re: An IDEA whose time has come (Notes from the RSA Conference)
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:52 AM 1/22/96 -0800, Jonathan Zamick <JonathanZ(a)consensus.com> wrote: > Right now I'm trying to convince Ascom to develop a > crippled version of IDEA to simply give away if anyone wants it for export. > (Like most of the folk here, I don't see a 40 bit key as very valuable, but > it is useful for companies which don't have contacts in Europe.) A crippled version is easy - generate a 128-bit random key, make 88 bits available as salt, leaving 40 hidden bits. The problem is how to make the salt-bits available without interfering with applications and protocols. If you wanted a 64-bit crippled version, most applications need 64 bits of IV anyway, so you could use 64 bits of salt for that, leaving 64 more. To do a 40-bit version, you _could_ use 64 bits of salt and wire down the other 24 bits into a well-known pattern instead of choosing them randomly. That's three characters of ASCII, and I'd suggest "NSA" as the obvious pattern :-) So generate your 128-bit random number, replace the first 24 bits with "NSA", copy the 64 bits into the IV, and use it for your key. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

Re: Crippled Notes export encryption
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:53 PM 1/23/96 -0500, jpb(a)miamisci.org (Joe Block) wrote: >At 9:06 AM 1/23/96, Herb wrote: >>Careful... what would YOU have done, with your customers demanding stronger >>crypto today and you unable to legally give it to them? > >Umm - contract the crypto overseas somewhere it would be legal to export it >from? Then import the code to the USA, with a press release to WSJ & NYT >stating that American programmers were being put out of work by ITAR. The problem is whether you can separate the functionality of what you're exporting sufficiently from what you're contracting out that the exported material isn't a "component of a cryptosystem"; it's tough to do a good bones version of code if you're concerned about satisfying both the letter and spirit of a law to avoid hassles with the government. On the other hand, if you're as big as IBM or even MIT, sometimes you can do it.... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

Re: Who would sign Lucky Green's key?
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:24 PM 1/23/96 -0800, Lucky Green wrote: >The latest discussion about key signing parties and related questions asked >in private email got me thinking about signing keys for nyms. What would >one have to know to sign a key for a nym? Would you sign my key? Why? There are nym keys i have signed before. They are usually for nyms of friends and they are usually signed with another nym key. Kind of a fictional web of trust... I normally only sign keys for people I have met and trust to be the individual with the key claimed. "True names" and other legal fictions do not interest me as much as the individuals involved. Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

re: [local] Report on Portland Cpunks meeting
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:11 PM 1/23/96 -0800, jim bell wrote: >At 04:26 PM 1/23/96 -0800, Alan Olsen wrote: >>Key fingerprints should be brought on paper becuase it is not always assured >>of having a computer there to read the disk. (We had a lap top that was >>refusing to read disks effectivly. We had to use on of the Habit's >>computers.) > >...which, of course, had been infected the night before by a black-bag job >by some NSA operatives with a "fiddle with PGP and make the key signatures >come out wrong" virus... <G!> Well, it was only YOUR key that we were verifying! >Paranoia strikes deep... Into your keyring it creeps... It starts when your always afraid... Step out of line and the orbital mindcontrol lasers will zap you away... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Re: NY State to restrinct netporn?!
by Deranged Mutant 17 Dec '03

17 Dec '03

You wrote: > I heard about it and want to search NY's gopher site for the bill to get > the exact wording. Did the article give any more specifics, i.e., who > proposed it, the specific name of the bill, etc.? Not much info in the article. It wasn't the central focus... actually, the article dealt with the political cynicism of the new measures. More from the article (all that really mentions the bill at all): The cyberspace bill, passed by the Senate last week, could make it a felony to have sexually explicit communication with a minor through a computer network, especially if the communication included pictures of sexual activity or an invitation to have sex. Which doesn't say much about the bills content. Technically this is already illegal, so why pass a cybespce-specific bill? What are the responsibilities of publishers, ISPs, SysAdmins, etc.? What if a minor pretentds not to be a minor? IMO, It sounds like another meaningless bill that looks good on political mailings... What's the NYS gopher address again? Rob. > At 07:23 AM 1/23/96 +0000, you wrote: > >This in today's LI Newsday, p. A6: > > > >Crime Time in Albany > >Bills Reflect now popular get-tough stance > > > >by Liam Pleven, Albany Bureau > > > > Albany - A bill that would restrict sexually explicit material on > >the Internet - which the Assembly took little notice of last year - > >is suddenly headed tothe governor's desk after winning legislative > >approval yesterday. > >... --- "Mutant" Rob <wlkngowl(a)unix.asb.com> Send a blank message with the subject "send pgp-key" (not in quotes) for a copy of my PGP key.

1 0

Re: DigiCash Ecash - 2 security topics
by iagoldbe＠calum.csclub.uwaterloo.ca 17 Dec '03

17 Dec '03

>> > E.g. has there been a DigiCash response to Ian Goldberg's >> > publication of a denial-of-service attack which operates by >> > spending a coin with the same serial number as your victim's >> > coin? >> After discussing things with Ian we came up with several solutions. >> One is encrypting more messages (which we will do in a next revision >> of the protocol), the other is enabling ecash to work over ssl >> servers. You may not see the answer directly in the list, but you >> will see it in the next protocol revision. Actually, my original suggestion was to include 'n' in the value encrypted in the bank's public key. The less we have to _rely_ on ecash-enabled apps having to do their own encryption (like SSL), the better. Of course, extra encryption is OK, too. I wonder if Dave and I will get Digicash's reward for this one... I still haven't seen anything from them (though various individuals keep promising), or from Netscape either, for that matter... [emoticon elided] - Ian "starving grad student (sigh)"

1 0

Re: Crippled Notes export encryption
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

Dan Weinstein wrote: > On Tue, 23 Jan 1996 10:39:03 -0500, perry(a)piermont.com wrote: > > > >Set up development shop overseas for the crypto plug-ins. > > > >The solution is obvious and easy. > > > >By the way, I really think Netscape should simply ship Jeff and other > >people to the Amsterdam office or wherever else seems reasonable and > >do all the crypto work from there. It will save trouble and > >hassle. U.S. citizens wanting full 128 bit over the net would then get > >it from Netscape's overseas download sites. No one anywhere in the > >world would be forced to use crap. > > Wrong, this would be a violation of ITAR. David Chaum is doing it, why can't Netscape? I agree that it's probably technically a violation. I think that the real thing that's stopping Netscape is the golden government handcuffs, they don't want to piss off a big customer. thad -- Thaddeus Beier thad(a)hammerhead.com Technology Development 408) 286-3376 Hammerhead Productions http://www.got.net/~thad

2 1

Your Majordomo request results
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Your request of Majordomo was: >>>> subscribe cypherpunks Succeeded. Your request of Majordomo was: >>>> end END OF COMMANDS

1 0

Re: Reporting ITAR Violations
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:07 AM 1/24/96 -0500, Futplex wrote: >I would feel a bit more comfortable if violations by non-anonymous entities >were well publicized. Otherwise, we may force the TLAs to cash in the >"weapons export" card against the anonymizers, and hasten a crackdown on >them. Would that the remailer network were significant enough to call forth a legislative response. DCF

1 0