December 2003 - cypherpunks-legacy

Re: Crippled Notes export encryption
by Alex Strasheim 17 Dec '03

17 Dec '03

> The usual issue: That if a foreign-originated product even appears to be a > standard (so far, none have been), and includes strong crypto, then the NSA > and other agencies will simply change the rules. Thus, if extremely strong > crypto from "Netscape-Zurich" starts to have a significant market presense > in the U.S., then some law will be passed to restrict it. But what would they restrict? The use of strong crypto between two domestic points, or strong crypto where one end is within the US and the other without? We already have the former -- wouldn't it be hard for them to take it away? Especially if the software already has a large installed base, which is your premise? I'm not denying that there are people in the NSA who would want to react that way, but I don't think they'd be able to pull it off. It is true that the National Security establishment has a lot of power and influence here. But there are other groups with power as well, and the security types don't have the ability to do whatever they want without regard to the opinions and interests of those other groups. I think America's commercial interests will carry the day. The NSA isn't capable of achieving its objective, which is to preserve passive surveillance. It doesn't matter what the rules are or what Congress passes. It's over. There are a lot of smart people in the NSA, and some of them have to know that. Big companies like Netscape, Sun, Microsoft, and IBM/Lotus, on the other hand, will almost certainly achieve their objectives if they win the political fight. They'll make buckets of money selling crypto software abroad. And if they lose the fight, they're going to be handing big opportunities to foreign competitors. Who's going to fight harder? You add to that the fact that impartial observers will say, for the most part, that Netscape's right and the NSA is wrong, and the tremendous interest world wide in creating a trustworthy net based infrastructure for commerce, and the NSA starts to look a good poker player with a bad hand. They used to say that "what's good for General Motors is good for the country." A lot of people still feel that way about our biggest companies. When they get their acts together and stare down the NSA in a block, it will all be over. I feel a little strange about constantly playing the corporate shill here. I'm not a corporate person, and all of the companies I talk about here would probably find me unsuitable for employment. I'm certainly not going to participate in the crypto profits that they'll realize. My interest in this isn't the same as Netscape's. But it's going to be Netscape that pushes this thing over the top. Crypto is a big tent issue. Some people want the restrcitions eased so they can make money, some are afraid of the government, some want to protect civil liberties, some love the math and technology, and others just want to thumb their noses at Mr. Freeh. I want to see censorship become technically infeasible. There's very little popular support for that position among the general public; everyone wants censorship as long as they agree with the censor. Arguing for crypto from the vantage point of a civil libertarian is pointless. Even here on cypherpunks the bill of rights doesn't get much respect. The point is that the only guy in the big tent with any clout at all is the corporate manager. When the kids get together on the street and protest net censorship, does anyone care? Is a militia movement argument going to play in Peoria? (I think those are counter productive -- at times I've been scared enough by them to re-examine my own position.) I agree with Noam Chomsky when he says that corporate interests dominate our politics, but I also agree with Milton Friedman when he says its for the best. We should focus our efforts on energizing corporate America for the fight. The best way to do that is to demonstrating to customers that exportable security is nothing more than snake oil under the current rules. Another way it is to explain to people -- journalists and managers alike -- exactly why the current rules are bad for business. Lets develop and popularize arguments against the NSA position, not radical or esoteric arguments, but the kind of arguments that sensible people who go to work and read the paper every day can repeat to one another when they talk about politics. If we can get this stuff onto the editorial page of the WSJ -- which is where it belongs -- we'll be in spitting distance of a victory.

1 0

Re: Crippled Notes export encryption
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

At 11:50 PM 1/23/96, you wrote: >The problem is whether you can separate the functionality of what you're >exporting sufficiently from what you're contracting out that the exported >material isn't a "component of a cryptosystem"; it's tough to do a good bones >version of code if you're concerned about satisfying both the letter and >spirit of a law to avoid hassles with the government. On the other hand, >if you're as big as IBM or even MIT, sometimes you can do it.... So move 100% of the development overseas. Pick someplace where the labor is cheaper (maybe the former Soviet Union, but I don't know what their crypto export laws are like) and develop 100% of the product overseas. Put a notice inside each shrink-wrapped box that "This product was forced to be written overseas, costing American programmers their jobs, by the shortsightedness of Congress." 2048bit-Fingerprint: F8 A2 A5 15 56 42 9B 16 3F BD 57 0F 8A ED E3 21 No man's life, liberty or property are safe while the legislature is in session.

2 1

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 4:17 1/24/96, Timothy C. May wrote: >The usual issue: That if a foreign-originated product even appears to be a >standard (so far, none have been), and includes strong crypto, then the NSA >and other agencies will simply change the rules. Thus, if extremely strong >crypto from "Netscape-Zurich" starts to have a significant market presense >in the U.S., then some law will be passed to restrict it. I agree. The reason for enforcing ITAR is to keep good crypto of the *domestic* market. If ITAR no longer accomplishes that, new laws will be passed. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

re: [local] Report on Portland Cpunks meeting
by Bruce Baugh 17 Dec '03

17 Dec '03

At 01:33 PM 1/24/96 -0500, Jonathan Rochkind wrote: >If, on the other hand, I sign "Toxic Avenger"'s key, then what benefit is >this for third parties? Since Toxic Avenger is, by intention, _not_ linked >to a real person, I'm not saying that I feel confident that this key really >belongs to any particular real person. What am I saying? Over time, some nyms take on a distinct identity of their own. In fact, some do it very quickly, a with the neo-Nazi twits now arguing in favor of rec.music.white-power over on news.groups, some with distinct "voices". The thought, therefore, as I imagine it would be "You don't know I am in person, but you can count on me to be who I am, with this style and set of views, and I say that this guy is another actual person with the same." Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

2 1

Re: Crippled Notes export encryption
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

Lucky Green <shamrock(a)netcom.com> writes: > At 4:17 1/24/96, Timothy C. May wrote: > > >The usual issue: That if a foreign-originated product even appears to be a > >standard (so far, none have been), and includes strong crypto, then the NSA > >and other agencies will simply change the rules. Thus, if extremely strong > >crypto from "Netscape-Zurich" starts to have a significant market presense > >in the U.S., then some law will be passed to restrict it. > > I agree. The reason for enforcing ITAR is to keep good crypto of the > *domestic* market. If ITAR no longer accomplishes that, new laws will be > passed. No need for any new laws or regulations, all that needs to be done is to add crypto to the import list (the opposite, and currently not so widely discussed counter part to the export list). In fact I wouldn't be suprised if the ODTC and NSA could interpret ITAR and the current import list to allow this. (Anyone have an electronic copy of the import restricted list?) Of course this wouldn't be a very popular move, so I'd guess that it wouldn't be tried until a) foreign crypto apps become a significant obstacle to the NSA, and b) other methods have been exhausted. Adam -- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length$n&~1)/2)

1 0

NON_nsa
by John Young 17 Dec '03

17 Dec '03

February Byte reviews nine non-US (non-NSA, wah?) crypto programs, ranging from uses for a single laptop to company networks to transmissions on the Internet, by Martin Banks, a UK writer. Admire these deadpan marketing names: Deadlock (uk) EasySafe and MasterSafe (il) Latches for Windows (uk) Safeguard Easy (de) SecureData (uk) SmartLock (it) StopLock (uk) TeamWare Crypto (uk) and, more Jim Carey-ly: Visage (uk) -- which uses faces as passphrase! NON_nsa (For those with non-key-access to Byte)

1 0

Re: Crippled Notes export encryption
by Dan Weinstein 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- m5(a)dev.tivoli.com (Mike McNally) Wrote: > Dan Weinstein writes: > > >By the way, I really think Netscape should simply ship Jeff and other > > >people to the Amsterdam office... > > > > Wrong, this would be a violation of ITAR. > > I don't understand; are you saying Jeff's brain is a munition under > the ITAR? > > (Is it a citizenship thing? If so, that's an easily solved problem: > hire Dutch (or Egyptian or Bangali or whatever) engineers.) I forget how it is termed in ITAR, but expertise can't be exported either. Another thing to remember is that Jeff and the others at Netscape aren't writing the encryption algorithms themselves, they implement the code that they get from RSA. Though most of the code they get from RSA is already available abroad, if they wanted to import it they would face serious copywrite problems with RSA. Also, like I suggested before any programers who gained their knowledge of crypto programing in the U.S. and then went abroad and developed crypto software would be in danger of prosecution under ITAR if they ever returned to the U.S.. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMQbINb6vSB2TMALlAQG8zAf9FFlCiiYS86Q/ZsiycSXN0w7hT+NdVHI5 8fBVaT+w+OP5DZAbEMg7gM37ryujuDXnRO12WJTa8HTT5+W81TDf6vzgK2yWqShZ kCM6j48nUttwYsXVGUpK2uSSBhLs1+y7lLPObs0I9BNZ9QZ3o/68jpRXnsph3+Oc J4XEe6Yf1u/V4wM58hO8v1fClcCHSyeIFZL+i8NdhcO+BO71qBhOntsGWuVu+sM0 jN7/hix1do+xA856EkRzPoqv0LPcJkCjF3qw+iCKdI7y6LWljA91LJvrYedONu9V cigMrsQF4QFJ2CHrxulolzMPuz4ZNg9K/ZjWoY2t8wgs57dDiojKTQ== =ehWV -----END PGP SIGNATURE----- Dan Weinstein djw(a)vplus.com http://www.vplus.com/~djw PGP public key is available from my Home Page. All opinions expressed above are mine. "I understand by 'freedom of Spirit' something quite definite - the unconditional will to say No, where it is dangerous to say No. Friedrich Nietzsche

2 1

Netscape & open NNTP servers
by stephen_albert＠alpha.c2.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've got a question that I feel like I *should* know the answer to, but don't. Say I configure Netscape to point through an open http proxy, and then connect t an open NNTP server. I don't know much about how proxies work. Does the NNTP connection go through the proxy or directly from my machine? As I understand it if it does the first, then I don't have to worry about the NNTP server's log file, if any. But if it does the second, I do. Am I in the ballpark here? ObCrypto: Not-readily-traceable posting with less hassle than a mail-to-news gateway seems to have some privacy relevance, even if it's not directly crypto. Stephen "To NNTP Serve Man" Albert stephen_albert(a)alpha.c2.org <*> PGP key on request and on servers -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMQbVikimCtQtWVIdAQEjZgf+KFK8AzLY8ndSBAmWzQAwqMCmbA3IR8yl TU/c2f/FAMRypAGf+IcKIgmLAPxjbOBSvCmYv8cSXBtb/hhOFbmzIf5EY5QyfcMt OVsMk80gHJxBiUaSYetwklkRub1dqan0R2fUfQq1ey2ZUZk3OvUB4gTW5XPKNpND HxLINjJ2Ph6SH4AqCZ0hNwFkk3gtZsLGTgUHhdrkhaAKnEBSXWN9mMvkNHngScRq A0SlVehxwj8yFLF5rf1G82AM3fdZrdWhMDlWmVCkgpo5mr5AXtYpfHKa9ZsesM8O eRVvlVzXU+w4Y1B5swM5QDpezsPqxBtTn0JEb78mGM4gCoVyEi06Ow== =gwrx -----END PGP SIGNATURE-----

2 1

Re: Crypto Exports, Europe, and Conspiracy Theories
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:59 PM 1/24/96 -0800, Timothy C. May wrote: >In a kind of variant of the Fermi Paradox ("Why aren't they here?," >referrring to alien visitors), my question is this: "Why aren't we able to >solve this pressing problem of not being able to export strong crypto by >_importing_ it?" > >I don't think it's an accident, or laziness on the part of European and >Asian companies, that we haven't gotten around the U.S.'s laws about >exporting crypto by getting our crypto from competent programmers and >companies outside the U.S. > >Comments? How about time. We're less than a year on from the "Internet Breakthrough." It is not obvious to the non-political that stand alone desktops or enterprise LANs need crypto. The "need" for the product only develops with telecoms. Recall the fact that hardly anyone was online (or even knew what the term meant) only a short time ago as product development cycles run. We'll see. Markets are efficient but not perfect. DCF

1 0

Re: Crippled Notes export encryption
by Rich Salz 17 Dec '03

17 Dec '03

>So where exactly do they draw the line? You can still construct your >software in such a way that there is a clean boundary between the >crypto stuff and the rest. Right. However, if you call things like "keysize" as oposed to "state" then they will look askance. >How exactly are crypto-hooks defined? On a case-by-case basis. /r$

1 0