December 2003 - cypherpunks-legacy

Crypto Exports, Europe, and Conspiracy Theories
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)got.net (Timothy C. May) on Wed, 24 Jan 4:59 PM A welcome inquiry, Tim. Is it not likely that the best crypto in many of the countries is kept off the market in the national interest, cloaked in the greatest secrecy like other crucial weapons of survival? Especially to defend it from NSA-like predators. Was this not the practice in the US before public key genie escaped? And is surely still the case for the very best US crypto -- not that which can be readily purchased or purloined. The market, and PGP, are probably condoned as a cloak for the best, in the US and elsewhere. Or bait. Or traps.

1 0

mouse droppings
by joee＠li.net 17 Dec '03

17 Dec '03

In the march '96 issue of macworld there's a "Viewpoint" reporting on the progress of the info superhighway. Privacy and security issues predominate the text, the primary source of which is larry irving --- "a top administration adviser on telecommunications." One issue, "mouse droppings" --- "a trail of every site they visit and for how long [on the www], was highlighted as an example of existing privacy regulations falling short of consumer expectations. Apparently, the amorphous public is shocked, *SHOCKED* I tell you , to discover that their service providers are selling the personal preference information to the highest bidder. More info in article. Would some rocket scientist speak to this terrifying mouse droppings issue? j. ercole <joee(a)li.net> ny, usa pgp public key at: http://www.li.net/~joee/autumn2.html $$$$$$$$$$$$$$$$********************&&&&&&&&&&&&&&&&& Stand By---.sig presently being unearthed in regression therapy.

3 3

Free speech and written rights.
by James A. Donald 17 Dec '03

17 Dec '03

At 10:06 PM 1/24/96 +0800, Bruce Murphy wrote: > Which brings me to another point. At least [Americans] *have* a free > speech bit in your constitution. While it's generally considered a > right [in Australia], legally that's not really good enough. About twenty or thirty years ago, there was big debate on in Australia on whether Australia should have a bill of rights. The natural rights crowd popped up from obscurity and vigorously opposed a bill of rights. They successfully argued that if a bill of rights were written down on paper, these rights would then become mere creations of the courts. This same concern is voiced in Article nine of the American bill of rights. In my judgement, America is reasonably free despite having a bill of rights, rather than because of a bill of rights. The American nation derived its cohesion from the ideology of liberty, not from a race or religion. This is the reason America has a bill of rights, and this is the reason it remains somewhat free despite possessing a bill of rights. Despite this debate and referendum in Australia, the government has been sneaking some rights into the Australian constitution by various stratagems, and I think that this will have the effect of undermining liberty. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Lotus, NSA sing in same key
by David K. Merriman 17 Dec '03

17 Dec '03

Article of that title in Jan 22 issue of EE Times: "San Francisco - IBM subsidiary Lotus Development Corp. offered an olive branch of sorts to the National Security Agency (NSA) last week, at the opening of the RSA Data Security Conference at the Fairmont Hotel. The Iris Associates unit of Lotus that developed Lotus Notes will be able to ship an international version with the equivalent [!!] of 64-bit encryption, using a concept Lotus calls "Differential Workfactor Cryptography". In the past, NSA has blocked the State Department from issuing broad licenses for packages with encryption of 40 bits or stronger. The Business Software Alliance argues that this has jeopardized sales of U.S. software overseas. The NSA has unsuccessfully tried to get U.S. manufacturers to use the Clipper chip or its software equivalent (based on a classified encryption algorithm) or an unclassified "key escrow" algorithm in which decryption keys must be held by third parties. OEMs have rejected all key-escrow concepts and have demanded international export rights for public-key cryptography methods promoted by vendors such as RSA. Lotus's compromise with the NSA concedes the agency's right to conduct signals intelligence on foreign targets. The encryption in Notes Release 4 is based on a 64-bit random number. But for the exported version of Release 4, the NSA generates a public-key algorithm and encrypts 24 bits of the key using the public RSA key. The result of this operation, the Workfactor Reduction Field [!?], is bound to the encrypted data. Foreign hackers will find the encrypted messages as difficult to decrypt as a message with a 64-bit RSA key, but the NSA will find it as easy to crack as a message with a 40-bit key." EE Times, Jan 22, 1996, page 116 sidebar ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geocities.com/CapitolHill/1148

2 1

RE: Crippled Notes export encryption
by Pete Loshin 17 Dec '03

17 Dec '03

Joe Block wrote: > >At 11:50 PM 1/23/96, you wrote: >>The problem is whether you can separate the functionality of what you're >>exporting sufficiently from what you're contracting out that the exported >>material isn't a "component of a cryptosystem"; it's tough to do a good bones >>version of code if you're concerned about satisfying both the letter and >>spirit of a law to avoid hassles with the government. On the other hand, >>if you're as big as IBM or even MIT, sometimes you can do it.... > >So move 100% of the development overseas. Pick someplace where the labor >is cheaper (maybe the former Soviet Union, but I don't know what their >crypto export laws are like) and develop 100% of the product overseas. Put [deletia...] I've heard that India is the place to be for software development these days (top talent for 10% the price of Americans, or some such). I've also heard that, for example, CyberCash has a development office there. -Pete Loshin pete(a)loshin.com

2 1

re: [local] Report on Portland Cpunks meeting
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 11:13 PM 01/23/96, Bruce Baugh wrote: >The nym signing is an idle thought of mine. I have a nym key which is, at >the moment, signed only by itself. I know friends of mine have nym accounts. >if we could assemble a group of folks whom I can trust enough to link the >nym and myself, it'd be nice to add some more signatures to the nym key, and >vice versa. I don't understand--what would signatures on a nym's key be good for? If I sign your key named "Bruce Baugh", I'm basically saying that I feel confident that this key really _does_ belong to Bruce Baugh. Others see my signature, and say "Jonathan, he's a groovy guy, if he feels confident that this belons to Bruce, well, he's probably gotten the fingerprint directly from Bruce in person, and I'm happy to use this key to send mail to Bruce." If, on the other hand, I sign "Toxic Avenger"'s key, then what benefit is this for third parties? Since Toxic Avenger is, by intention, _not_ linked to a real person, I'm not saying that I feel confident that this key really belongs to any particular real person. What am I saying?

3 2

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 19:34 1/24/96, Derek Atkins wrote: >If I have a function that does something like this: > >authenticate (args) >{ > ... > > des_encrypt (); > ... >} > >I would have to remove the des_encrypt() call from the authenticate() >routine before it can be exported... What if you replaced it by rot_13 () ? Surely, they can't ban that. And someone later could just swap all rot_13 () for des_encrypt () -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Crypto Exports, Europe, and Conspiracy Theories
by Rich Salz 17 Dec '03

17 Dec '03

I believe that one minor reason is the PKP chokehold on public-key patents. It has slowed down adoption within the US, and the RSA licenses for example tend to get very "interesting" when it involves places where their patents don't hold. Last year, how many COTS products had strong crypto? There are very few software imports into the US. I don't think crypto is particularly slighted. There might be pressure, and there might be dummy front firms, but with tongue in cheek to emphasize the point, I just think those ferriners can't code fer shit. /r$

1 0

Re: Hack Java
by br＠scndprsn.Eng.Sun.COM 17 Dec '03

17 Dec '03

]Both of you are correct if you look carefully at the assumptions. Rich ]assumes that you have a 'malicious compiler'. Godmar is right that Java ]does not utilize pointers in the byte code. What would make the entire ]scenario work is a malicious interpreter or a 'NotJava Browser'(TM) that ]allowed malicious code to be executed. Couple a bad compiler and a bad ]interpreter and you are in buisness (nasty business that is). Yes. And if you also let an intruder in your house, have them sit at your computer with your newborn child in the room and go on vacation, things can get really, really nasty. Sort of like when you execute untrusted code in an untrusted environment... -- Benjamin Java Products Group

3 2

Re: Nym use in the real world
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 10:01 AM 1/26/96, Eric Murray wrote: >With the coming Internet restrictions and growing use of the >net by LEAs, it's become obvious to me that I shouldn't post >messages with my real name. But I have some problems/questions about >using a nym: [...] Very good points. Just saying "use anonymity" is often a gross oversimplification for several reasons. One of the problems I've been thinking about recently is that I may want only a special group of people, and no one else, to know that I'm responsible for a post. A nym won't work in this case. As has been pointed out here before, a lot of people are going to be getting in trouble for things they posted to obscure newsgroups or mailing lists four years ago. How do I make sure that I get credit for something I've posted, but avoid the Alta Vista police? There are a few feeble solutions, like: h w t w s t c b s f w A V i o h a o h a e e o i l i d r i y e n a r t t s i d s y ' r h a t n s t c a g h e d o.r..l.i.k.e..t.h.i.s ...but someone will undoubtedly find a way to search for these things eventually, or they can just subscribe to the list! Anonymity is a pain in the ass, frankly, which is why I've never used it. True, I've never needed to post anything really sensitive, but going through life as "Black Unicorn" (no offence, BU) is just an unacceptable inconvenience as far as I'm concerned. Sort of like having to live on the lam, which I'm sure is no party. It seems there are more and more situations where encryption and anonymity aren't enough. One obvious case is the web, where I may want to put something of questionable legality on my home page. There's no way that crypto will render the laws irrelevant in this case. Can I get an offshore account and post the offending graphic there? Yes, but it's a pain. And when the big net crackdown comes, I wonder whether the U.S. will pressure other countries to participate and help them wipe out these data and gif havens? The net is moving farther and farther away from being a "Temporary Autonomous Zone," meaning there are fewer and fewer pockets to hide or get lost in. --Dave. -- Dave Mandl dmandl(a)panix.com http://www.wfmu.org/~davem

1 0