December 2003 - cypherpunks-legacy

digital signatures and "meaning"
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Digital signatures can have many different uses and meanings. The most popular application of digital signatures is proof of authorship. A person signs something when he claims that he wrote it and if the signature is invalid, the message must have been altered. However, digital signatures are used for many other applications. Typical applications include timestamping, digital cash, and validating a document or statement. The problem with these applications is that there must be some way to distinguish and timestamp signature from a proof of authorship. There are several different ways to do this: - Make all digital signatures prove proof of authorship. Someone would include the text of the document he wants to sign and put a message saying at the end such as: "This document existed on such and such date" or, in the case of digital cash, "This coin was blinded and signed by the bank using standard protocols." - Append some kind of electronic tag to the message that represents a certain kind of authorization. This is identical to the previous method except it relies more on protocols. - Specify the type of signing that is to be done with a key. This could be included in the text of the user-ID field of the public key in a PGP-like program. It could also be done by extending a key generation and management protocol to include a tag on the key itself specifying what this key is to be used for. There are advantages and disadvantages to each of these. The first has the advantage that it requires no protocol modification but relies on "legaleese." The second method does require that protocols be slightly modified, but these modifications could be made by just pre-processing and post-processing the message with another program. However, this is more limited than the first method because it essentially uses "canned" messages. The final method relies on either no modification to the crypto program used or a non-trivial modification. Personally, I tend to think that anything that uses a standardized protocol is a Good Thing. This is why I think that the second and third methods listed above would work better than the first. Comments? - --Mark =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= markm(a)voicenet.com | finger -l for PGP key 0xf9b22ba5 http://www.voicenet.com/~markm/ | bd24d08e3cbb53472054fa56002258d5 PGP: Because sometimes, a _Captain Midnight_ decoder ring simply isn't enough. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMQ1agLZc+sv5siulAQFKtwP/Xs7gOm1vP2FeDJDjahymYbMum3JrFqh0 VKXrkjmlh42ygX9y2sLfivN7DMsAGIF86NRaW67x0LD2uPuBl00KyvC18bqEPfiF kMbvOZv96xL4fBssheRR7F4YH/oaASxCagxuAkIqBxi9uEzAppNloxMYHy87w0kY h+48n+YH3D0= =QTZp -----END PGP SIGNATURE-----

1 0

Re: Lotus Notes
by Rich Salz 17 Dec '03

17 Dec '03

Thanks for the explanation -- in all my discussion with RSA and explanation to our lawyers I was thinking strictly API. Your quote of the RSAREF license says they won't refuse anythign reasonable, and one would be hard-pressed to say that changing keysize for something already not exportable isn't reasonable. I'll have to read our license when I get to work tomorrow. /r$

1 0

The Boys From Brazil - thoughts on cloning Nazi servers
by Simon Spero 17 Dec '03

17 Dec '03

I've tried to stay out of this thread, as it is mostly off topic, but I do have one suggestion to people setting up clones of the zundel site. There's a fine line between defending someones freedom of speech, and actively promoting that speech. The reason these mirrors have been set up is to counter the restriction on access to the original site that has been put in place by Deutche Telecom; however, in addition to defeating this restriction, this approach also makes the material more widely available than it was previously, which could be seen as crossing the line between defence of free speech, and active promotion. One approach that would stop this line being crossed would be to configure the clone servers to only allow access to sites in Germany affected by the original restriction. This compromise defends freedom of speech, but does not give the site any wider promulgation than it would have had had no government restrictions been emplaced. Simon

1 0

Re: Unscribe
by Alex de Joode 17 Dec '03

17 Dec '03

TCM sez: : At 1:34 AM 2/2/96, Ewout Meij wrote: : >unscribe cypherpunks(a)toad.com : ^^^^^^^^ : > : >unscribe emeij(a)pi.net : ^^^^^^^^ : > : >There is a theory which states that if ever anyone discovers exactly : >what the Universe is for and why it is here, it will instantly : >disappear and be replaced by something even more bizarre and : >inexplicable. : There is a theory which states that the correct way to unsubscribe from : mailing lists is defined by the mailing list charter and principles, and : that sending misspelled "unscribe" messages to the wrong place, and : including "unscribe" messages intended for other lists, is bizarre and : inexplicable. : --TCM [pi.net] 'Planet Internet' is the dutch equivalent of AOL. -AJ-

1 0

The Boys From Brazil - thoughts on cloning Nazi servers (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 1 Feb 1996 10:49:19 -0800 (PST) > From: Simon Spero <ses(a)tipper.oit.unc.edu> > Subject: The Boys From Brazil - thoughts on cloning Nazi servers > > There's a fine line between defending someones freedom of speech, and > actively promoting that speech. The reason these mirrors have been set up > is to counter the restriction on access to the original site that has > been put in place by Deutche Telecom; however, in addition to defeating > this restriction, this approach also makes the material more widely > available than it was previously, which could be seen as crossing the > line between defence of free speech, and active promotion. > I would counter and say that there is no distinction between free speech and promoting said speech. How does one say one party has the right to make a statement and a second party does not have the right to agree? The whole point of freedom of speech is to prevent limitations on distribution of information (aka speech, writting, source code, executables, video, audio tapes, etc.). Even use of these materials (ie running a virus) would not violate either the spirit or the letter of the law unless it harmed another person or somehow took advantage of their property (physical or intellectual) without their prior consent. Jim Choate CyberTects ravage(a)ssz.com

3 2

Domain registration
by David Mazieres 17 Dec '03

17 Dec '03

Well, several people have told me it is possible to get response times of 8 hours on domain registration requests. The last MODIFY request I sent in was in mid January. They sent back an autoreply telling me they were still working on modify requests from the third week in december, and then didn't change my domain until last week. (The inaddr.arpa modify request was considerably faster, however.) Maybe they just don't like me, or maybe they have very very recently automated the process. At any rate, I stand corrected. David

2 1

cypher-list noise levels
by Jonathon Fletcher 17 Dec '03

17 Dec '03

Hi, Can someone on the PGPdomo cypher-list tell me how good the signal to noise ratio currently is, and how good the content is. I've not signed up, but I'm tempted to try and get away from the noise on here recently. -Jon -- Jonathon Fletcher <jonathon(a)pobox.com>

2 1

Crypto-smart-card startup Inside Technologies
by Peter Monta 17 Dec '03

17 Dec '03

There's an article in the January 29 _EE Times_ about a French cryptographic-smart-card startup called Inside Technologies. Tidbits: ..."In public-key cryptography, 512-bit keys are typical and already vulnerable. So we are looking at 640-bit-long keys supported by a scalable design." ..."Users want their own, custom algorithms, which can be downloaded at the time of use". ..."The CLU [cryptographic logic unit] will operate at a higher clock frequency than the RISC---60 MHz, in our design---yielding 640-bit RSA decrypt in less than 50 ms". The article goes on to say that they plan to both manufacture smart cards, presumably for ecash and communications, and license the design at the macrocell level, possibly for use in embedded systems like mass storage. By my count, six European companies mentioned, zero American. Cheers, Peter Monta pmonta(a)qualcomm.com Qualcomm, Inc./Globalstar

2 1

Re: Downsizing the NSA
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

A semiparanoid thought struck me: Maybe the NSA doesn't these extra 20K people, they just don't want them to go out into the industry and build crypto for the outside world. So they continue to pay them salaries and have them do nothing useful. This would be kind of analogous to how when Russia no longer needed so many nuclear scientists, the U.S. helped create "make work" jobs for them, just so they wouldn't go to work for the likes of Iraq. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Freedom of speech question...
by Jim Choate 17 Dec '03

17 Dec '03

It is a commenly held belief that shouting 'fire' in a crowded theatre is a crime because of the potential for harm to persons and property. It is one of the most commen examples given for limiting freedom of speech even though the Constitution says "Congress shall make no law...". This view is proposed as a equaly valid rationale for limiting crypto, virus technology, drugs, etc. My question to the list is would it be a crime if you were alone in the theatre? If you developed a virus and didn't distribute it would that be a crime? If you give it to one person is it a crime? How about if you give it to millions? How many people must know a fact, posses source code or executable. In short, does freedom of speech rest on how many people are aware of your expression? My position is that if you answer in the affermative then you are basicaly stating there is no freedom of speech. It should be perfectly permissible to shout 'fire' in a theatre filled to the brim. If anyone takes you seriously and is harmed then you should be liable for the damage. Your right to shout 'fire' is not relevant. If you accept the premise then what you are buying into is preemptive justice, in short judging somebody guilty by what they might do, not what they have done. If this is permitted then we have a serious problem in that anyperson is therefore guilty of whatever crime is desired.

2 1