December 2003 - cypherpunks-legacy

Re: Voice On the Net Digest V2 #44
by tedwards＠access.digex.net 17 Dec '03

17 Dec '03

> From: "Shane D. Mattaway" <shane(a)netspeak.com> > Date: Thu, 1 Feb 1996 07:12:32 -0500 > Subject: [VON]: WebPhone Beta 6 Release > AUDIO ENCRYPTION > All audio transmissions are encrypted to provide secure conversations > without any performance overhead. Encryption is accomplished using a > proprietary algorithm. If the encryption is secure, there is no need to have "security through obscurity." I rather doubt that the makers of WebPhone have invented a proprietary encryption method that actually provides a high level of security. Most truly secure encryption methods (DES, RSA, IDEA) are presented for peer review for years before the academic and cryptographic communities deem them to be reasonably secure. It is easy to claim you have a secure encryption algorithm - but most such algorithms turn out later to have serious security holes. Only some manage to hold up to their security claims under close academic analysis. PGPfone's encryption methods are available for public inspection, and are generally accepted by the cryptographic community to be secure. -Thomas Edwards

1 0

RC2 Source Code - Legal Warning from RSADSI
by baldwin 17 Dec '03

17 Dec '03

WARNING NOTICE It has recently come to the attention of RSA Data Security, Inc. that certain of its confidential and proprietary source code has been misappropriated and disclosed. Despite such unauthorized use and disclosure, RSA Data Security reserves all intellectual property rights in such source code under applicable law, including without limitation trade secret and copyright protection. In particular, RSA Data Security's RC2 (TM) symmetric block cipher source code has been illegally misappropriated and published. Please be advised that these acts, as well as any retransmission or use of this source code, is a violation of trade secret, copyright and various other state and federal laws. Any person or entity that acquires, discloses or uses this information without authorization or license to do so from RSA Data Security, Inc. is in violation of such laws and subject to applicable criminal and civil penalties, which may include monetary and punitive damages, payment of RSA's attorneys fees and other equitable relief. RSA Data Security considers misappropriation of its intellectual property to be most serious. Not only is this act a violation of law, but its publication is yet another abuse of the Internet. RSA has begun an investigation and will proceed with appropriate action against anyone found to have violated its intellectual property rights. Anyone having information about the misappropriation identified above is encouraged to contact RSA directly.

2 1

Re: RC2 Source Code - Legal Warning from RSADSI
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

> I hope that his code was not stolen, if it was actually stolen and then > released and we knew that for sure, then trade secret rights would probably > still apply. However the code was posted anonymously we do NOT know for > certain that it was MISAPPROPRIATED. As such it may have been reverse > engineered in manner that does not violate trade secrets and hence it can be > used. The burden is with RSA to prove that any one person KNEW it was > misappropriated. That is why we are seeing all these messages flying around > on the web, RSA attorneys are trying to shut the barn door after the horses > have left... The author claims that the code was disassembled. S/he credits "CodeView" which is Microsoft's debugging/disassembly tool. Of course, this could just be a cunning ruse...

2 1

RC2 technical questions
by baldwin 17 Dec '03

17 Dec '03

In a shameless attempt to move the discussion of RC2 into a more technical arena, here are some interesting questions to explore about RC2. --Bob Key expansion - How can you tell whether the permutation is based on some sequence of digits from PI? - What are the diffusion and avalanche properties of this permutation? - What are the linear characteristics of this permutation? - What are the properties of the compression function that maps 16 bits (bytes X and Y) to 8 bits (byte Z) via Z = P[X + Y]? - How does the length of the key influence the mixing of bits during each pass of the expansion algorithm? - Is this a non-linear feedback shift register over the field GF(256)? - If the first pass of expansion is viewed as a hash function that produces 40 or 128 bits out, what are its properties? Round Functions - What are the diffusion and avalanche properties of the two round functions? - What are the linear approximations and how good are they? - What characteristics can be preserved by the round function that performs rotations? - With what probability? - Does the amount of rotation influence the security? - What characteristics can be preserved by the round function that performs the data dependent selection of the expanded key? - With what probability? - Are there any "weak" keys? - Will the expansion algorithm produce them?

3 2

"Can't we all just get along?"
by Pot＠networking.stanford.edu 17 Dec '03

17 Dec '03

This is not FLAMEpunks.

2 1

Fair Credit Reporting Act and Privacy Act
by Frank Willoughby 17 Dec '03

17 Dec '03

FWIW, while the goal of the cypherpunks in helping to promote secure private communications by making encryption publicly available on a worldwide scale, definitely helps socially backward countries which have dictators (communist or otherwise), it misses its mark somewhat in the USA. Personally, I think that in the USA, this is treating the symptom, but not the disease. Probably the easiest way of ensuring that personal information isn't wantonly distributed by credit agencies or (anyone else) is to update our Privacy Act - which is ridiculously out-of-date and badly in need of being re-written. It is also hampered by its apparent lack of teeth. My personal recommendation would be a law like Germany's BDSG. The BDSG (BundesDatenSchutzGesetz which translates to: Federal Information/Data Protection Law (aka Privacy Act). Even better would be a law like the one in Austria (which I understand has the world's strictest privacy act. (Hooray for the Austrians). 8^) If the Privacy Act were rewritten to be as strict as the BDSG, businesses would have a (mandatory) legal requirement to: o Ensure that personal data is stored properly (by encrypting it, etc) o Ensure that personal data is not distributed o Ensure that databases are *not* being maintained which describe the characteristics of individuals (buying habits, income, property ownership, etc) wantonly propagated by marketing (direct mail, telemarketing, etc) companies. (Note that credit bureaus still have a function, but they would be (forced to be) responsible for ensuring that compliance with the Privacy Act would be maintained. This could result in better safeguards being implemented by the credit bureaus.) resulting in the following by-products: o the promotion of the use & implementation of encryption - including the possibility of ITAR being reduced or eliminated for the export of encryption products o reduced propagation of personal information o reduced amount of junk mail that winds its way to our mailboxes each day 8^) o reduced amounts of tele-marketing 8^) If pressure were brought to bear on the law-makers to rewrite the Privacy Act to give it qualities like the BDSG, etc, then this would significantly help achieve the cypherpunks' goal of promoting secure private communications. (I realize this isn't the only goal of the c'punks, but its a start). As the changes would be made within "the system" as opposed to outside of it, there would be virtually no hassle from the government. IOW, changing the Privacy Act will probably solve a variety of problems while achieving the c'punks goal of secure personal communications. Food for thought. Best Regards, Frank <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc. Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified Home of the Free Internet Firewall Evaluation Checklist

1 0

RE: Sometimes ya just gotta nuke em
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 8:33 2/3/96, "A. Padgett Peterson, P.E. Information Security" <PADGETT@hobbe wrote: >Tim rote: >>At 4:12 AM 2/3/96, Rich Graves wrote: >>>Who holds up the nuking of Hiroshima and Nagasaki as great victories >>>against tyranny? >>Since you ask, I do. > >And the biggest secret of the war was that "Fat Man" was the *last* A-bomb >we had or could build for about a year (had taken several *years* to >separate enough fissionable material for the three via two entirely >different processes). > >To me this is the great strength of the USA: given a theoretical problem, we >will develop a hundred different solutions, try them all in parallel, and at >least one will work. I agree - Not only were there two different separation methods but the two bombs dropped on Japan were of different designs (I think that the Hiroshima bomb was the same design as the land test version and the Nagasaki one was the untested design [so that if used, there would have been a tested design for the first drop]).

2 1

RE: Protecting the innocent on the nets
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

David rote: >If so, then using the dictionary as the key seems bad---the >compression dictionary is not designed to obscure the data, but to aid >in compression. The dictionary might well be easy to guess. For >example, some compression schemes use a Huffman coding on their >dictionary. If so, one can guess that short pointers into the >dictionary correspond to common plaintext strings. Using such a >dictionary as an encryption system is security through obscurity. Oh Heavens to Betsy, I was not trying to describe *crypto*, that might be regulated. Was describing a mechanism to comply with the new Scudderite laws concerning protecting the innocent from nasty sights. Figure it this way: can duplicate CD-Roms for a quarter. If a subscription costs $19.95/yr then who is going to bother with cloning it ? "controlled circulation" magazines would save postage. Web pages could be posted with nothing but pointers (don't tell me you have never sat waiting for a little red bar to reach the end) and assurance that only a specified audience could look at the pretty pictures (which compress the best of all 8*). Further, if the intent is to satisfy a law then would this not be a "good faith" attempt to do so ? Zippy's friends have decided what is not safe to be on the net in the clear but they have not said what it takes to protect the innocent while allowing consenting adults their freedom to communicate. If I want good crypto I just use PGP (and the Enclyptor makes it real easy). This is something completely different. Warmly, Padgett

1 0

Hey, we are quaint! (Was: A Sign of the Future)
by Bill.Humphries＠msn.fullfeed.com 17 Dec '03

17 Dec '03

Steve Levy replied to Alex Strasheim over an alledged 'plot' to discredit cypherpunks at Wired Magazine: >Give me a break. I do not work for Wired but I write for them at times, >and most often my subject is crypto related. [...] >On Mon, 5 Feb 1996, Alex Strasheim wrote [citing Gary Wolf 'channeling >McLuhan']: > >> > Concerns about privacy and anonymity are outdated. Cypherpunks >> > think they are rebels with a cause, but they are really senti- >> > mentalists. >> >> I'm not much for big conspiracy theories, but I like the little ones. <rant> Hey folks, we are quaint Jeffersonians for the most part here. We believe that reasoned arguement should carry the day instead of FUD (fear, uncertainty and doubt). And that privacy is a good thing. Whereas modern, marketing driven media (as described by McLuhan) will use FUD and whatever else it takes to deliver an audience. Ask any of the people who have been publicly tarred as Nazi's for their involvement over the Zundel/Hollow Earth/webcom business. Wolf's portrayal of McLuhan is spot on, because media producers who give a damn about anonymity and privacy aren't going to land the big contracts. The money to buy bandwidth and servers wants the highest quality data availiable so we can be coerced to spend every minute we aren't working, commuting, sleeping, or fornicating (was f*cking before the CDA) as 'consumers.' And many people aren't going to think of these issues, not because they are dumb, but because they are so busy working to provide for their families to spend any time in the reflective/meditative state required to make political choices. I suggest that Cypherpunks add one more slogan to their list: "Cypherpunks teach." Because no one is going to invest in the time and effort to use PGP, remailers, and blind web proxies unless they understand why they should. I'm going to invest in the time to show my family and friends why these technologies are important so when I mention PGP to someone they'll have something other than the soundbite "only Nazis use strong encryption" to fall back on. </rant> bill.humphries(a)msn.fullfeed.com "The more you know, the more jokes you get" -- Tompkins and Kaufman

2 1

Re: free speech and the government
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:25 PM 2/4/96 +0000, Stephan Mohr wrote: >Actually, I am glad that the whole story started over some neo-nazi stuff >and not a recipe to easily make a very potent poison. For some strange reason, people believe it is difficult to find information on such things. I picked up my copy of _Poisons and Poisoners_ by C. J. S. Thompson at Barnes and Noble in the discount section for $9.98. Books on the topic can also be picked up in bookstores catering to Murder Mystery fans. (Some excelent descriptions of esoteric poisons can be derived from these books.) "Forbidden" information is hard to forbid with the existance of the printing press. Electronic networks make the information even more available. Are you suggesting that we burn all the books with "dangerous" information? And who's definition of "danger" do we take? Yours? Mine? The National Council of Churches? Crypto relevence: Some people regard the ability to hide "dangerous" information to be as "dangerous" as the information hidden. Freedom of Speech includes the right to choose who can listen to that speech. Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ Is the operating system half NT or half full?

1 0