December 2003 - cypherpunks-legacy

Article on CAs in WebWeek
by olbon＠dynetics.com 17 Dec '03

17 Dec '03

An article on the front page of WebWeek this week discusses digital signatures and CAs. The best point made was that a small company could undercut (pricewise) the post office as a CA. Overall it seemed a pretty fair article. It mentioned UC Berkeley researchers "spoofing" a Netscape server's identity and sending false data to the client. This was news to me, I am curious as to how this was done. The paper article also listed as a "resource on the net" the URL for Tim May's cyphernomicon. Here's the link. Enjoy. Article: Big Step Forward For Authentication URL: http://pubs.iworld.com/ww-online/96Feb/news/authentication.html Clay --------------------------------------------------------------------------- Clay Olbon II | olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: finger olbon(a)mgr.dynetics.com Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 "To escape the evil curse, you must quote a bible verse; thou shalt not ... Doooh" - Homer (Simpson, not the other one) ---------------------------------------------------------------------------

1 0

RSA-China Crypto
by John Young 17 Dec '03

17 Dec '03

Wall Street Journal, February 8, 1996, p. A10. China, U.S. Firm Challenge U.S. On Encryption-Software Exports By Don Clark RSA Data Security Inc., the dominant supplier of data-privacy software, announced an unusual partnership with the Chinese government that exploits loopholes in U.S. export restrictions on codemaking technology. As part of the deal, RSA, which is based in Redwood City, Calif., plans to fund an effort by Chinese government scientists to develop new encryption software. The Chinese-developed software, based on RSA's general mathematical formula, may be more powerful than versions now permitted for export under U.S. Iaws, said James Bidzos, RSA's president. Two Chinese agencies also will use and distribute RSA data encryption products that may be legally exported from the U.S. The Chinese encryption-development arrangement, which isn't based on those products, appears to be legal as long as RSA doesn't supply the scientists with any other controlled technology, lawyers familiar with export laws said. RSA's move comes at a sensitive time in U.S.-China relations, and opens a new front in the company's long-running campaign against encryption export regulations. The closely held company, and other U.S. software concerns, have attacked the Clinton administration and the National Security Agency for trying to limit the strength of exported U.S. technology, while stronger products increasingly can be purchased from competing foreign companies. "The government has opened export doors a crack, and we sort of drove a Mack truck through them," Mr. Bidzos said of the Chinese deal. "The genie is truly out of the bottle." Stewart Baker, a Washington lawyer and former general counsel of the NSA, said the government "obviously would not be thrilled" by RSA's China venture. China hasn't in the past been party to international agreements governing encryption exports, he noted, and RSA's move could force other countries to consider China as an important player. "It's going to create an interesting strain in the international discussion," he said. Japan, an even more potent force in technology, appears to be leaning toward loosening export controls on encryption, Mr. Baker and other industry executives say. RSA plans to announce the formation of a new company in Japan today, but the venture will be subject to U.S. export controls, Mr. Bidzos said. Encryption uses special mathematical formulas, called algorithms, to scramble voice conversations or data to make them unintelligible to eavesdroppers. RSA's founders developed a popular variant of the technology that helps determine the authenticity of senders and recipients of messages. Both privacy and authentication are widely regarded as crucial to advances in electronic commerce. RSA struck its deal with departments of China's Ministry of Foreign Trade and Economic Cooperation, and the Academy of Sciences. They will use two RSA software products -- one for authentication and one for protecting the contents of PC hard drives -- internally and help distribute them. The Academy scientists who will develop new encryption software also will be paid to try to break RSA's products to test their strength, Mr. Bidzos said. A spokesman at the Commerce Department's bureau of export administration said he was unaware of RSA's China venture, but said the agency would be monitoring developments. Mr. Baker, the former NSA attorney, questioned whether customers in other countries would warm to the idea of Chinese-developed encryption software. Products approved by the U.S. government for export have the stigma that NSA can decode, and Chinese products might be subject to even more suspicion, Mr. Baker said. Still, the RSA deal is likely to be seen as further evidence of slipping U.S. control over encryption. "It is another example of what happens when you try to impose unilateral controls on what is in reality uncontrollable technology," said Bruce Heiman, an outside attorney for the Business Software Alliance. [End]

1 0

e$: Paint it Black
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- As strange as my politics are ;-), I've never been one for political protests, at least not since I graduated college and grew up. However, it seems that I've done enough protesting for silly causes in my youth to excuse me for doing one small thing about something I still *do* believe in, the freedom to talk about what you want without the threat of someone hauling you off to jail. With that in mind, I'm joining the EFF, VTW, and thousands of other web sites across the world today and making the e$ Home Page black for 48 hours. I'm hoping that others out there will join me in making Black Thursday as memorable as they can for the people who think that censoring the net is even possible, much less conscionable. "The net sees censorship as damage, and routes around it." -- John Gilmore Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRoPsPgyLN8bw6ZVAQE0rwP+LZu5yNwabfBCyTjjnez5/VooUA5f6zkf gTFKHWDelSZS1RZ8ynoOzYSDJ7KzKQDEvETmeY59VTVODKR0brrDwwwbconFCaCm wEcjuhwPpw3jECMPpFNc0NFAdC4h3uoiG8sBY3Da6RZlEVkxgvj0XDweslbcPC/x 6Kkiy6oUJd4= =F1Vn -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Archives back on line
by Leslie Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The cypherpunks archives are back to being updated regularly. I apologize for the lapse (and repeat my lament on the quality -- or lack thereof -- of hypermail). The URL: http://www.hks.net/cpunks/ - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRoV3yoZzwIn1bdtAQFlWAF9Ev0ihCGbT6JOGXlKgtrI+ZOk8wmJxnVK NQNsP6J1Td1/2ui3Q8JL3dkhqYwOLHPF =ZBO0 -----END PGP SIGNATURE-----

1 0

Re: Report available: "Minimal Key Lengths for Symmetric Ciphers"
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

I downloaded this so-called "report". It doesn't even mentions PGP. Gotta wonder why the 007 wannabe "experts" and the Big Business (BSA) want you to only use 90 bits for your keys and why they've never heard of PGP... Anyone who listens to crypto advice from people who's purpose in life is to listen to *YOU* gets what they deserve. I'll stay with PGP which has a 2048 bit key. JustWalT

4 3

Re: Arthur C. Clarke Supports Strong Crypto
by avatar＠mindspring.com 17 Dec '03

17 Dec '03

At 09:06 PM 2/4/96 -0800, you wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >At 08:05 PM 2/4/96 -0800, Timothy C. May wrote: >> >>(Pardon me for mentioning crypto...) >> >>Arthur C. Clarke, known to most of you (author of many SF works, coiner of >>the phrase: "all sufficiently advanced technlogies are indistinguishable >>from magic," mention by Alan Olsen yesterday), has a role in a "Discovery >>Channel" program called "Mysterious Universe." > >Actually, it was _I_ who mentioned this quote, but didn't specifically >recall whom to ascribe it to. Perhaps Tim May didn't see it; a week or so >ago May engaged in a shotgun-type killfile addition, including me when I was >merely ( I still believe...) the victim in a local flamewar. If there is >somebody out there who: > >1. Is on speaking terms with Tim May. >and >2. Has a little respect for my commentary, I would very much appreciate it >if you would forward this comment to him to ensure that he sees it. > >The truly ironic thing is that Tim wrongly ascribes the comment to Alan >Olsen, who is apparently the (recently admitted) perpetrator of at least one >flamewar >against me. > >Jim Bell >jimbell(a)pacifier.com > GROW UP!! Charles Donald Smith Jr. ||The government is my shepherd I need not work. It alloweth me to lie down on a good job. It leadeth me beside stilled factories. It destroyeth my initiative. It leadeth me in the path of a parasite for politics sake. YEA, though I walk through the valley of laziness and deficet spending I shall fear no evil, for the government is with me. It prepareth an economic utopia for me by appropriating the earnings of my grandchildren. It filleth my head with false security. My inefficiency runeth over. Surely, the government should care for me all the days of my life, and I will dwell in a fools paradise forever.................AMEN! || nuke'm if ya got'em||

1 0

Escrow Key Testimony: Witnesses Wanted
by Declan B. McCullagh 17 Dec '03

17 Dec '03

>From Robert Steele: The staff of the Commission on Protecting and Reducing Government Secrecy (primary sponsor is Senator Moynihan from New York) is looking for individuals able to provide authoritative testimony for or against the escrow key concept as it applies to the effectiveness of law enforcement. I suppose this is grand-son of Clipper, but it is a serious aspect of their over-all mandate, and probably a good idea to help them. I recommend direct contact to the deptuy staff director, Jacques Rondeau, whose email address is <fastermover(a)ichange.com>.

1 0

Re: Encryption and Backups
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 08:33 PM 2/4/96 -0800, John Pettitt wrote: > CP Backup (part of PC Tools for Central Point aka Symantec) has DES. As to > how good the implementation is: I have no idea. Broken: I worked on that (well I attended meetings on the implementation of that). It will keep out the average kid sister. Better than rot 13. I protested vociferously, saying that such encryption verged on fraud, and my boss overruled me without explanation or discussion -- odd behavior for him. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Media: FV story makes ClariNet
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

>SAN DIEGO, CALIFORNIA, U.S.A., 1996 FEB 7 (NB) -- First Virtual Holdings, >a company offering an Internet commerce system, has demonstrated a >program which, it says, makes all existing software systems that >encrypt credit card numbers and transmit them over the Internet >vulnerable to security breaches. ... _______________________ Regards, Talent develops in tranquillity, character in the full current of human life. -Goethe Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

Mailing list
by JOHN MARTIN LEWARS 17 Dec '03

17 Dec '03

Hey hey, Please make me apart of your mailing list. Thanks, jack

2 1