December 2003 - cypherpunks-legacy

Re: Bad news from Judge Richey
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:28 AM 3/26/96, jim bell wrote: >I realize that this may appear to be a rather disrespectful tactic, but have >you considered reminding the judge that if you are not allowed to profit by >exporting encryption that the government doesn't want to see exported, >you'll just have to make money in some other way, and this may lead you to >talk to Jim Bell about implementing a program using encryption that doesn't >_need_ to be exported...legally anyway. Whoahh! Hold on there, Jimbo! You're crossing the line. You're coming perilously close to actually calling for the killing of a federal judge. My recollection is that a couple of folks have been arrested and charged for calling for the killing of judges. You can skirt the issue by saying, in your "literal reading" mode, that you have not called for any such thing. However, we have read your "assassination politics" stuff ad nauseum, and it is clear from your language above that you are suggesting that this judge be made the target of one of your "betting pools." This is a plausible reading of your words. What may save your bacon, if any law enforcement or district attorney types are reading this, is that you are sort of the "neighborhood whacko" and your ramblings are unlikely to be acted upon by anyone, including yourself. Still, it does your "idea" no good to be talking about using your "assassination politics" scheme to have a judge whacked. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: ITAR double standards?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:13 AM 3/26/96, blanc wrote: >From: Timothy C. May > >I think there's been ample evidence that the ITARs are often used to harass >U.S. companies that "won't play ball," that refuse to go along with certain >governmental policies. (Part of the think we libertarians hate about Big >Government and Lots of Laws is that government can use selective >enforcement an another lever of power. As a felon, I am acutely aware of >this power.) >............................................................................ > >You're a felon? For real? > Yes. --Tim THE X-ON CONGRESS: INDECENT COMMENT ON AN INDECENT SUBJECT, by Steve Russell, American Reporter Correspondent....You motherfuckers in Congress have dropped over the edge of the earth this time... "the sorriest bunch of cocksuckers ever to sell out the First Amendment" or suggesting that "the only reason to run for Congress these days is to suck the lobbyists' dicks and fuck the people who sent you there," ....any more than I care for the language you shitheads have forced me to use in this essay...Let's talk about this fucking indecent language bullshit.

1 0

Re: LIST OF SHAME VOLUNTEERS
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:55 AM 3/25/96 -0500, "Declan B. McCullagh" <declan+(a)CMU.EDU> wrote: >Excerpts from internet.cypherpunks: 25-Mar-96 Re: LIST OF SHAME >VOLUNTEERS by Black Unicorn(a)schloss.li >> I did a little weekend poking, I can confirm this. If the Leahy bill >> passes, it will be a surprise (putting it mildly). > >Especially since there are only -- how many? -- 40 or 50 days left in >this legislative session. It might almost be nice to have the legislative session go out on a note of "We were working on a bill to re-emphasize the Constitutional right to private speech" rather than a note of "We came for the pornographers, and you narco-terrorist child-porn-hiding cryptographers* are next on our List**!" ...especially if it gives us some slack time to improve the (serious) weakness of the positive-sounding parts of the bill. Is Senator Leahy up for re-election this round? ==== content-downsized material follows ==== [**It's especially critical not to be Next on the List during the first few months of the Buchanan administration....] [*and your little dog, too!] ====== #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

FRE_mad
by John Young 17 Dec '03

17 Dec '03

3-27-96 NYT has two stories on the FBI siege of the Freemen tax protestors in Montana. One compares Waco and Ruby Ridge slaughter to this Freeh-mad cow prion. FRE_mad

1 0

WSJ on Big Java Flaw
by John Young 17 Dec '03

17 Dec '03

Wall Street Journal, March 26, 1996, p. B4. Researchers Find Big Security Flaw In Java Language By Don Clark A team of Princeton University researchers said they discovered the most serious security flaw yet in the widely used Java programming language from Sun Microsystems Inc. The flaw could make it possible for unscrupulous hackers to destroy files or cause other types of damage on any personal computer that uses Netscape Communications Corp.'s Navigator program, said Edward Felten, a Princeton assistant professor of computer science who helped discover the flaw. Netscape Navigator, which uses Java, is the most popular software for browsing the Internet's World Wide Web. Java enables the creation of tiny programs, called applets, that are transferred from a Web site on the Internet to a PC running Netscape Navigator. Mr. Felten said that unscrupulous people who discovered the flaw could boobytrap a Web page on the Internet, essentially seizing control of the browser software of any PC that tapped into that page. At that point, the hackers could read or delete an entire hard disk of data files. "The consequences of this flaw are as bad as they can be," he said. Sun, a computer maker based in Mountain View, Calif., acknowledged the problem. "This one is a serious bug," said Marianne Mueller, a senior Sun engineer specializing in security issues. The company, alerted by Princeton on Friday, is already testing a software fix it has developed for the program and hopes to distribute it to Netscape and other users in about two days. Those companies are then expected to distribute updated versions of their Web browsers or other products to users. "We plan to fix it and get it out to our customers as fast as we can," said Jeff Treuhaft, a Netscape product manager. Java was originally touted by Sun as a secure language. But at least two other flaws have already been discovered in the technology, including a less-serious problem uncovered by the Princeton team last month. Sun's Ms. Mueller said the problems have been correctable details in the way the Java code is written, not problems with its basic design. [End]

3 2

No Subject
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

At 12:21 AM 3/28/96, Syed Yusuf wrote: >If a person who speaks three languages is tri-lingual >If a person who speaks two languages is bi-lingual > >What do you call a person who only speaks one language? > >---------------------answer follows: > >An American. Or our version: What do you call a person who has to learn English as a second language in order to compete in the world? A foreigner. (Sorry for the insult, but it seems that this thread is bringing out insults from foreigners of all sorts.) --Tim Dont be sorry! Foreigner can atleast speak broken English. Can American speak broken foreign language?

1 0

Question about Blind Signature
by Chein-hsinLiu 17 Dec '03

17 Dec '03

Hi! I have some stupid question about how to implement blind signature. I Know it works as follows: If A wants B to sign X but donot know it is X, A can send X*PK(random) : PK is public key of B Then B signs on message: SK(X*PK(random)) ==> SK(X)*random Then A can obtain SK(X) by SK(X)*random/random My question is when I see how RSA encrypts using PKCS The PKCS block is like this 00 01 FF FF FF FF ... 00 input Then SK(00 01 FF FF FF .. 00 input) . If the input = X*PK(random) then SK(00 01 FF FF FF .. 00 X*PK(random)) will not produce SK(X)*random How to solve this?? Thanks!!

2 1

Re: Yeo, Pea-brained Imbecile
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"peponmc(a)fe3.rust.net" "Michael Peponis" 19-MAR-1996 10:17:59.06 >Given the plethera of reports like this, I will start maintaining a list of >country that will not be given access to my site, no FTP, no HTTP, no nothing, >on top of that, I will hard code into all the new versions of my network aware >programs to check for a domain subfix, if it is on of the black list, the >software will not function. I would suggest making an exception for material that the country in question _doesn't_ want available... you don't want to do their work for them. Of course, if that it's from a .gov-type site in that country (kind of hard to tell without the domain, but...), that's another story. >Filtering works both ways, they filter out the political and sex groups on >their end, we filter out the technical information on ours, I hope they enjoy >what is left, which is not much. This brings up the related topic of filtering mail lists the other way around. There have been times that I've wanted to email everyone on a mailing list _except_ one or two people. It's massively inconvenient to try to do this without automated software, for a large mailing list. Therefore, I'd be interested in majordomo/listserv/whatever modifications that would enable doing so. Of course, for anything significant having seperately encrypted messages to each person (as per that thread a bit back on encrypted mailing lists) would be necessary. -Allen

1 0

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 11:11 AM 3/26/96 -0500, Adam Shostack wrote: >Timothy C. May wrote: > >| My point is that I see no compelling legislation that is needed. If enough >| people in Washington really want increased length in _exported products_ >| (remember the "exported" part), the Congress and the President should find >| it easy enough to get said products on to the Approved List. (I note that >| the Leahy Bill really doesn't change this system anyway...some products go >| on the list, some don't...the law only seems to say that when the horse has >| already left the barn, i.e., when "comparable" products are already in >| fairly wide use outside the U.S., then the products should be put on the >| approved list. Big deal. > I'm forced to disagree on this point. I think that the >comparable product has the potential to be a very big deal; it means >that any product using IDEA or 3DES may become exportable, because >such products are available outside the US. > > It may be that wide use will be quibbled over, but DES, weak >as it is, is widely used outside the US, and IDEA and 3DES will be. >Thats why this legistlation will fail to pass. I think Tim already pointed out that the danger in this kind of conditional approval is that it would be used to restrict export of new _usages_ for cryptography based on their "political correctness" quotient, rather than simply on the basis of level of security (length of codes.) In other words, just because a program used 3DES or IDEA would not automatically make it exportable. This may sound pessimistic, but unfortunately pessimistic turns into "accurate" far too often. Far more acceptable (and useful to us) would be a rule which would mandate the government's allowing the export of any program that had, say, the key security provided by IDEA or less, regardless of what it did with that encryption. (Not that I want _any_ restrictions; it's just that such a limit would make it impractically large to attempt to crack.) Jim Bell jimbell(a)pacifier.com

1 0

Re: So, what crypto legislation (if any) is necessary?
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

At 4:11 PM 3/26/96, Adam Shostack wrote: >Timothy C. May wrote: > > I'm forced to disagree on this point. I think that the > >comparable product has the potential to be a very big deal; it means > >that any product using IDEA or 3DES may become exportable, because > >such products are available outside the US. > > I certainly don't disagree that if Leahy is passed, which is unlikely, then > conventional ciphers like 3DES will become exportable. (And I am forced to > add, "Big deal.") > > What I'm more interested in are not the ciphers which had their genesis in > the crypto work of the 70s, but in the new and exciting applications to > come. Things such as this list often discusses. I believe Leahy could stall > export of these new items until eventually there are offshore equivalents > of sufficiently wide deployment that the Leahy clause would get invoked. On the ITAR issue, and whether this is a big deal for someone living in the US, it seems to me that the major annoyance of ITAR is that it slows down development, and commercial uptake of crypto because the internet is a worldwide market place. ie I would have thought that getting rid of ITAR would be beneficial to internet commerce in general, and likely advance uptake of electronic cash (by several years?) For whatever reasons (best known to themselves) even big fish like netscape, and microsoft don't seem to have any stomach for taking on the USG in any meaningful way over the issue. I'd view widely deployed electronic cash to be a step in the right direction opening the way for more interesting crypto applications. What's your analysis on this? Do you think I am over-rating the negative effects of ITAR on furtherment of electronic cash? What say about electronic cash as a catalyst for uptake of other crypto applications? (my use of "electronic cash" above refers to payee and payer anonymous, not electronic cheques or credit card transactions over the internet) Adam

1 0