December 2003 - cypherpunks-legacy

Re: Bernstein case decisision (fwd)
by Michael Froomkin 17 Dec '03

17 Dec '03

reposted with permission. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) ---------- Forwarded message ---------- Date: Wed, 17 Apr 1996 05:23:47 -0400 >From: Mike Godwin <mnemonic(a)well.com> To: Multiple recipients of list <cyberia-l(a)warthog.cc.wm.edu> Subject: Re: Bernstein case decisision [...] The following summary is from my colleague Shari Steele: What Judge Patel said. First, the judge ruled that Bernstein could bring his case even though the Arms Export Control Act specifically precludes judicial review, because what we are asking the judge to review (i.e., the constitutionality of the statute and its regulations) was not what had been precluded (i.e., the government's determination in a particular instance whether or not something was exportable). "With respect to constitutional questions, the judicial branch not only possesses the requisite expertise to adjudicate these issues, it is also the best and final interpreter of them." Next, the judge determined that only the source code was at issue here, not Bernstein's academic paper describing the source code. Bernstein tried to get the government to rule separately on the paper and the code back in 1993 by filing separate CJ requests. The State Department merged the requests and rejected them all. On June 29, 1995, after we filed this suit, the government sent Dan a letter saying that the paper could be published and never had been forbidden. While Judge Patel claimed that the issue of the paper now appeared to be moot, she commented, "It is disquieting than an item defendants now contend could not be subject to regulation was apparently categorized as a defense article and subject to licensing for nearly two years, and was only reclassified after plaintiff initiated this action." Finally, the key ruling in the case. "This court can find no meaningful difference between computer language, particularly high-level languages as defined above, and German or French....Like music and mathematical equations, computer language is just that, language, and it communicates information either to a computer or to those who can read it....Thus, even if Snuffle source code, which is easily compiled into object code for the computer to read and easily used for encryption, is essentially functional, that does not remove it from the realm of speech....For the purposes of First Amendment analysis, this court finds that source code is speech." This is the first time that we know of that a court has ruled that source code is speech for First Amendment analysis. This is a Big Deal - a very important precedent. The judge drew an analogy to copyright law, which treats computer software as a "literary work" and offers it copyright protection, to help her come to her conclusion. The judge, therefore, did not throw out any of our claims (the ITAR acts as a prior restraint on speech, the ITAR is overbroad, and the ITAR is vague). She looked at each of them one by one and determined that each of them had merit. What this decision means. Most directly, it means that we can continue on with our lawsuit. The government had brought a motion to dismiss the case, contending that the court lacked jurisdiction to hear this matter because it was a matter of national security. The judge struck that down and said that we can go forward with our suit. More indirectly, the judge's ruling sets the stage for us winning at trial. She clearly "gets it," and isn't intimidated by the government's use of precedential cases that aren't on point.

1 0

RE: COQ_tal
by Matt Thomlinson 17 Dec '03

17 Dec '03

damn, that's the second time I've done that this week! dang 'R' key.. apologies, mattt >

1 0

COQ_tal
by Matt Thomlinson 17 Dec '03

17 Dec '03

1 0

Re: Protocols at the Point of a Gun
by Henry Huang 17 Dec '03

17 Dec '03

On Apr 16, 16:22, Steve Reid wrote: > Security classification and "decent/indecent" ratings are rather > different, IMHO. With security, the author of the data has to decide the > best rating for his/her own security. With decent/indecent filtering, the > author has to decide what is best for _other_people_. I suppose it's not > as bad as that with the third-party ratings in PICS, but there will still > be inconsistancies. "As bad"?!? Actually, it's a good deal worse. See below. > The main reason I think decent/indecent filtering should be done at the > application level is, if they create a ratings system and later decide > that they've screwed up and another system would be better (which is quite > possible, if you understand the previous paragraph), all that's really > required is re-writing the application software. OTOH, if they did it at > the transport layer and later decided to switch to something else, they > would have to change the protocol, which is very difficult. And, depending > on the changes, they may have to re-write the apps again anyways. > > Also, at the application layer, ANYONE could create their own ratings > system, and the market could decide which is best. (The downside of that > is that there would be nonstandardized chaos for a while). Well good. Better nonstandardized chaos than a single, arbitrarily defined and applied system. (Ref: "Parental Advisory" stickers, which were IMHO totally useless, and a doomed concept from the start.) I think that if there's going to be ratings, better to have lots of different organizations reflecting different tastes and mores than one organization reflecting political pressures and prejudices. (No real crypto relevance in the concept per say, but perhaps in the application (as Bill pointed out with the PICS excerpt).) -H

1 0

COQ_tal
by John Young 17 Dec '03

17 Dec '03

4-17-96. Fint: "When rocket scientists crash out of orbit." Barry Riley essays on the impact of physicists and mathematicians on finance and economics, while reporting on a recent article by three physicists critiquing the shortcomings of the Black-Scholes formula for pricing options. The Bouchaud-Iori-Sornette formula for "real world" options attempts to minimise these residual risks, especially by applying a more sophisticated mathematical treatment to the "tails" of the distribution. If the risks cannot be hedged out, at least they can be reduced via diversification. A bracing cocktail for the recent cpunks bar-slappers on funny-money and unscriving and eye-grit quackers. COQ_tal

1 0

Re: why compression doesn't perfectly even out entropy
by rick hoselton 17 Dec '03

17 Dec '03

At 08:12 PM 4/16/96 -0400, Perry E. Metzger wrote: >> Are you sure you want to claim that the text of Hamlet would make >> a good key for a one-time pad? ... much deleted .... >It is far, far more probable for the cryptanalyst, thinking the >key was "Hamlet", to get out a plausible but totally bogus text, than >it is for the key to actually be "Hamlet". I can agree with this. >Of course, it is also far, >far more probable for you to be stupid than for a random number >generator to put out "Hamlet". I agree here too. I've been stupid many times, but I never expect to see a fair random number generator produce Hamlet. (I should live so long!) >but if you go around getting rid of >RNGs that produce "Hamlet" or anything close, you have in theory given >information to the attacker that gives them a slightly better chance >of attacking you since your pads are no longer purely random. And I could agree with this too, except that cryptanalysts do not consider every string to be equally likely. If they did, they would never even bother to look at XORing a bitstream with ciphertext to produce plaintext. >The reason all this isn't stupid to discuss and actually has some >importance is just this fact. If you build a system that discards >things that "don't look like they have enough entropy" (which certain >people around here have proposed), you are giving the cryptanalyst a >very strong piece of information about the key, so your key is no >longer totally unpredictable. This is true. But it is also unavoidable. Actually, I'm pleased to give up one-percent of my keyspace, if that's the one-percent that an analyst will check first. Another example: What if I selected a nonsense passphrase, "Dagmar shaved Howard's cocker spaniel" Not great, but adequate for my needs. If, by some wild coindence, a book by that title became a best seller, I would change my passphrase. A cryptanalyst who knew that was my feeling could simplify his cracking by not bothering to search for best selling book titles. On the other hand, a cryptanalyst who was not so convinced of my paranoia, and who DID check book titles, would not find my passphrase. I assume that BOTH philosophies would be used in a serious attack. When I do the math, it says that, assuming BOTH types of attack are done, it is better to have a passphrase that is not the title of a book. >An irony, but something important to >keep in mind. Every once in a while (once in every four billion bits, >or so) your random number generator will put out 32 1's in a row if it >is functioning properly. Agreed. And if that produces a "weak key" for your cipher, you'll get broken. >Any given small segment of the output of a >good RNG might not look "random", but "random" isn't a property of a >given number -- it is the property of the infinite sequence itself. I agree here too. But the analyst doesn't see the infinite sequence, only the number itself. I am enjoying this discussion, but I feel like I'm running out of useful new ways to try to express this idea. If I don't reply, it doesn't mean you have convinced me. :)

3 2

Re: Clinton blathering about Internet terror
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"m5(a)vail.tivoli.com" "Mike McNally" 17-APR-1996 11:19:57.56 >Subject: Clinton blathering about Internet terror >See http://www.yahoo.com/headlines/960417/news/stories/internet_1.html. Also at http://www.nando.net/newsroom/ntn/info/041796/info11_8930.html. The listing of sites outside of the US might encourage people to realize that this information can't be stopped. -Allen

1 0

Clinton worried books may help arm terrorists
by tcmay＠got.net 17 Dec '03

17 Dec '03

Roiters, 4/17/96: Clinton worried books may help arm terrorists TOKYO, April 17 (Roiter) - U.S. President Bill Clinton said on Wednesday he was worried that books are aiding international terrorism by making it too easy for sinister forces to learn how to make bombs or produce nerve gas. "Are people learning, for example, from reading how to make the same sort of trouble in the United States that was made in Japan with sarin gas?" Clinton said at a news conference with Japanese Prime Minister Ryutaro Hashimoto in Tokyo. "Isn't it a concern that anybody, anywhere in the world, can find books and encyclopedia articles about how to build a bomb like the bomb that blew up the Federal Building in Oklahoma City?" he added. Clinton said Japan and the United States, both victims of home-grown terrorism last year, should learn from each other about how to deal with the dangerous issue of unauthorized reading. >From Tokyo, President Clinton is to fly to North Korea to discuss North Korea's successful campaign to limit access to books and reading.

1 0

Re: why compression doesn't perfectly even out entropy
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-04-16 15:51:46 EDT, Perry Metzger writes: >There is no reason you can't have a string of 20 1 bits in >a row in a perfectly random sequence, for example. Usually, random >sequences are non-compressable, but it is possible (though very >improbable) for Hamlet to appear out of a random number generator, >and it is of course quite compressable... Of course, if that happened, the odds of it happening from a Trojan Horse or other type of attack are overwhelming...

1 0

Re: No Subject
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-04-17 02:35:51 EDT, you write: >Knowledge about TCP/IP is alot easier to control than knowledge about the >Berlin Wall (ie, how many Chinese will even know of the existence of TCP/IP >-- in the US, where this is freely available, how many citizens know of it's >existence)? I bet this would change if people saw knowledge of TCP/IP as the "key to the Berlin Wall."

1 0