December 2003 - cypherpunks-legacy

Re: what's up with GROW?
by Robin Powell 18 Dec '03

18 Dec '03

>>>>> In article <199607101517.IAA19065(a)cygnus.com>, Michael Tiemann <tiemann(a)cygnus.com> writes: > I didn't post there specifically, but John Gilmore may have done so a > while ago. What specific problem are the cyberpunks trying to solve > that GROW would facilitate? Sorry, I've just recieved so much complete incompetence with this issue that talking to someone who was on the ball took some adjusting. Hope I wasn't too rude. One of the main issue on cypherpunks right now (Black Unicorn did a sort of "white paper" on it recently, as in two days ago) is integrating cryptography with other apps, in particular WWW apps. It just seemed to me that if the kind of exstensibility which Emacs is famous for was going to be a part of GROW, which apparently was the attention, this would be a Good Thing for cryptography integration. I good point in this direction is that the most popular way of using PGP with email is emacs-based (i.e. more people sign their posts to cypherpunks using Mailcrypt, the emacs-PGP interface, then all other signers combined, so it must be pretty easy to use). I've used it, and it's incredibly slick. I had hopes the GROW to go as far as emacs but with more network awareness. Oh well. This has been crossposted to cypherpunks, BTW. -Robin PS: You may want to go through and terf ALL the grow pages, not just some of them.

2 1

Re: MSoft crypto API's
by jim bell 18 Dec '03

18 Dec '03

At 04:51 AM 7/10/96 +0000, Deranged Mutant wrote: >On 9 Jul 96 at 20:34, jim bell wrote: >[..] >> Unexplained: What if the program Microsoft is asked to sign is not >> intended for export? Presumably, NSA has no authority, then, and thus > >They could insist on only signing exportable software, and in theory >use that as ITAR-relaxing leverage. > >Methinks it's a bad move to only have MS sign software... presumably >they won't outright refuse to sign competitors software. It would be >a conflict of interest for them not to... very usable as evidence >against MS in an anti-trust suit. Independent CA's would be better. Yes, that's the anti-trust vulnerability I mentioned. It is unclear if Microsoft could legitimately refuse to sign any software presented to it, regardless of its legal exportability. >IMO, it gives a false sense of sucurity to even require crypto apps >to be signed. A lot of folks would want a developer's kit (probably >cost $$$) to get around that requirement... nice loophole, BTW, for >those that can afford it. Or until somebody patches the code to >ignore bad signatures of lack of them and releases the patch. I'm sure that will happen! >> presumably Microsoft shouldn't be able to refuse to sign anything they're >> asked. > >Why? Assuming there were no export restrictions... if it's signed by >MS, people will take it to mean that MS is vouching for it. If they >sign a library that does 'naughty things' or is an incredibly >incompetant implementation of an algorithm, it could turn out to be >bad PR for them. (Hm... they could use this as an excuse to read >competitor's source code.) What MS would be signing for is the GENUINENESS of the software, not its effectiveness. Sorta analogous to key-signatures in PGP. Jim Bell jimbell(a)pacifier.com

1 0

NIST on PKI
by jya＠pipeline.com 18 Dec '03

18 Dec '03

Business Wire, 9 July 1996: Note To Editors: For more information on the NIST initiative, please refer to the NIST press release: "NIST, Industry Partners to Develop Specifications for Public Key Infrastructure," July 9, 1996. ---------- Certicom to Partner with NIST to Develop Specifications for a Public Key Infrastructure; Certicom signs agreement with NIST to contribute cryptographic expertise Toronto -- Certicom Corp. a leading information security company, today announced that it will participate in an initiative by the U.S. Commerce Department's National Institute of Standards and Technology (NIST) which will lead to the development of the elements of a public key infrastructure (PKI). A PKI will enable individuals and organizations who have never met to electronically send and receive documents which have been digitally signed. NIST announced today that it is partnering with several companies who bring specialized experience in providing products or services related to PKI components. "Certicom is excited about the establishment of this PKI project. It represents a proactive initiative by the Commerce Department to develop standards based on existing technology and commercial and government requirements by soliciting the active participation of key industry players," said Skip Hirsh, Director of U.S. Government Marketing for Certicom. "The strong leadership position taken by NIST will accelerate the deployment of practical public key infrastructures essential for the secure exchange of electronic data." "Certicom will contribute significant cryptographic experience to the partnership, particularly with the Elliptic Curve Cryptosystem (ECC) which is the most efficient public key technology available," commented Gary Hughes, president and CEO of Certicom. "ECC is a critical, enabling technology for this NIST project because of its efficiency in the high volume applications that are common in PKIs." ... Other partners that NIST has signed cooperative research and development agreements (CRADAs) with include: AT&T Government Markets, BBN Corp., Cylink Corp., DynCorp Information & Technology Inc., Information Resource Engineering Inc., Motorola, Northern Telecom Ltd. (Nortel), SPYRUS, Inc. and VeriSign, Inc. The goal of the partnership is to develop a minimum interoperability specification for the technical components of a PKI. The results will be shared with participating companies, the appropriate standards-making bodies, federal government agencies and industry organizations that are working on aspects of PKI development. A public key infrastructure relies on public key cryptography in which each user has a key pair consisting of a public and private key. The public key must be digitally signed by a central authority to ensure its authenticity. Digital signatures are cryptographic techniques which are used for data integrity, authentication and nonrepudiation. The process of digitally signing public keys is known as certification and is the main purpose of a public key infrastructure. Certicom expects to demonstrate the benefits ECC provides to large-scale PKIs in which numerous users are signing and verifying documents. Elliptic Curve Cryptosystems have the highest strength per bit of any known public key system, minimizing the requirement for large key sizes. Cryptographic processes based on ECC provide efficient computation techniques which reduce communications and computation time, thereby substantially reducing costs. Certicom is a developer of information security products and technologies and is the leader in Elliptic Curve Cryptosystems, the world's most efficient public key technology. The company specializes in applications where the combination of cryptographic strength and high efficiency are critical. Certicom's primary markets are in wireless, smart cards, banking and electronic commerce over the Internet. Visit Certicom's home page at www.certicom.ca. -----

1 0

RE: MSoft crypto API's
by geeman＠best.com 18 Dec '03

18 Dec '03

ok, last time: the deal was that Microsoft got the permission to ship a generalized API if the crypto-engines are signed to prevent code that conforms to export restrictions from being tampered with after the fact: hence the signing. This prevents code that is conformant from being patched, e.g. to turn a 40-bit key parameter into a usable one. Now I suppose it could be that there is a back-door deal that MSFT will provide to NSA info regarding the originators of the engines, but let's have some evidence of it before yet another conspiracy rant, OK? ---------- From: Black Unicorn[SMTP:unicorn@schloss.li] Sent: Tuesday, July 09, 1996 8:27 PM To: George Kuzmowycz Cc: cypherpunks(a)toad.com Subject: Re: MSoft crypto API's On Tue, 9 Jul 1996, George Kuzmowycz wrote: [...] > " Microsoft's Crypto APIs will be available to third-party vendors > writing applications with embedded security. But the hardware or > software Crypto-engines for these applications will need to be > digitally signed by Microsoft before they will work with the APIs. > Under an unusual arrangement with the NSA, Microsoft will act as a > front man for the powerful U.S. spy agency, checking on whether the > vendors' products comply with U.S. export rules." > > I was a bit surprised not to see any discussion of this here. Is it > just old news? Or maybe people here don't read Network World? [...] > An MS/NSA alliance? > > -gk- This is a very deft and sly move, if it was indeed planned, by the NSA. Clearly they have got the message. Political efforts to curtail crypto are doomed to failure. Economic strangulation is the way to go. Well here you are folks, months of bitching about how stupid the NSA must be has paid off. Not only is this clever, its insidious. 1. It's too difficult for Joe Sixpack to understand. 2. It preys on the market leader already, rather than attempting to bootstrap (as with clipper). 3. It uses as its implementation a private, rather than a public entity. Now this strikes me as something truely frightening. The NSA has become an intelligence agency which is effectively working in concert with private interests to conduct internal security operations by proxy.

1 0

Re: [RANT] Giving Mind Control Drugs to Children
by mike＠fionn.lbl.gov 18 Dec '03

18 Dec '03

On Jul 10, 12:29pm, JR(a)ns.cnb.uam.es wrote: > Maybe they would be better off fighting against a system that > alienates them than contributing to support it? Seems to me that's > shooting their own foot. Maybe, but consider that they are unable to focus properly on any activity. Revolution requires long term focus & unusually good organizational skills, both are weak in add types. On Jul 10, 8:13am, "Clay Olbon II" wrote: > or alcohol while pregnant or nursing. It is important to consider that any > drug used over a period of time may have lasting (possibly negative) > effects, and that these effects are multiplied when the drugs are taken by > still-developing children. It's a serious question, no doubt about it. > While it is crucial for an adult to be able to function and maintain a job, > is it really as important for a kid to be able to sit still in school? Well, for the add child, they don't get a proper education by any measure, no matter what their symptoms are, without some kind of treatment. This does not necessarily include drugs, of course, but some appear to benefit from it. For the class, a hyperactive student -- ONE -- is more than sufficient to bring the house down & make it impossible for the rest of the class to learn anything much of the time. As a taxpayer or parent with children in such a classroom you may find this a matter of some concern. On Jul 10, 8:37am, The Deviant wrote: > hrmm.. I'm certified ADHD, and I drink more than LD50 Caffeine in cokes > per day.... what does that make me? ;) Probably a good candidate for this year's tooth decay poster child %^)

2 1

Re: MSoft crypto API's
by jim bell 18 Dec '03

18 Dec '03

At this point, someone will probably claim that the export of a mere signature (or the XOR between a sig'd and a non-sig'd file) is, itself, prohibited from export under ITAR. However, I've pointed out in the past that even if that export is illegal, it could be done by an unknown "volunteer", possibly using means as innocuous as a paper envelope (with no return address?) mailed to a confederate outside the US. Later, it could be mailed back to the (foreign) company who wanted it in the first place. The foreign company would, of course, NOT be guilty of any export violation, because it had no part in the export, and it would just be a beneficiary of some (guilty) anonymous prankster's action. This tactic would not benefit a domestic, US manufacturer of crypto software, because it still would have to export thousands or even million of copies of that software. Also, another question occurred to me, today: Let's suppose a piece of software was written which is designed to run on a Microsoft API, IF SIGNED. If it isn't signed, it won't do anything. Does that mean that it's legal to export, since it can't actually do any encryption? If so, we may have the last laugh yet. At 11:45 PM 7/9/96 -0700, Mike Ingle wrote: >It's even easier than that. Remember, signatures are detachable from the >data. You import the software, MS signs it, you export the signature, and >reattach it to the software. > > Mike > >> Couldn't somebody IMPORT a piece of encryption software, have it signed by >> Microsoft, then take the XOR of the signed and unsigned software and export >> it? (It's not a tool capable of encryption...) >> >> Or: Microsoft presumably has foreign branches, or at least it could easily >> afford to set up one. What's to stop Microsoft from signing foreign >> encryption software outside of the US? The software is never exported >> (since it's already outside the country...), so there's no USA-law involv >> ement. >> Jim Bell >> jimbell(a)pacifier.com >> > > > > Jim Bell jimbell(a)pacifier.com

1 0

Re: MSoft crypto API's
by jim bell 18 Dec '03

18 Dec '03

At 01:04 PM 7/10/96 +0800, Enzo Michelangeli wrote: >> >> " Microsoft's Crypto APIs will be available to third-party vendors >> writing applications with embedded security. But the hardware or >> software Crypto-engines for these applications will need to be >> digitally signed by Microsoft before they will work with the APIs. >> Under an unusual arrangement with the NSA, Microsoft will act as a >> front man for the powerful U.S. spy agency, checking on whether the >> vendors' products comply with U.S. export rules." >More details are available from MS' web pages at: >http://www.microsoft.com/win32dev/apiext/capi4.htm >and: >http://www.microsoft.com/intdev/security/cryptapi.htm > >I understand that NSA may have accepted the arrangement because only >signed CSP's will be loaded under the CAPI, and MS will only sign them in >Redmond. So, strong CSP modules developed outside the US will not be useable >there because, once gone to Redmond, won't be re-exportable. However, see my commentary to Mike Ingle. If it's a foreign manufacturer we're talking about, then even though the export of the signed package might arguably be illegal, ONLY ONE copy of it needs to be exported, possibly by some anonymous person who has nothing to do with either company. The export will be illegal, but once exported any recipients would presumably be able to do anything they want with the program. >The interesting part is that the basic, but crippled, CSP (PROV_RSA_FULL) >will be supplied for free by MS: So they DIDN'T want their pieces of silver, huh? Jim Bell jimbell(a)pacifier.com

1 0

Re: [Poster] Add Uncle Sam to Your Circle of Friends and Family
by David Lesher 18 Dec '03

18 Dec '03

Michael Froomkin writes: : http://www.rsa.com/rsa/gallery/circle1.gif See the REST of that directory, also....... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: Mind-Altering Drugs
by tcmay＠got.net 18 Dec '03

18 Dec '03

At 3:48 PM 7/10/96, Asgaard wrote: >Thinking of T. Leary in memoriam I looked around for the >present psychedelic scene. Alta Vista sent me to where >'everything' seems to connect ... Santa Cruz, Ca. Guess where I live? Leary came to a Cypherpunks party, a little over a year ago, at the home of Doug Barnes. He was pretty frail-looking. I talked a bit to him, mostly about "Gravity's Rainbow." (Whose author lived anonymously near Santa Cruz, just over a ridge from me, for almost 10 years.) --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

[ANNOUNCE] - PGP library for Perl
by Gary Howland 18 Dec '03

18 Dec '03

PGP LIBRARY FOR PERL _________________________________________________________________ DESCRIPTION This library contains a suite of PGP modules for Perl. Many of the modules require the Systemics Cryptix 1.1 library. Although the library is quite usable, it is still a long way from being complete, and the interface subject to change. FEATURES This library contains the modules to do the following: * PGP ascii armouring * PGP conventional encryption * PGP public key encryption/decryption * PGP key generation, including vanity keys! Note - the current version cannot handle compressed data packets, does not handle signatures, and the key management is quite poor. The library can be downloaded from http://www.systemics.com/software/ Enjoy!

1 0