December 2003 - cypherpunks-legacy

Re: Java
by Clay Olbon II 17 Dec '03

17 Dec '03

Bill Frantz <frantz(a)netcom.com> wrote: >In the long run, I hope to use Java to sell cycles. Java has the advantage >in a cycle market that it is machine independent, and the Just In Time >compilers should make the performance reasonable. > Has anyone written a Java app to implement the Chinese Lottery? Seems like a natural way to do it. A small cash prize might entice lots of folks to let it run in the background... Clay --------------------------------------------------------------------------- Clay Olbon II | Clay.Olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: on web page Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 TANSTAAFL ---------------------------------------------------------------------------

1 0

(Fwd) Crypto conference
by jya＠pipeline.com 17 Dec '03

17 Dec '03

>----- Forwarded Cyberia-L message (DAVID POST <postd(a)EROLS.COM>) -----< I was at EPIC's annual crypto conference yesterday, and just thought I'd pass along my impressions. It was, as always, extremely interesting; EPIC does a terrific job at these things of getting a very diverse and thoughtful collection of people with interests in crypto policy into the room together, everyone from Whit Diffie and Phil Zimmermann and Eric Hughes to Scott Charney of DOJ and Bruce McConnell of the White House, people from the OECD and the hardware/software community, etc. There were panels on key escrow, digital cash, international developments, and the Karn/Bernstein cases and other domestic policy developments. To me, the most striking feature of the event was what I felt was a new bite to the complaints about export controls. People have been complaining, needless to say, about these for a while -- but the *economic* case for lifting controls is now in the forefront of the discussion in a way that was not the case before, imho. Indeed, there wasn't an enormous amount of talk about the *privacy* implications of encryption this time at all. Jim Bidzos of RSA gave a very powerful talk at lunch, at which he unveiled two chips that are now being mass produced by Nippon Telephone, one incorporating the Triple-DES algorithm, and one with the RSA public key algorithm. Someone else pointed to a recent story in the Economist, which listed the leading encryption software/services companies worldwide, each of which is Israeli. Bidzos made the claim, and many others echoed, that the export controls are in the process of doing nothing more than ceding a potentially lucrative market to others, a market in which the US might otherwise be expected to be the dominant player. It may even, in the eyes of some, be too late to undo this damage. Now, some of this may be exaggerated, special interest whining. But there's an interesting hook here. Many have talked about the importance of control over "standards " in network industries, the importance of obtaining an early dominant position in the market that can appropriate all of the network externalities waiting to be plucked out there. [Mark Lemley has an interesting discussion of this in a piece on antitrust on the Net -- Mark, is that out anywhere yet?] Acting quickly to penetrate the market becomes critical, not just because markets change on "Internet Time," but also because the early entrants have a chance of establishing themselves as de facto standards and thereby extending their dominance over time. This, one can plausibly argue, is what is happening -- has happened? -- in this market. It is more credible in these kinds of markets to argue, as Bidzos was arguing, that if government policymakers wait until there's actual evidence of damage, of "lost market share," to US companies, that it will at that point already be too late to do anything about the damage. ---------- [Second Cyberia-L message by David Post] One other interesting issue generated heated discussion -- as in yelling and screaming between audience and panel -- at the EPIC conference. Scott Charney of DOJ, who heads the US delegation to the OECD crypto guidelines conference, was subjected to pretty heated questioning about the possibility that the US is trying to use the international forum as a way to move a particular policy agenda that is *not* being successfully peddled at home, and then to use the international support as a means of moving the domestic policy debate in that direction. Jamie Boyle of AU was particularly eloquent about this concern (I raised it too, less eloquently) -- I think it fair to say that both of us had the copyright experience in the back of our minds, where, many of us believe, the US has been pushing the "Lehman agenda" in international discussions as a way of presenting Congress with a kind of fait accompli. Charney vigorously denied that this was going on -- he strongly argued that since the OECD guidelines are non-binding (unlike, say, the treaty obligations being discussed in the copyright context), there's simply nothing wrong with discussing these clearly global issues with our international partners. It was, as they say in the press, a spirited exchange. David ********************************* David G. Post, Georgetown University Law Center Postd(a)erols.com 202-364-5010 Cyberspace Law Institute home page http://www.cli.org ********************************* David ********************************* David G. Post, Georgetown University Law Center Postd(a)erols.com 202-364-5010 Cyberspace Law Institute home page http://www.cli.org *********************************

1 0

Cost of brute force decryption
by Bruce M. 17 Dec '03

17 Dec '03

Windows NT Magazine ran an article in their May 1996 issue titled "Secure Enterprise Email - How Safe is Your Mail System" that goes into matters of keeping company email private. PGP and other means of encryption are mentioned along with the following: "If you can ensure secrecy either until no one cares about the information or so that cracking the code costs more than the information is worth, it's 'secure enough.' "For example a 40-bit key takes about $10,000 worth of supercomputer time and two weeks to crack. Although this key may be adequate to protect my checking account, it's probably not large enough for the accounts of a major corporation. "A slightly longer key of 56 bits requres millions of dollars to crack and should protect the information for years to come. A 56-bit encryption key has 2^56-or 72 quadrillion-possible keys. With 1,000 computers, each trying 1,000,000 keys per second, trying them all would take 833 days. On average, you find the key halfway through your search. I was curious as to what type of formula was used to determine these figures since it wasn't mentioned in the article. Obviously, the speed of the computers, method of cracking and other such factors would be important to know. Could anyone shed some additional light on this for me? Thanks. Bruce M. * brucem(a)feist.com ~---------------------------------------------------~ "Knowledge enormous makes a god of me." -- John Keats

1 0

Asendmail yet again
by Ben Holiday 17 Dec '03

17 Dec '03

Ok so it isnt really and truely available. The right URL should have been: http://www.cyberpass.net/~ncognito If that still isn't right then im gonna assume that god is giving me a hint and go shoot myself in the head. Adios.

1 0

How to explain crypto?
by declan＠well.com 17 Dec '03

17 Dec '03

Brock, the crypto-challenged, humbly apologizes for his gaffe. He was looking for a way to draw an understandable comparison of how much harder a 1024-bit implementation of RSA is to break than what current export controls allow. He's asking for suggestions on how in future articles he could word this so a layman could understand it... Preferably something that could be said in a few sentences. (Brock cops to the fact that it does an incredible disservice to a complex topic. Remember, tho, he writes for a broad audience with a way diverse range of understanding -- or misunderstanding, as the case may be!) For example, someone sent me this explanation: "The 1024 bit key is likely an RSA key, and is not comperable to a 40 bit symetric key. From memory, 1024 bit RSA is about as hard to crack as 90 bit symetric." Is this a reasonable comparison? -Declan

3 2

Re: Java Crypto API questions
by jim bell 17 Dec '03

17 Dec '03

At 11:52 PM 6/3/96 -0700, Lucky Green wrote: >At 16:22 6/3/96, jim bell wrote: > >>A signature is just that: A signature. It doesn't encrypt or decrypt. It >>doesn't even ALLOW the system it's in to encrypt or decrypt, because there >>are numerous encryption programs written that have no need for such a >>signature. If no program existed which _used_ that signature, nobody would >>think twice about exporting it. >> >>The fact is, it is LEGAL to import encryption code into the US. It is LEGAL >>to generate an hash of that code, and it is LEGAL to export that hash. To >>believe otherwise is to broadly expand the scope of export laws far beyond >>what they were intended to mean. > >First, the ITAR are not laws, but regulations. Second, there are many that >believe that applying ITAR to crypto software is already expanding the >scope of the regulations far beyond what they were intended to mean. I agree. Which is why I think any acquiescence by Microsoft on the subject of exportability of signatures is wrong. Let the government press its case, if it wants to try. Don't assist it, even rhetorically. Jim Bell jimbell(a)pacifier.com

1 0

Re: NYT on NTT/RSA Chips
by jim bell 17 Dec '03

17 Dec '03

At 10:54 AM 6/4/96 GMT, John Young wrote: >Connecting Declan's three dots [...]: > The New York Times, June 4, 1996, pp. D1, D4. > Japanese Chips May Scramble U.S. Export Ban > By John Markoff > Washington, June 3 -- The Nippon Telegraph and Telephone > Corporation has quietly begun selling a powerful data- > scrambling chip set that is likely to undermine the Clinton > Administration's efforts to restrict the export of the > fundamental technology for protecting secrets and commerce > in the information age. > An executive at NTT America said that although there were > no restrictions on the export of cryptographic hardware or > software from Japan, his company was still anxious to > obtain software from RSA Data to use in its chips. That > software is still controlled by United States export law, > he said. Maybe it's just me, but the solution to NTT's problem is obvious. Even assuming that the export of this software would be against the law, why doesn't somebody simply violate that law? RSA would publish that software, possibly encrypted with NTT's public key, on a public system protected against direct export. "Somebody" would download it, write it to a floppy (taking care not to leave any fingerprints, and wetting both the stamp and the envelope with tap water, rather than licking them) and mail that floppy off to NTT in Japan. (Naturally, you don't put a return address on that envelope. The truly paranoid would first take that floppy to some store's PC section, and cross-load the data onto a floppy written by some other floppy drive.) NTT finds that envelope in their mail, opens it, reads the floppy, decrypts the data, and say, "Wow! It's the data we wanted to get!" It verifies that the data is valid by emailing a copy back to RSA in America, who say, "Amazing! Somebody has illegally exported our software!" As far as I know, there is nothing wrong with NTT using this software even if it is assumed to have been exported illegally. Obviously, NTT won't _ask_ for somebody to do this, because then the government will claim it was all a conspiracy, but that doesn't prevent NTT from being the beneficiary of somebody else's activities. Jim Bell jimbell(a)pacifier.com

2 1

Export what's imported
by jim bell 17 Dec '03

17 Dec '03

Recently, Senator Burns introduced that bill, S.1726, "ProCode." Part of it had to do with changes in the export laws to allow export of things that are currently not allowed. It occurs to me that this bill should be amended to say, explicitly, that any object or software which has ever been imported into the US can be legally exported. (Including multiple copies of software.) It is particularly important that we do this now that the NTT encryption chip set has been announced. Why? Well, first, we CAN easily justify this. The claim for export controls is that they restrict the access of encryption to various of the horsemen, out there. But by definition anything which has ever been imported is already available outside the US, so it'll look rather silly if they try to control somebody from export that came from out of the country. What are the benefits? Maybe it'll destroy the entire crypto-export-regulation system. Domestic software companies can simply set up a practice of buying all their crypto expertise from overseas. If this happened over the long term this would be bad, but it won't because within a couple of years good crypto will be exported by American manufacturers based on foreign designs. Pretty soon the export bans will become meaningless (even more so than they are today) and the pressure to remove the last restrictions will be enormous. Jim Bell jimbell(a)pacifier.com

1 0

Re: (VTW) BillWatch #48
by jim bell 17 Dec '03

17 Dec '03

At 10:17 AM 6/4/96 -0400, Carl Ellison wrote: >I was at the EPIC conference yesterday (6/3) -- where Whit Diffie, BTW, presented the same argument Steven Cherry gave in this BillWatch -- but at the end of the EPIC conference we had Scott Charney of DoJ on a panel about what the OECD is doing (pushing Clipper internationally) and we kept going round with him on the administration's pushing of Clipper (N). [One attendee described this as "forum shopping" -- looking for a friendly place to push Clipper.] > >There were people battling him over his alleged representation of the USA at the OECD -- claiming he was misrepresenting the country by pushing Clipper. His response was that the Executive is empowered to do all international meetings/negotiations/.... > >After the meeting ended it hit me what the problem is and I mentioned it to PRZ. We're complaining that the Executive has gone rogue -- is disobeying the will of the people. PRZ likened it to Nixon's war in Cambodia. I have a solution to that problem. Jim Bell jimbell(a)pacifier.com

1 0

Re: FOR WHOM THE BELL TOLLS
by jim bell 17 Dec '03

17 Dec '03

At 12:30 PM 6/4/96 -0700, Sandy Sandfort wrote: > Carl Ellison wrote: >>After the meeting ended it hit me what the problem is and I >>mentioned it to PRZ. We're complaining that the Executive >>has gone rogue -- is disobeying the will of the people. >>PRZ likened it to Nixon's war in Cambodia. > > Jim Bell replied: > >>I have a solution to that problem. > >My question for member of this list is: When Bell finally >goes too far and they arrest or shoot him, how can we best >capitalize on his martyrdom? Or in a more negative light, >what damage control will we need to do in that case? >Now I know that barking dogs rarely bite, but Jim may just >fool us and find his cajones. In any event, the sort of >yapping he is doing could itself be considered a crime that >could attract the sort of negative attention he apparently >craves. If there is any doubt that we _need_ a system to rid us of these sleazy politicians: I just saw tonight's PBS McNeil news hour, and they had two politicians on, one of which was promoting a re-emergence of the "Star Wars" missile defense system, which even under optimistic scenarios would cost hundreds of billions of dollars. My solution is simpler and far less expensive: Target any political or military person at any level who is directly or indirectly in control of any offensive missile system (nuclear or otherwise), killing off as many as it takes until they cry "uncle" and destroy all of that hardware. Probable cost of this persuasian? A few hundred million dollars, at most. Who is committing the crime, here? Maybe, someday, you'll start really LISTENING to what I have to say. ObCrypto? Your motivations are quite opaque. Maybe we can turn them into a cryptosystem? Jim Bell jimbell(a)pacifier.com

1 0