December 2003 - cypherpunks-legacy

RE: MSoft crypto API's
by geeman＠best.com 17 Dec '03

17 Dec '03

ok, last time: the deal was that Microsoft got the permission to ship a generalized API if the crypto-engines are signed to prevent code that conforms to export restrictions from being tampered with after the fact: hence the signing. This prevents code that is conformant from being patched, e.g. to turn a 40-bit key parameter into a usable one. Now I suppose it could be that there is a back-door deal that MSFT will provide to NSA info regarding the originators of the engines, but let's have some evidence of it before yet another conspiracy rant, OK? ---------- From: Black Unicorn[SMTP:unicorn@schloss.li] Sent: Tuesday, July 09, 1996 8:27 PM To: George Kuzmowycz Cc: cypherpunks(a)toad.com Subject: Re: MSoft crypto API's On Tue, 9 Jul 1996, George Kuzmowycz wrote: [...] > " Microsoft's Crypto APIs will be available to third-party vendors > writing applications with embedded security. But the hardware or > software Crypto-engines for these applications will need to be > digitally signed by Microsoft before they will work with the APIs. > Under an unusual arrangement with the NSA, Microsoft will act as a > front man for the powerful U.S. spy agency, checking on whether the > vendors' products comply with U.S. export rules." > > I was a bit surprised not to see any discussion of this here. Is it > just old news? Or maybe people here don't read Network World? [...] > An MS/NSA alliance? > > -gk- This is a very deft and sly move, if it was indeed planned, by the NSA. Clearly they have got the message. Political efforts to curtail crypto are doomed to failure. Economic strangulation is the way to go. Well here you are folks, months of bitching about how stupid the NSA must be has paid off. Not only is this clever, its insidious. 1. It's too difficult for Joe Sixpack to understand. 2. It preys on the market leader already, rather than attempting to bootstrap (as with clipper). 3. It uses as its implementation a private, rather than a public entity. Now this strikes me as something truely frightening. The NSA has become an intelligence agency which is effectively working in concert with private interests to conduct internal security operations by proxy.

1 0

Re: [RANT] Giving Mind Control Drugs to Children
by mike＠fionn.lbl.gov 17 Dec '03

17 Dec '03

On Jul 10, 12:29pm, JR(a)ns.cnb.uam.es wrote: > Maybe they would be better off fighting against a system that > alienates them than contributing to support it? Seems to me that's > shooting their own foot. Maybe, but consider that they are unable to focus properly on any activity. Revolution requires long term focus & unusually good organizational skills, both are weak in add types. On Jul 10, 8:13am, "Clay Olbon II" wrote: > or alcohol while pregnant or nursing. It is important to consider that any > drug used over a period of time may have lasting (possibly negative) > effects, and that these effects are multiplied when the drugs are taken by > still-developing children. It's a serious question, no doubt about it. > While it is crucial for an adult to be able to function and maintain a job, > is it really as important for a kid to be able to sit still in school? Well, for the add child, they don't get a proper education by any measure, no matter what their symptoms are, without some kind of treatment. This does not necessarily include drugs, of course, but some appear to benefit from it. For the class, a hyperactive student -- ONE -- is more than sufficient to bring the house down & make it impossible for the rest of the class to learn anything much of the time. As a taxpayer or parent with children in such a classroom you may find this a matter of some concern. On Jul 10, 8:37am, The Deviant wrote: > hrmm.. I'm certified ADHD, and I drink more than LD50 Caffeine in cokes > per day.... what does that make me? ;) Probably a good candidate for this year's tooth decay poster child %^)

2 1

Re: MSoft crypto API's
by jim bell 17 Dec '03

17 Dec '03

At this point, someone will probably claim that the export of a mere signature (or the XOR between a sig'd and a non-sig'd file) is, itself, prohibited from export under ITAR. However, I've pointed out in the past that even if that export is illegal, it could be done by an unknown "volunteer", possibly using means as innocuous as a paper envelope (with no return address?) mailed to a confederate outside the US. Later, it could be mailed back to the (foreign) company who wanted it in the first place. The foreign company would, of course, NOT be guilty of any export violation, because it had no part in the export, and it would just be a beneficiary of some (guilty) anonymous prankster's action. This tactic would not benefit a domestic, US manufacturer of crypto software, because it still would have to export thousands or even million of copies of that software. Also, another question occurred to me, today: Let's suppose a piece of software was written which is designed to run on a Microsoft API, IF SIGNED. If it isn't signed, it won't do anything. Does that mean that it's legal to export, since it can't actually do any encryption? If so, we may have the last laugh yet. At 11:45 PM 7/9/96 -0700, Mike Ingle wrote: >It's even easier than that. Remember, signatures are detachable from the >data. You import the software, MS signs it, you export the signature, and >reattach it to the software. > > Mike > >> Couldn't somebody IMPORT a piece of encryption software, have it signed by >> Microsoft, then take the XOR of the signed and unsigned software and export >> it? (It's not a tool capable of encryption...) >> >> Or: Microsoft presumably has foreign branches, or at least it could easily >> afford to set up one. What's to stop Microsoft from signing foreign >> encryption software outside of the US? The software is never exported >> (since it's already outside the country...), so there's no USA-law involv >> ement. >> Jim Bell >> jimbell(a)pacifier.com >> > > > > Jim Bell jimbell(a)pacifier.com

1 0

Re: MSoft crypto API's
by jim bell 17 Dec '03

17 Dec '03

At 01:04 PM 7/10/96 +0800, Enzo Michelangeli wrote: >> >> " Microsoft's Crypto APIs will be available to third-party vendors >> writing applications with embedded security. But the hardware or >> software Crypto-engines for these applications will need to be >> digitally signed by Microsoft before they will work with the APIs. >> Under an unusual arrangement with the NSA, Microsoft will act as a >> front man for the powerful U.S. spy agency, checking on whether the >> vendors' products comply with U.S. export rules." >More details are available from MS' web pages at: >http://www.microsoft.com/win32dev/apiext/capi4.htm >and: >http://www.microsoft.com/intdev/security/cryptapi.htm > >I understand that NSA may have accepted the arrangement because only >signed CSP's will be loaded under the CAPI, and MS will only sign them in >Redmond. So, strong CSP modules developed outside the US will not be useable >there because, once gone to Redmond, won't be re-exportable. However, see my commentary to Mike Ingle. If it's a foreign manufacturer we're talking about, then even though the export of the signed package might arguably be illegal, ONLY ONE copy of it needs to be exported, possibly by some anonymous person who has nothing to do with either company. The export will be illegal, but once exported any recipients would presumably be able to do anything they want with the program. >The interesting part is that the basic, but crippled, CSP (PROV_RSA_FULL) >will be supplied for free by MS: So they DIDN'T want their pieces of silver, huh? Jim Bell jimbell(a)pacifier.com

1 0

Re: [Poster] Add Uncle Sam to Your Circle of Friends and Family
by David Lesher 17 Dec '03

17 Dec '03

Michael Froomkin writes: : http://www.rsa.com/rsa/gallery/circle1.gif See the REST of that directory, also....... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: Mind-Altering Drugs
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:48 PM 7/10/96, Asgaard wrote: >Thinking of T. Leary in memoriam I looked around for the >present psychedelic scene. Alta Vista sent me to where >'everything' seems to connect ... Santa Cruz, Ca. Guess where I live? Leary came to a Cypherpunks party, a little over a year ago, at the home of Doug Barnes. He was pretty frail-looking. I talked a bit to him, mostly about "Gravity's Rainbow." (Whose author lived anonymously near Santa Cruz, just over a ridge from me, for almost 10 years.) --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

[ANNOUNCE] - PGP library for Perl
by Gary Howland 17 Dec '03

17 Dec '03

PGP LIBRARY FOR PERL _________________________________________________________________ DESCRIPTION This library contains a suite of PGP modules for Perl. Many of the modules require the Systemics Cryptix 1.1 library. Although the library is quite usable, it is still a long way from being complete, and the interface subject to change. FEATURES This library contains the modules to do the following: * PGP ascii armouring * PGP conventional encryption * PGP public key encryption/decryption * PGP key generation, including vanity keys! Note - the current version cannot handle compressed data packets, does not handle signatures, and the key management is quite poor. The library can be downloaded from http://www.systemics.com/software/ Enjoy!

1 0

July Freedom Forum Meeting
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 09 Jul 1996 17:48:35 -0500 From: Jack Shimek <jshimek(a)jaqboot.mv.com> MIME-Version: 1.0 To: <very big snip...> Subject: July Freedom Forum Meeting ******** FREEDOM FORUM ******* July Meeting Announcement ********************************** July 15, 1996, 7-9 PM, Newbridge Cafe, Nashua, New Hampshire E$ ---- Electronic Money and Commerce Robert Hettinga, Digital Commerce Society of Boston --------------------------------------- Banks have been doing "electronic funds transfers" for years, and now ATM transactions have skyrocketed, due to their convenience. What happens when you can take complete control by saving your e-money right in your own personal computer's hard drive? Will there be competing e-currencies? Will transactions become invisible? The internet and new encryption techniques make the possibilities absolutely enthralling. Hear Bob Hettinga explore all the technologies and possibilities at the July Freedom Forum! (For directions, see our web page at: http://www.mv.com/ipusers/jaqboot/Freedom/Forum.html apologies to this month's speaker for not creating a full web page on his talk. Will catch up after the talk. Jack Shimek --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

3 2

Re: Contracts, Responsibilities, and Drug-Dispensing
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 5:33 PM 7/9/96 -0700, Wei Dai wrote: >On Tue, 9 Jul 1996, Bill Frantz wrote: > >> ObCrypto: When may a minor child say no to PAK (Parental Access to Keys)? > >Interesting threat model... What can one do in the total absense of >physical security? We've talked about mental cryptography before, but I >think we agreed that it isn't very practical. Perhaps security through >obscurity is a better solution here, since many parents are less computer >literate than their children. Steganography still seems to be useful. However, I don't think total absence of physical security will last for long. Soon school children will be carrying their own portables, the way they now carry calculators. They will have private time alone with the hardware the same way their parents will. Parents and children divided into "armed camps" has always been a lousy way to run a family. Computers are just a new battle ground for families that chose to run that way. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

DES & IDEA built right into the Linux kernel...
by stig＠hackvan.com 17 Dec '03

17 Dec '03

Nicholas Leon <nicholas(a)binary9.net> has created tools that allow DES and IDEA encryption at the device level for the Linux kernel. Some of the patches are in the 2.0.4 kernel, and the rest can be found at http://www.binary9.net/nicholas/linuxkernel/patches/ Stig

4 4