December 2003 - cypherpunks-legacy

Would Netscape take money for 'exported' copies?
by Arun Mehta 17 Dec '03

17 Dec '03

At 22:13 23/07/96 -0400, Anonymous Remail Service wrote: >As I have said before, European & other foreign users, who get the strong- >crypto version should pay Netscape what they owe Netscape, to keep the ITAR >as the issue, and not piracy. Yes, but could/would Netscape even take our money? Wouldn't that be complicity (IA obviously NAL)? I'd imagine they'd just return the money, and tell us to please destroy our copies of the software. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/ finger amehta(a)cerfnet.com for public key

1 0

Re: Parsing John Youn (Re: OPS_nuk)
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Jul 25, 1996 03:46:19, 'tcmay(a)got.net (Timothy C. May)' wrote: >P.S. John Young does an invaluable service in forwarding items and making them >available at his site, but I find parsing his text into something >understandable a real chore. Too bad when style gets in the way of substance, >unless, of course, ones aspires to Joycehood. Tim, pity the moot transcriber a-choring (spit). It's a grind (pus) forwarding other's fishwrap (buggers), hardly able to contain one's gibbering idiocy (pee) counterreaction to the new's gratuitous fatuity (dookie). Usually, though, one's bowel-rumblings (Bic lits) pass unnosed in the c'punk parfumerie.

2 1

Re: Ross Anderson's Eternity service
by Arun Mehta 17 Dec '03

17 Dec '03

At 20:13 22/07/96 -0700, Hal wrote: >Sherry Mayo posted here a while back a reference to Ross Anderson's >Eternity service paper, <URL: http://www.cl.cam.ac.uk:80/users/rja14/#Lib >. Got that far, but could not download the Eternity service paper itself. Something about only accepting connections from certain sites. Would someone kind-hearted enough mail me a copy? Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/ finger amehta(a)cerfnet.com for public key

1 0

Re: Netscape
by jim bell 17 Dec '03

17 Dec '03

At 06:39 PM 7/24/96 -0700, Tom Weinstein wrote: >The Deviant wrote: >> >> I would have suggested even being as nice as "We'll do the same as MIT >> does with PGP's distrobution, or RSA does with RSAREF (just so you'll >> know, RSA's FTP basicly has a readme file that says "the files in >> subdir of a dir thats -r+x to you, so if you're a citizen go to >> dist/usaRANDOM_NUMBER_HERE", thats it). Then make them explain why >> Netscape should be any different. > >MIT reportedly has a letter stating that their systems is okay. The >state department wouldn't give us such a letter because they were >"currently reevaluating their guidelines", or some such thing. We >convinced them to give us temporary permission for this system until >they had finalized their new policy. That still doesn't make since. First, there were laws. And we had to obey them. Then, they added ITAR. And they want us to obey it. Finally, it seems, they're giving us "guidelines." Not law, Not ITAR. Next it's gonna be their their fondest desires, their preferences,and finally their whims. What's wrong with this picture? Do I detect an ass-kissing contest? You should have told them that if they're "evaluating their guidelines" that means that NO future modifications to those guidelines is binding on you, since it is not part of ITAR and is CERTAINLY not part of the law. You should have memorialized the contact with a lawyer's letter, and promptly posted the new version of your software with whatever version of the precautions (MIT, RSA, or?) you felt most happy with. Jim Bell jimbell(a)pacifier.com

4 3

Re: Boobytraps and the American Legal System
by Chris Adams 17 Dec '03

17 Dec '03

On 24 Jul 96 01:21:34 -0800, dlv(a)bwalk.dm.com wrote: >I think Tim May is growing senile... This is new? <g> >> (Later examples were to be even worse. For example, the burglar who climbed >> on a roof and stepped through a skylight. He sued, and won. I guess the >> owner of the property was obligated to install night lights so burglars >> could see their way, and to generally make his property more >> "burglar-friendly." > >Actually, he fell through the roof of a school he was trying to burgalize. > >In a similar incident a burglar broke into a house that was being treated >for pests (i.e., was full of toxic fumes). He died; his family sued the >owners and won. > >Maybe someone can post a reference to these two cases. I recall that both >happened in New York, but I could be wrong. I remember hearing about a case on this end of the continent (west coast) that involved a store that had been robbed many times. The owner noticed that most burglars came through the skylight, so he electrified it. Not much of a charge, just something like 12 volts - enough to keep someones hands off of it... However, a klutzy burglar managed to fall into the skylight and get stuck. His partner deserted him. Over the course of several hours, he died... *ouch* Needless to say, his next-of-kin sued and won. The guy lost his store. Another one I liked: in (I believe) Pennsylvania, a drunk peed on an electrified third rail. His next of kin sued the trolley company and won... A man tried to commit suicide in Chicago by jumping onto an El track. He was only crippled, so he sued and won! // Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! // Automatically receive my resume or PGPKEY by sending email with a subject // of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful!

1 0

Brute-forcing DES
by trollins＠interactive.visa.com 17 Dec '03

17 Dec '03

Hi, Anyone have a FPGA chip PCI board layout that they would like to share. Having seen the paper "Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security", the FPGA chip seems like a perfect addition to my pc. Count me in... Thanks, -tom > Any one up for a distributed brute force attack on single DES? My > back-of-the-envelope calculations and guesstimates put this on the > hairy edge of doability (the critical factor is how many machines can > be recruited - a non-trivial cash prize would help). -- Tom Rollins <trollins(a)interactive.visa.com>

1 0

Shell buys key escrow system from Trusted Info. Systems
by Will Rodger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Administration officials didn't return calls for comment, but it's clear that the Clinton-Gore team have their first "testbed" for trying out key recovery, or key escrow, proposals. Steven Walker, president of Glenwood, Md.'s Trusted Information Systems Inc., told Inter@ctive Week late last week that TIS will supply his companys Gauntlet Firewall technology, complete with commercial key escrow capabilities, to an a large multinational with headquarters outside the United States. The multinational company will self-escrow, that is handle all encryption keys itself, in cooperation with the British government, sources close to the deal said. Walker declined to name the company, but several Washington-based sources confirmed the buyer is Royal Dutch Shell. The deal represent the first time that a foreign buyer has purchased a US key escrow product without escrowing keys in the US. Indeed, TIS has sold only one other system for export abroad, one which involved communications between the US and the UK with US key escrow. Walker, widely credited with devising the controversial commerical key escrow system now being promoted by the current administration, claimed "there really is an important issue here in finding a balance between the interest of government and those of industry. A policy that says anyone who wants to export strong encryption as long as there is key recovery is an important development." The success of the deal and others like it could figure heavily in the Clinton administration's ability to sell it its latest proposals on commercial key escrow; a recent report from the National Research Council recently warned that such efforts were unproven and required serious examiniation before they could be deployed. Long-time critics of the proposal have, in turn, leveled the same criticisms. Jim Bidzos, President of RSA Data Security Inc. and a long-time foe of administration policy said he doubted the market would rush to purchase products like Trusted Information Systems, but said he was slightly more hopeful for a resolution to the controversy than he had been previously. "Ive said all along that user key escrow is the only thing that makes sense," Bidzos said. Users who hold their own keys "can comply with any regulation in the world - if you want to give your keys to France or whoever you can thats your business. If it's good enough for the CIO, it's good enough for the CIA." Royal Dutch Shell officials said security considerations forbade confirming a sale had been made, but freely admitted to having had talks with TIS. The companys interest key escrow, computer security head Nick Mansfield said, lay principally in getting access to records after keys had been lost, stolen or otherwise disabled. The Gauntlet firewall, nonetheless, encrypts and decrypts messages as they arrive; it does not store messages in encrypted form. "To us its not a matter of going along with key escrow, its a matter of doing business," Mansfield said. ********* A shorter, slightly less jargon-laden version of this story appeared in the 7/22 issue o fInter@ctive Week. An archived copy should be on our site (http://www.zdnet.com/intweek) by week's end. Will Rodger Washington Bureau Chief Inter@ctive Week -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMfa2sUcByjT5n+LZAQE4nAf7BA5X2f3LX1KQXXygkYtaGWc6qMgDEFWA cYlQNtVw+KS+h8hNRmpZ4KWaUJS1iwHPfwaS0XqI40gVGyZE2mYBmF6RybAkLKKV zGXEyIlAVxKOz2FsRQ35Tg1VV5Y8NaL+YxK3uUcutLHBK/Vxq7iLcnaqRn2klfYM 6ImSKecHMU2NzaB8JGIIJbAuG7NpGmLj/O4BEP3ccoNeA3NQ1fIAujMyL12gbdPF TUZVUOLsj5eHG1dwqRmSUdsNHcwYoQ6WFX2waIdot0Ia/nph/ERpliVjkccIsKsz q+qDeH0fz3ZoENS/zqUy9ilHwLcAdMoiyQzlm06dZBRf+O9rqpDjKA== =RJjm -----END PGP SIGNATURE-----

1 0

Parsing John Youn (Re: OPS_nuk)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:30 PM 7/24/96, John Young wrote: > The WSJ Page Ones a loser's game about the CIA's role in > promoting Japanese pachinko cards to halt the surreptitious > funneling of betting cash to the construction of a North > Korean nuclear plant. And the op's nuking by the Kobe quake > looting of card-reading mechanisms, cracking encryption > codes, and counterfeiting not-so-smart cards for counter- > tipping the house fix. Mondex, watcher bleedin arse. Huh? (If anyone has a decryption key for this, please send it to me.) --Tim P.S. John Young does an invaluable service in forwarding items and making them available at his site, but I find parsing his text into something understandable a real chore. Too bad when style gets in the way of substance, unless, of course, ones aspires to Joycehood. Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Distributed DES crack
by talon57＠well.com 17 Dec '03

17 Dec '03

Matt Blaze scribes: >My estimate is that an FPGA-based machine that can do a single DES >key every four months (eight months to exhaust the whole keyspace) >could be built with off-the-shelf stuff for comfortably under $50k >(plus labor, plus software development costs). A prototype board >should cost under $1000 and will help prove the concept and get a >more accurate cost estimate. I expect to build such a prototype >machine myself, and, if it works as I expect, maybe the whole >thing. >-matt If the price is reasonable, I for one would be willing to donate the bucks for a FPGA chip or two to see this get built: -------------------- | Chip donated by | | talon57(a)well.com | -------------------- The very existance of this device in the real world would make our point better than anything I've yet heard. Imagine being at a hearing and having the physical device sitting there before the judges...... Brian

2 1

Re: Game Theory and its Relevance to Cypherpunks
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 09:57 PM 7/20/96 -0700, you wrote: > >Game theory is terribly important to Cypherpunks. Just to make a plug for my thesis, people can find some of this discussed at: http://far.mit.edu/~reagle/commerce/thesis/thesis.html . The SanteFe Inst. references might be of particular interest with respect to decentalized economies and such. _______________________ Regards, There is no greater sorrow than to recall a time of happiness in misery. -Dante Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0