December 2003 - cypherpunks-legacy

Re: Crypto: Systems & Application Developers Wanted
by Greg Broiles 17 Dec '03

17 Dec '03

At 07:11 PM 10/15/96 -0400, Mark Aldrich wrote: >On Sat, 12 Oct 1996, SPYRUS wrote: > >> SPYRUS, the leading provider of cryptographic tokens (PC cards & >> Smart Cards), with associated systems and applications software, is >> looking for engineers with the following qualifications to work >> with >> our Secure Applications Group in San Jose, CA: >Uh, excuse me, but doesn't SPYRUS in fact market a Fortezza card? The >very same card being used by the Evil Empire to spread diseased and impure >so-called "cryptography" (with GAK permanently embedded into it) to the >uninformed minions? Uninformed? It's right in their name: SPY-R-US. Just don't tell Toys 'R Us, they've been on a trademark litigation jag lately. (but it might save everyone some time if they added "Not concerned about the long-term effect your work has on the quality of human life & freedom" to the list of qualifications required.) -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

Japan imposing crypto export restrictions!
by nobody＠replay.com 17 Dec '03

17 Dec '03

Another Cypherpunks exclusive! Bowing to US pressure, the Japanese Ministry of International Trade and Industry (MITI) has quietly made changes to Japanese crypto export regulations. In the past, export of crypto products from Japan was unregulated. The exporter had to file a pro-forma export declaration with MITI. The new regulations, imposed in recent weeks without public announcement, require the exporter to state the ultimate recipient of the crypto product. MITI then conducts a lengthy approval process that can take many weeks. It is widely assumed that the US used the thread of trade sanctions to bring about this 180 degree turn in the attitude of the Japanese government. The new regulations apply to exports from Japan to all countries, including the US. --anon

3 2

Re: "Right to Privacy" and Crypto
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 7:40 PM 10/15/96 +0000, attila(a)primenet.com wrote: > the first sort of stands, but consider that the right > to privacy and the freedom of speech should also include > the right NOT to speak --that has been gutted by the > rulings on the fifth. The limits on free speech in the workplace, and their gradual extension to non-work environments make me think the first is going down the tubes too. ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

1 0

Comment on binding cryptography (2)
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

Adam Back wrote: >Hey Bert-Jaap, I had you down as one of the good guys, what caused you >to fold :-) It's nice to hear I was listed as a good guy. Maybe I can regain some credit if I explain why I co-published the binding cryptography proposal ;-). I haven't yet made up my mind how the crypto problems for law enforcement are to be addressed. It's my Ph.D. subject, and all I can say at present is that the issue is complex. That is why I want there to be as much information on the issue as possible. I don't say I agree with key-escrow, GAK or binding crypto, nor with demanding a suspect to decrypt, but I want to know all there is to know before I make up my mind. Having a new proposal helps putting things into perspective. At least the binding crypto proposal shows (as other proposals have) that there's no need to escrow your private keys, and that's a point. Also, as I said in my first comments, binding crypto isn't meant to solve the crypto problem, it is "merely" meant to provide a trustworthy crypto system with some safeguard. Finally, to my mathematician's sense of aesthetics, binding crypto is an elegant proposal. It merits publication in its own right. Not because I think it should be established, but because I think it should be known. Bert-Jaap --------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 466 8101 Center for Law, Administration and facs +31 13 466 8149 Informatization, Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------------------- Postbus 90153 | This world's just mad enough to have been made | 5000 LE Tilburg | by the Being his beings into being prayed. | The Netherlands | (Howard Nemerov) | --------------------------------------------------------------------- http://cwis.kub.nl/~frw/people/koops/bertjaap.htm ---------------------------------------------------------------------

1 0

Re: mail software for multiple addrs
by Ross Wright 17 Dec '03

17 Dec '03

On or About 15 Oct 96 at 18:46, Vladimir Z. Nuri wrote: > 1. multiple internet providers > 2. multiple email accounts > 3. multiple mailing lists How about Pegasus? =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Re: AW: binding cryptography
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In your mail, you write: > That is correct. Sorry that the BTW-statement is so evident. Some people > did not understand that if you *do* agree, then you *can* be breaking any > rules... Which of course implies that to be effective, the system can't allow anyone to opt out. > >Which they will, and presumably already do. Therefore, your proposal > >does not and cannot hamper criminals. Therefore, your proposal only > >hampers law abiding citizen-units' access to uncompromised crypto. > > I do not agree. For instance, the encryption possibilities of wordperfect, > and MS-word are weak; my mail-system (ms-exchange) does not have any > encryption at all. The security of these important Custom of The Shelf > products can and will be enhanced.. And as I pointed out above, the system only works when compromised-key crypto is all that is available. Where there are more secure options available, people will choose them. Your example is a good one: WordPerfect, MS Word and MS Exchange may well choose key-compromised crypto to gain the approval of the state. Thus, those products will never have real security. I can't agree that key-compromised crypto is secure at all, as it requires that some third party hold key (or the means to recover keys). You may argue that the supposed TRP can actually be trusted. I'm not willing to grant that trust without good cause. In the case of governments, I'm simply not willing to grant that trust at all. (to be fair, I acknowledge that the USA is not the Netherlands, and you may not understand Americans' distrust of our government) > The point is that public available systems should *aid* not them in their > criminal activities, let them search for alternatives. Compare it with the > legislation we have here on the sell of guns. You sort of say: hey, that > does not help cause criminals will get it somewhere. I say, that is true, > but it will make their lifes more difficult, or maybe I should say less > easy. My point is that I, as a member of the public, should not be restricted in *my* choices. Just as gun control laws make it harder for me to lawfully purchase and own a gun, your proposal makes it harder for me to lawfully obtain strong cryptography. The obvious difference is that guns are capable of inflicting fatal damage to humans, where cryptography is not. > >Registration plates do not "stop criminals". Locks do not "stop > >criminals" (although they might slow a criminal down). Neither will > >compromised crypto "stop criminals". But all the above impinge on my > >liberty. Am I to give up yet another freedom? > > Our system slows down criminals too, or maybe I'd better say does > not speed them up. And it also makes me more vulnerable. You are asking me to compromise my own security because some other person might abuse his own capability. Will you also ask that I allow my muscles to atrophy to the point where I cannot inflict damage with a blow from my fist, because others might decide to fight? It is important to remember that cryptography is 100% defensive. It _cannot_ be used in an offensive manner. Any plan to weaken or restrict cryptography is a plan to disallow defenses. How can you ask me to leave myself vulnerable to attackers? > We believe our system gives a solution in which every democratic > country on his own implement to their middle, without losing > connectivity with countries that think otherwise. Repressive states will endeavor not to allow connectivity with non-repressive states. Your plan only facilitates the repressors. Thus, you offer weapons of repression to governments. Still think it's such a good idea? - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMmRoQxvikii9febJAQHOvAQAhzUvsJapB+lBWM0MNjkOPFg0PtIFIKID 7uhWjzQ7Lwp7WlCeiqcB9+AdZuQMxAC/cq4uJai98jv8/5ba3t1uPiLMIx+ytSAN q8UURDF3CWaX5TAzrC0OvdPUc+LONXVBebX0PMtwHaGZfsJWnebschJA36zRIY8Z in8xv1t78Z8= =GITW -----END PGP SIGNATURE-----

1 0

[Noise] Re: [*CORRECTED* POINTER] On Vulis' net background (fwd)
by Douglas B. Renner 17 Dec '03

17 Dec '03

On Tue, 15 Oct 1996, Rabid Wombat wrote: > Still more on this rather silly topic: > (Hey - at least I put "noise" on it) :) Definitely needed. :) SORRY* I typo'ed the most incriminating link - the following should work: http://www.math.harvard.edu/~verbit/scs/cranks/from-Shlomo.html#vulis (This is a fellow with a rather long & amazing history of net abuse. It's amazing enough to warrant a look. There is a sub-section titled "Who is Dimitri Vulis" that most CP readers would find shockingly familiar. It explains _quite_ a bit.)

1 0

RE: mail software for multiple addrs
by blanc 17 Dec '03

17 Dec '03

I use Win95 and Exchange for email, which works as follows: In Exchange you can set up separate user "profiles", for which you enter all the info for any number of different ISP accounts, including the phone number for access, login name, and also password, if you wish. Then when you open up Exchange you can select which account you want to connect to. You can have a default connection, but after you've downloaded the email from one service, you can then select a different service to connect to and get your mail from there, and so on. Each selection of a service provider will automatically: 1. dial the service 2. log you in 3. enter your password, or allow you to enter it manually each time 4. download your mail 5. disconnect There are bars at the top of the Exchange email list of messages by which you can sort your mail according to Sender, Subject, To, From, Date Sent, Date Received, Attachments, Level of Importance, etc., according as you click on each so-entitled bar. Then you can highlight the messages and put them into folders and sub-folders. Each provider brings up its own window of user-created folders. At this time Exchange does not provide automatic filtering or "rules" to send certain messages to particular folders unless you're connected to an Exchange server, but there is a nifty new mail package front-end coming out very soon which will do this. Then it will be possible to indicate that you want all your Cypherpunk mail going to the 'cpunk' folder, or messages from certain individuals going into a folder by their name (or you can send their email to the 'Delete' folder and set this folder to automatically delete all those messages when you exit the mail program). With Win95 you can also connect to a service provider through a semi-GUI interface for shell-access only (called Hyperterminal, similar to a telnet window) and use whatever software the provider offers (like Pine), and this will appear in all text, except that you can set automatic connections. You can create multiple icons with their own separate automatic connections for this type access as well. Internet Explorer 3.0 also offers mail features similar to Netscape, but they're also still comparatively simple (limited) . .. Blanc

1 0

Re: Royalties
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:31 PM 10/16/96 +0800, pclow(a)pc.jaring.my wrote: >> Thus, PGP Inc. now >> holds the exclusive license on commercial PGP products. > >Even the international version of PGP? There are lots of copyright notices in PGP. If you're trying to sell PGP-derived code in a country that's part of the Berne Copyright Convention or has other international copyright-honoring agreements, it may apply. But you can read it. Copyright is more widely accepted internationally than patents on mathematical algorithms, and the RSA patent in particular is not valid in most of the world because it was disclosed to the public before the patent was applied for (to avoid American government tricks that let the military classify and essentially confiscate processes that are "national security" related when you apply for the patent.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

AW: Binding cryptography - a fraud-detectible alternative to key-escrow
by Eric Verheul 17 Dec '03

17 Dec '03

On dinsdag 15 oktober 1996 22:48, Daniel Pouzzner[SMTP:douzzer@lechter.chautauqua.com] wrote: >"Binding cryptography" does not increase the difficulty of subverting >the key escrow facilities of a messaging system. In order to subvert >such a system, one can either modify the messaging system (as >described by leichter(a)smarts.com, for example), or nest another >cryptosystem inside it; these techniques are not impeded through the >introduction of "binding cryptography." There are no easier subversion >techniques, so "binding cryptography" has zero impact on the viability >of compulsory key escrow implementations. I agree that binding cryptography, or any "recovery" system can be subverted by nesting another cryptosystem into it. However, the advantages gained this way - in my opinion are small; people wanting to do this might as well use/make their own system. Compare this with the simple "recovery" system where users are obliged (*if* they voluntarily agree to *use* the system) to send along a session key encrypted with a public key of a Key Recovery Agent, and where *no* binding data is required. Then it would be trivial to convert this system into a criminally useful one - by a simple manipulation in software - with: - *not* having to build another cryptosystem (and its key-management) into the system; - packets send can by no means be distinguished by third parties from "correct" ones. As we liked the flexibility of choice in Key Recovery Agents of this system (which in our opinion amplifies privacy properties of the scheme) we proposed binding cryptography, as a middle between non-liberal private key escrow and the too liberal simple "recovery" system. > >I am troubled because your research is misdirected, and because by >publicizing your research you are serving to cloud what is >fundamentally a very simple issue. In your announcement you described >"binding cryptography" as an "alternative to key-escrow." This is >misleading to the point of falsehood. It is key escrow with even more >stringent constraints placed upon choice of algorithms and >architecture. The idea of escrowing session keys, rather than >keypairs or passphrases themselves, is hardly new. We know, see above. >The utility of key >escrow itself is indisputable - for example, it is a clear boon when >cryptography is used to secure documents in an institutional >environment. However, your proposed "alternative" adds nothing of >utility to either users or governments, and erodes the freedom of the >software architect. I find any architectural imposition repugnant, as >does any architect whose primary design criterion is quality. I think that architectural problems with key-escrow systems are more difficult than that associated with our scheme. The NRC study in fact raises the question of key-escrow on a large scale is at all possible. >Those of us who know better should not bicker among ourselves. >Compulsory key escrow is plainly unethical and mathematically >untenable. You should be ashamed for every minute you have spent >devising stratagems by which a public less technically knowledgeable, >but no less deserving of fundamental rights, can be duped into >accepting compulsory key escrow thereby abdicating their privacy and >endangering their safety. There is no middle ground. I respect your opinion, but I think there is a middle ground. Maybe you should be ashamed for not realizing the future problems that arise when even the part of the Global information superhighway that is paid for by society can be very conveniently used by criminals to harm society. > >-Daniel Pouzzner > Software Architect > >

1 0