December 2003 - cypherpunks-legacy

Draft OECD crypto guidelines on WWW
by Robin Whittle 17 Dec '03

17 Dec '03

I have obtained the OECD draft crypto guidelines from: http://www.quintessenz.at/Netzteil/OECD/index.html where they are a Word 6 file. I have converted them to HTML and put them at: http://www.ozemail.com.au/~firstpr/crypto/oecd_dr.htm This is probably not the absolute latest draft, but it is the best I can get. I think there is a lot of good material here, but they still seem wedded to the idea of key-recovery or some other means of governments accessing plaintext or keys. They seem to assume there will always be a copy of the key around the place somewhere. In general, in the future cryptographic exchanges will use fresh key-pairs for each session, so not even the user can get a copy of the private key. Maybe key-recovery techniques are designed to cope with this, but the question is why would anyone want to use such a system other than that the government (and some corporations aligned with the government) want them to? There is no reason why ordinary or criminal users should be interested in key recovery/escrow, or weakened key-spaces - what they need is simple to use, totally secure, end-to-end encryption. The whole aim is to make a bulletproof secure pipe that doesn't depend on any other data, technology or administrative actions. The draft guidelines have my comments at the start, including a suggested rewording of paragraph 88 which currently states that crypto systems *should* provide for lawful access to the plaintext/key. The OECD people do not seem to have considered the fact that criminals will wrap their material in a crypto system they can trust before putting it through the government mandated system that they don't trust. My comments include a more detailed discussion of this argument, particularly in the situation where criminals are communicating with non-criminals. In a nutshell, how is all the cost, risk, doubt and complication of key escrow/recovery etc. justified by its benefits for serious crime prevention/deterrence, when the great majority of criminals and a large number of ordinary private and commercial users will be applying their own strong encryption first? Does anyone know of writing that specifically tackles this question? This is a separate question from those about whether governments can be trusted, or about absolute rights to privacy etc. It is simply a cost/benefit analysis. To me the benefits for reducing serious crime seem slim indeed and the costs - not least the general feeling that people may be using daily a system specifically designed for tapping their communications - seem to be very high. - Robin . Robin Whittle . . http://www.ozemail.com.au/~firstpr firstpr(a)ozemail.com.au . . 11 Miller St. Heidelberg Heights 3081 Melbourne Australia . . Ph +61-3-9459-2889 Fax +61-3-9458-1736 . . Consumer advocacy in telecommunications, especially privacy . . . . First Principles - Research and expression - music, . . music industry, telecommunications . . human factors in technology adoption. . . . Real World Interfaces - Hardware and software, especially . . for music .

1 0

Any RC4 attacks?
by Jim & Carla Rogers 17 Dec '03

17 Dec '03

Schneier claims that RC4 has not yet fallen to crypanalytic attack. Assuming that a sufficient length key is used (>= 128 bits), have there been any successful attacks? Jim Rogers

1 0

Patent Fight Could Add to Cost of Inter
by Alan Pugh 17 Dec '03

17 Dec '03

By KATHLEEN SAMPEY Associated Press Writer NEW YORK (AP) _ A little-known patent could raise the cost of doing business over the Internet for companies selling software, video or other digital products delivered online. E-Data Corp. of Secaucus, N.J., is suing 17 companies, including McGraw-Hill and CompuServe, to collect licensing fees on the patent, which protects downloading of encrypted digital information. A court hearing is scheduled Dec. 6 in New York on the company's claims. Analysts said the patent will not significantly restrain Internet commerce, but would raise the cost of doing business on the Internet and cause headaches for small start-up companies. Some companies, including Adobe Systems and VocalTec, have grudgingly paid the licensing fee. Others intend to fight it. ``We believe it's important to draw a line in the sand and make them prove infringement,'' said CompuServe spokeswoman Gail Whitcomb. ``We think their claim is way too broad.'' Arnold Freilich, E-Data's president, said the company bought rights to the patent in 1994. He won't disclose how much the company has made from it, but said it covers digital products such as text, software, images, music and video transmitted through phone lines to customers. Companies that take orders for products over the Internet, then ship them by mail would not be affected. The patent was first issued in 1985 to Charles Freeny Jr. Freeny, an electrical engineer, held the digital encryption patent until 1989. Unable to make money on it, he sold it for about $100,000 to a company called Avedas Corp. ``I didn't foresee the Internet,'' he said. Avedas couldn't make money from it either and has since gone out of business. By 1994, when E-Data bought the patent for $290,000, the World Wide Web had come of age, and so had the possibility of enforcing the patent, which expires in 2003. Peter Tracy remembers making the acquaintance of U.S. Patent No. 4,528,643. His East Haven, Conn.-based company, MicroPatent, operates a Web site where users can search and download patent and trademark information for 25 cents a page. On March 22, he received a packet from E-Data saying his company might be infringing on the patent. He could either pay a fee based on the percentage of his Web site profits, or be sued. ``I felt like I had been sucked into (a) bottomless pit,'' he said. MicroPatent agreed to pay the licensing fee, which Tracy will not disclose. The cost of the annual fees range from 1 percent to 5 percent of sales under $1 million, according to David Fink, E-Data's attorney. For sales over $1 million, the rate is determined on an individual basis, he said. Several cases already have been dismissed because either defendants paid the fees or they were found not to be in violation, he said. Cases against Dun & Bradstreet, Decision Support and Meca Software were dismissed. Company representatives either could not be reached or refused comment. IBM spokesman Fred McNeese declined comment on questions about E-Data or the licensing fees. But companies such as McGraw-Hill are anticipating the December court hearing. ``We fail to see anything that we do in our businesses that infringes on this patent,'' said McGraw-Hill spokesman Steven Weiss. ``We've asked them continually what we've been doing, and E-Data has not told us _ aside from accusing us. ``We have no plans to pay them anything,'' he said. But Freilich said the patent is specific in its description of encrypted digital data, which is how many companies have sold such information since 1994. For example, a customer orders a digital product over the Internet, and pays for it through the Internet with a credit card. These types of transactions are not all that new, as in CompuServe's case. But once the product has been downloaded to the customer's terminal, an encryption code is provided by the seller to unlock the encryption, thereby allowing the customer to use the product. It is this added step that Freilich said the patent describes. Today's network organization also makes the patent enforceable, he said. In 1985 when the patent was granted, there was no such thing as an addressable computer or the Web. ``The technology has brought us to the point where anyone's computer terminal is addressable, where encryption is commonplace and that has led to the enforcement of this patent,'' Freilich said. Scott Smith, analyst at Jupiter Communications, predicted the case would not dampen Web commerce. ``I think it's a blip on the radar,'' he said. ``It may hurt some of the start ups. But larger companies face this kind of thing all the time. They'll be able to shake it off.'' While some may accuse E-Data of trying to stifle Internet commerce, Fink sees his client's efforts merely as a means to cash in on a legitimate, far-sighted investment. ``Besides,'' he said, ``3 cents on the dollar will not put any company out of business.'' AP-DS-11-19-96 2327EST * * * END OF DELIVERY * * *

2 1

Magic passwodr in BIOS?
by Kamil Golombek 17 Dec '03

17 Dec '03

Hi, yesterday I've read about so called "magic password" in AWARD BIOS. It was a surprise for me and I wasn't very happy that the way how to bypass this is so easy. But nevermind, I heve two questions about it. First, is there any way how to disabled "magic password" 589589 in AWARD BIOS? Second, does anobody know another "magic passwords" to various BIOSes? Thanks for your answers! ZERO

1 0

CAVE Table
by John Young 17 Dec '03

17 Dec '03

For clarity we've replaced the CAVE Table image in TR45.3 with HTML and ASCII versions. The tables are also at: http://jya.com/cavetable.htm

1 0

Mass-market crypto phones
by Clay Olbon II 17 Dec '03

17 Dec '03

A while back, Eric Blossom posted a URL for a mass-market, phone encyrption device (http://www.comsec.com/) The point of this post is to posit a scenario based on the implications of this product. This is speculation based on where I think such products should be heading. I think we need to keep a couple of goals in mind. The first, is to get encrypting phones (or phone add-ons) into Wal-mart, K-mart, etc (where probably most Americans now buy their phones). The prices need to be low enough that people will want to buy them (<$100?). Is this technically feasible? The comsec device from the above URL already demonstrates the needed capability. Is the cost target possible? My guess is soon, given the lowering costs and increasing capabilities of current processors. The second goal needs to be to push a similar product for cell-phones. I think this will be perhaps an easier sell, given the higher initial cost for these phones, and their reduced security. Perhaps a home device could be sold with the cell-phone as a package deal, so that communications with the "home base" (i.e your office, home, etc) would be secure. With the rapid growth in cell-phone sales, selling a package such as this might ensure a larger user-base of home devices. Given that these goals are met, I think widespread use of crypto over phone lines would become almost inevitable. However, the fun part would be the introduction of such products. The FUD coming from police, the government, etc. would be amazing to behold. Clay ******************************************************* Clay Olbon olbon(a)ix.netcom.com engineer, programmer, statistitian, etc. **********************************************tanstaafl

3 2

Re: Why I Don't Read SF Much Anymore (fwd)
by gimonca＠skypoint.com 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 21 Nov 1996 00:14:49 -0800 > From: "Timothy C. May" <tcmay(a)got.net> > Subject: Re: Why I Don't Read SF Much Anymore > [among other things] > > - Vernor Vinge, "True Names," obviously, "The Peace War," "Marooned in Real > Time," "A Fire Upon the Deep," and his collections of short stories (incl. > "The Ungoverned"). > > (Caveat: I've been invited to do a chapter for Vinge's forthcoming "True > Names" book, containing essays about computers and society, and, of course, > his novella of the same name. So I may be biased.) > Is this the St. Martin's Press "True Names" edition that was listed in amazon.com? At one time, it was going to be released August or Sept. of this year. I have to mention that the owner of Dreamhaven Books here in Minneapolis complained to me last year that he has a "truckload" of remaindered copies of "Peace War". They still have a bunch--every time I've been in there, there's a hardbound "Peace War" on display with a price tag of $1.00. Buying a copy of "True Names" right now is about as easy as buying an original Dead Sea Scroll--but if anybody wants a cheap copy of "Peace War", look up Dreamhaven in Minneapolis. --C.G.

2 1

Re: Magic passwodr in BIOS?
by Eric Wilson 17 Dec '03

17 Dec '03

At 12:39 PM 11/21/96 +0100, you wrote: >Hi, > yesterday I've read about so called "magic password" in AWARD BIOS. It >was a surprise for me and I wasn't very happy that the way how to bypass >this is so easy. But nevermind, I heve two questions about it. First, >is there any way how to disabled "magic password" 589589 in AWARD BIOS? > Second, does anobody know another "magic passwords" to various BIOSes? > > Thanks for your answers! > ZERO > > I wouldn't be too disappointed with a hole in BIOS password security. Most of them can be easily defeated by a jumper switch, or shorting a pin on the system board.

1 0

No Subject
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

On Thu, 21 Nov 1996, aga <aga(a)dhp.com> wrote: From: aga <aga(a)dhp.com> To: Rabid Wombat <wombat(a)mcfeely.bsfs.org> cc: FREEDOM-KNIGHTS(a)JETCAFE.ORG, Black Unicorn <unicorn(a)schloss.li>, cypherpunks(a)toad.com Subject: Re: Does John Gilmore EAT Asshole? |FUCK YOU COCKSUCKER -- as long as you keep writing to be, |I will continue to rip a new asshole in the Faggot John Gilmore |who promotes PUNKs like you. [snip] |A 'punk' is a faggot pussy who is really NOT a man! |The faggot Gilmore does take it up the ass and also eat assholes, so |he should be added to the net.scum list at once. I should'a kill-filed this sicko long ago. Like the raving individuals one passes on the sidewalk, he is best ignored. Leave him for professional care. >From whence does such trash arise? Oh me!!

3 2

Re: Why I Don't Read SF Much Anymore
by Ken Kirksey 17 Dec '03

17 Dec '03

>The problem with straight SF for me is that computers and networks have >changed the future so much that (in the words of the motto of the SF >Writer's Association) The Future Ain't What It Used to Be. The science >fictional futures of my childhood are now dead as doornails. I still enjoy some of the "old stuff", but not in the same way that I did when I was younger. I read those works as period pieces now. There is a certain romance in the Gersnbackian view of the future that I enjoy, especially in contrast to the Grim and Gritty (TM) "reality" of most modern and post-modern SF. I still find Heinlein's juveniles to be fun reads, probably for this reason. Ditto for Edgar Rice Burroughs's Mars books. >And I can't >enjoy contemporary SF that doesn't include a healthy dose of computers and >networking. Computers and networking may not be central to the story the author is trying to tell. And with the way things are going, computers and networking will become (some would say already have become) such an integral part of the culture that they don't warrant special attention. Kinda like airplanes, automobiles, television, radio, microwave ovens, cellular phones, ad infinitum. Computer Networks were a new and nove idea when _Shockwave Rider_ was written, but now with every car and cereal commercial on TV promoting a web site as well, it's not all that exciting anymore. As far as keeping up with current SF, I, like others, don't seem to make as much time to read as I used to. I rely on Gardner Dozios' annual _Year's Best Science Fiction_ anthology to keep me up to date and introduce me to new writers. I've always enjoyed the stories he's chosen, some more than others, and he's introduced me to some great writers that I probably wouldn't have heard about otherwise: Greg Egan, Connie Willis, and Terry Bisson, to name a few. Judging from your comments, I think you'd like Greg Egan, especially his novel _Permutation City_. Ken

1 0