December 2003 - cypherpunks-legacy

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:52 PM 12/19/1996, Bill Frantz wrote: >At 12:08 PM -0800 12/19/96, Peter Hendrickson wrote: >> If each chip has a unique public/secret key pair, and executes >> authenticated code only, there are some interesting implications. >> Software piracy becomes difficult, if not impossible. Code is sold >> on a processor by processor basis. Code for a different physical >> processor cannot be decrypted or executed. > This makes backup hard. That is the rock the routine copy protection hit > up against. There were many, me included, who simply said, "If your > product is copy protected then I will buy from your competitor." No, you can backup just as much as many times as you like. The code isn't stored on the chip permanently, it is only decrypted there. There is a similar problem, though. If your processor dies you could lose your software library. There are ways to mitigate this. One is for the vendors to just trust people and reissue the code to a new processor. Of course, you track how often you have to do this. Or, you could turn in the broken processor and have the manufacturer certify that it was turned in to the software vendors and that a new version of the software should be generated. This might not be so important if you generally pay for metered software. >> Viruses are not feasible if the authentication is strong. > So is user written code, public domain code etc. If there is an > un-encrypted mode for that kind of code, then viruses again become > possible. User written code is harder to arrange, it is true. You might have a way to execute non-authenticated code but at a speed comparable to an emulator. Or, you might just have another computer for running your own code. Right now it is not uncommon for a software library to exceed the value of the machine. It might actually be economical to have two machines if one of them can support a rich software library which doesn't cost as much money because it can't be pirated. Free software is still possible to run at full speed, but it has to be authenticated. The free software writer just has to do whatever the software vendor had to do to get it okayed. This makes it harder to release free software, but the effort is still a small fraction of the work required to build a significant application. Getting it to execute for particular processors is easy. You could release a piece of software which takes code and encrypts it for your particular hunk of silicon. If you could offer otherwise free software for, say, $20 and know that everybody using it will pay, many people might consider that to be a great deal. Right now the mechanisms of moving the software are too expensive to really make it feasible for something under $20. Development might be a bit tricky, but there are workable solutions. The manufacturer could release special processors which have an additional authentication mechanism for software developers which is specific to each developer. They could authenticate code to run on their own machine, but not on anybody else's. This does make it possible for software developers to pirate software (if the can get a secret key), but if the number of development processors is low, this could be manageable. If the environment was well defined, you could conceivably develop in a high level language on one platform, but deploy for sale on the decrypting-processor platform. Peter Hendrickson ph(a)netcom.com

2 1

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 1:41 AM 12/20/1996, Scott V. McGuire wrote: >On Thu, 19 Dec 1996, Peter Hendrickson Wrote: >> The manufacturer of the encrypted-code processor would protect its >> instruction set using intellectual property law. Given the high >> price of a fab, it is entirely feasible to stop anybody from building >> a new architecture which can execute the code about as fast as >> the encrypting-code processor. > It seems to me that this is where this scheme would be broken. Have > intellectual property laws been (successfully) used in this way? I don't know, but I bet it would be possible to arrange if there was support for it. Or, maybe the instruction set itself remains a trade secret. Sure, it could leak out, but aren't there laws against industrial espionage? (If the instruction set was secret, the manufacturer might have to provide a compilation service.) > And even if so, would they be enforced in all the countries where the > chips might be fabricated? Yes, if the laws exist they would be easy to enforce. What does a state-of-the-art fab cost now? $5 billion? $10 billion? I was generous when I said "G-7". Which countries can really compete in this market? The U.S. and Japan, I believe. There is no reason to rule out extra-legal pressure, either. The USG appears to have played the policeman in supporting the DRAM market in an informal way. It would be very easy to have a chat with the Japanese government about the importance of stopping software piracy. Peter Hendrickson ph(a)netcom.com

1 0

Ebonics
by Timothy C. May 17 Dec '03

17 Dec '03

In order to remain compliant with the new California law requiring increased use of "Ebonics," the new academic name for "Black English" (and known by honkey mofos as "ghetto jive"). Apparently the coloreds have had enough of "standard English" and its repression of their culture. To meet the requirements of this new law, 10% of my posts from now on will be written as best I can manage in the Ebonic language. Switching to Ebonics: De honks be chimin.' Code be fly! I's huffa be gots to be sizing, bitch. PGP 3 be dope, nuffin but bad! I be axing you if it be outa honkeyland or outa Afrika? Dat bitch Reno be sayin' it be 'legal be usin' dope 'warez. Day be hos. --a melanin-challenged honkey mofo Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Test files for encryption
by Steve O 17 Dec '03

17 Dec '03

Can someone point me to any standard files that are used when testing encryption strength. Iie i'm looking for a gourp of files that may have been used by an agency or Internet group in the past that when encrypted were tested for byte frequency etc. as well as cryptoanalytic atacks. thanks in advance. steveo privsoft(a)ix.netcom.com

1 0

Re: Executing Encrypted Code
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 03:30:46 EST, you write: << > >You could also timestamp the software so that it only runs for a given > >length of time. This will encourage people to upgrade regularly. ;-) > >> If anyone thinks it is anything but trivial to track down a call for time/date and a comparison of the two.. and then overwrite the area with some nop's to make sure the address jumps come out the same.. your sadly mistaken =-}

1 0

C2Net Party: January 24th
by sameer 17 Dec '03

17 Dec '03

http://www.c2.net/party/ C2NET is having a party January 24th at 654 Mission St. San Francisco assorted snacks, a cash bar and live music by WEIRD BLINKING LIGHTS with dj accompaniment by DJ FLINT and DJ PINNIPED will be present for your enjoyment Festivities begin at 8PM We hope to see you there --- Directions: >From the West or North: Take Oak Street East. Turn left on Laguna. Turn right on Fell. Fell crosses Market and becomes 10th Street. Merge left within one block of Market. Turn left on Mission. >From the East: Take Hwy 80 West across the Bay Bridge. Take the first exit on the left (Harrison Street exit) Turn left on Harrison. Turn right on 3rd Street. Turn right on Mission. >From the South: Take Hwy 280 North. Follow 280 to its end at 4th & King Streets. Follow King Street to its end at 3rd Street. Turn left on 3rd. Turn right on Mission. >From BART: Take BART to the Montgomery station Walk south on New Montgomery Street Turn right on Mission. Parking: There is a commercial parking lot across the street on Mission and another one on the corner of 3rd and Mission.

1 0

Re: Executing Encrypted Code
by Hal Finney 17 Dec '03

17 Dec '03

From: Ben Byer <root(a)bushing.plastic.crosslink.net> > [Quoting Peter Hendrickson:] > > The software vendor would be wise to check that the public key was > > legal. It would be a simple matter for the manufacturer to publicize > > all public keys that had been installed on chips. > > The manufacturer is going to publish a list of ALL of the public keys? > We're talking one key per chip, right? Isn't that an AWFUL lot of > keys, like, in the millions range? Probably an easier way would be for the chip manufacturer to issue a key certificate (signature) on the chip keys. Then it is a trivial matter for any software manufacturer to verify that a proferred chip key is legit; just check the cert. > > One approach is for the manufacturer to authenticate software submitted > > by approved vendors. The vendors are then tasked with encrypting it > > for the correct processor. > > I'm not sure the "approved" bit would go over too well... one idea > would be to license the compiler writers, who would build the > encryption into compilers. It's still not horribly great, but > better. Hey, it's a free world, right? Some people only run authenticated code from big companies; other people turn off the authentication bit in the CPU and can run any old thing they stumble across on the net. Everybody's happy. The first group doesn't have to worry about viruses, or at least they have somebody to sue if they see one, and the second group gets to run all the freeware and PD code they can today. > Right; the only reason I could see people using this would be for > economical reasons. Yes, I think this is a point often missed in these discussions. People say, why would I want a CPU which will limit the software I can run, something which will let a software maker give me a version of his program which will only run on my CPU and which I have no ability to share with others? What's in it for me? The answer presumably is that the software manufacturer will sell software with such limits for much less than he will sell unlimited software. That's because software piracy is such a major problem, and this way he can be protected against piracy from this copy of his program. So people with these CPU's can buy their software a lot cheaper. Now if you only use pirated software anyway, which you get for free, then obviously this is not much of an incentive. It is only for people who pay for their software. But that is a significant market. Of course the big downside is that the track record of tamper resistant hardware has not been too strong lately! If a system like this gets into widespread use and somebody finds out that shooting X-rays at the chip exposes its secret key, you've got a big problem. Hal

2 1

Key Escrow Rule
by John Young 17 Dec '03

17 Dec '03

The Federal Register of December 13, 1996 has published "Licensing of Key Escrow Encryption Equipment and Software" This parallels the draft regulations for encryption export provided by Steptoe & Johnson on December 11 but sets provisions specifically for key escrow products. We've put it at: http://jya.com/ke121396.htm (39 kb) Here are excerpts from the opening: ----------------------------------------------------------------------- This interim final rule amends the Export Administration Regulations (EAR) by imposing national security controls on Key escrow information security (encryption) equipment and software transferred from the U.S. Munitions List to the Commerce Control List following a commodity jurisdiction determination by the Department of State. This interim final rule also amends the EAR to exclude key escrow items from the de minimis provisions for items exported from abroad and to exclude key escrow encryption software from mass market eligibility. Further, key escrow encryption software is subject to the EAR even when made publicly available. ... Once transferred, key escrow encryption items will be controlled for national security reasons. A license will be required from the Department of Commerce to all destinations, except Canada. This is an initial step in liberalizing the treatment of encryption exports. The Bureau of Export Administration is preparing regulations to further implement the Administration's encryption policies, which will be published in the Federal Register in the near future. ...

1 0

BXA Crypto Meeting
by John Young 17 Dec '03

17 Dec '03

Federal Register: December 12, 1996 ----------------------------------------------------------------------- Bureau of Export Administration Information Systems, Technical Advisory Committee; Notice of Partially Closed Meeting A meeting of the Information Systems Technical Advisory Committee will be held January 7 & 8, Room 1617M-2, in the Herbert C. Hoover Building, 14th Street between Constitution and Pennsylvania Avenues, NW., Washington, DC. This Committee advises the Office of the Assistant Secretary for Export Administration with respect to technical questions that affect the level of export controls applicable to information systems equipment and technology. January 7 General Session 9:00 a.m.-12:00 p.m. 1. Opening remarks by the Chairmen. 2. Presentation on Office of Exporter Services outreach program. 3. Update on status of Export Administration Regulations. 4. Public discussion on encryption issues. 5. Other comments or presentations by the public. Closed Session 6. Discussion of matters properly classified under Executive Order 12958, dealing with U.S. export control programs and strategic criteria related thereto. January 8 Closed Session 7. Discussion of matters properly classified under Executive Order 12958, dealing with U.S. export control programs and strategic criteria related thereto. The General Session of the meeting is open to the public and a limited number of seats will be available. To the extent time permits, members of the public may present oral statements to the Committee. Written statements may be submitted at any time before or after the meeting. However, to facilitate distribution of public presentation materials to the Committee members, the Committee suggests that public presentation materials or comments be forwarded at least one week before the meeting to the address listed below: Ms. Lee Ann Carpenter, TAC Unit/OAS/EA, Room 3886C, Bureau of Export Administration, U.S. Department of Commerce, Washington, DC 20230 Dated: December 6, 1996.

1 0

Life with Dale
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

:From: Dale Thorn <dthorn(a)gte.net> :I spent part of my growing up years in Leroy West Virginia, pop. :about 15, give or take. I know about hillbillies, and I know about :guns. :If you had the impression I am a whiner, or that that defines me as a :person, you're about as clueful as the other old farts who attack :people they don't know anything about. Name one thing Dale has not experienced.

5 12