December 2003 - cypherpunks-legacy

Re: [NOISE] aga isn't on cypherpunks... (and I'm glad)
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> > That is your last warning, Mike. If you start harasing my postmaster, > I will have your fucking ass in Federal Court before you can blink. > I on the other hand can kick your ass because I am in the UK and I look forward to doing so immensely unless you stop sending shit to the list... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

3 2

SSLeay Legality FAQ
by cjh＠osa.com.au 17 Dec '03

17 Dec '03

Folk, Here's version 1.4 of the SSLeay Legality FAQ. Additions since 1.3 are in the areas of import/export controls in various countries. Enjoy! ---------------------------------- Cut Here ---------------------------------- SSLeay Legality FAQ Version 1.4 Outline: Disclaimer Legality/Patent Rights table Export Considerations Patent Considerations References For more information Credits Disclaimer: This document may contain gross errors, and neither Clifford Heath nor Open Software Associates Limited accept any liability for same. Users should do their own research and receive professional legal advice. With regard to the legalities of using SSLeay, there is a number of geographical considerations, and a number of kinds of legal considerations. Legality/Patent Rights table: I've broken the legal considerations into "legal" (will the govt come after you :-) and "license" (who do you need to pay patent royalties to). Algor: Location: Purpose: Legal: License: Ref: DES world-wide any mostly# public domain RSA US indiv/free only RSAref free RSA RSA US commercial RSAref/BSAFE from RSADSI* RSA DH US ? mostly# Cylink+ DSA/DSS (based on Diffie-Hellman) RC4/2 US any mostly# from RSADSI RSA RC4 elsewhere any mostly# seems safe IDEA US/Europe/Japan indiv/free mostly# free ASCOM IDEA US/Europe/Japan indiv/commercial mostly# $US15, ASCOM ASCOM IDEA US/Europe/Japan company site mostly# from ASCOM ASCOM IDEA elsewhere any mostly# free SAFER world-wide any mostly# free Safer MD2 world-wide PEM only yes free@ rfc1319 MD5 world-wide any yes free@ rfc1321 SHA world-wide any yes free Any(!) France any only with (almost unobtainable) permit Any(!) Russia any only with permit Notes: * RSADSI's patent on RSA (#4,405,829) runs out on 20 Sep 2000. RSAref is free under certain terms, otherwise can be licensed through Concensus. BSAFE is stronger and has RC4 but requires purchase and royalties: $25K up front, royalties the larger of 2% or $2, royalty prepayment of $5000 per annum required in subsequent years covers 50% of royalties over the following year. + DH by itself cannot be used for digital signatures - the El Gamal extension provides this. CYLINK claim their DH patent covers El Gamal. The US patent #4,200,770 runs out on 29 April 1997. The Canadian patent (#1,121,480) registered 6 April, 1982, runs out in 1999. @ Acknowledgement is required - see the RFC. # Many countries have nominal export controls, including the UK and Australia, but I only know of them being enforced in the USA. MD2/5 and SHA are not subject to export controls anywhere that I know of. Export considerations: The USA has regulations under ITAR (International Trade in Arms Regulations) which categorises "cryptographic and ancillary devices" as munitions. Two classes of export licenses are granted: Distribution Licenses or DL's and Individual Validated Licenses or IVL's. To get an IVL you must say who the customer is and why he needs DES (or 3X DES, etc.). One may then use the IVL to export to the approved end user. Thousands are granted every year and very few applications are rejected. Systems which use cryptography for decryption only, authentication only (e.g. Kerberos authentication as available from Cybersafe and others), or can only be used for protecting financial data (e.g Cybercash etc., as long as it cannot be used for arbitrary messaging) are more-or-less readily granted a DL. DLs have also been granted for some implementations of RC4/40 bits (e.g Netscape). Canada has back-to-back agreements with the USA's ITAR controls, so it's easy to get crypto from the USA to Canada but you can't export from Canada. More information is available from Customs Canada (Revenue Canada) and Department of External Affairs and these URLs: http://axion.physics.ubc.ca/ECL.html - Excerpts from the Export Control List of Canada, and http://insight.mcmaster.ca/org/efc/pages/doc/crypto-export.html Canada's export controls. Many other countries have export controls (UK, Australia and others), but enforcement is less stringent than in the USA. In Australia, export of cryptographic software is controlled by Customs Regulations 13B (military technology) and 13E (Dual Use Technology). The regulations are administered by the Defence Signals Directorate - mail to "Director, Strategic Trade Policy and Operations, Dept of Defence, Anzac Park West Offices APW1-1-OA1, Canberra, ACT" or fax (06)266-6412 and ask for their "Australian Controls on the Export of Technology with Civil and Military Applications". The Australian regulations are also online at http://www.austlii.edu.au/cgi-bin/sinodisp.pl/au/legis/cth/consol_reg/cer43… Software is defined as "one or more programs fixed in any tangible medium of expression", which explicitly leaves electronic shipment uncontrolled. Don't carry or mail media with SSLeay-based software out of Australia - email or FTP it instead! The UK Gov't is funding a project at Royal Holloway College which contains Key Escrow provisions. Watch for the EC DGXIII introducing European legislation under the banner "European Trusted Services", or visit http://www.modeemi.cs.tut.fi/~avs/eu-crypto.html, ftp://ftp.dcs.rhbnc.ac.uk/pub/Chris.Mitchell/istr_a2.ps, ftp://ftp.cl.cam.ac.uk/users/rja14/euroclipper.ps.Z France disallows *import* and use of crypto technology without a permit, and Russia requires a permit for use also. Patent considerations: According to 35 U.S.C. 271 (a), "whoever makes, uses, offers to sell, sells or imports ... infringes the patent." In other words, you better ensure that you *compile out* and patented algorithms unless you intend to license them, even if the code is not executed. In fact, if you are in the USA, merely ftp'ing SSLeay into the USA is a breach of various patents. (Eric, you might consider splitting it into two ftp archives, one for the USA and an additional one for the rest of the world.) References: RSA: http://www.rsa.com/ CYLINK: http://www.cylink.com/products/security/ ASCOM: http://www.ascom.ch/Web/systec Safer: ftp://ftp.isi.ee.ethz.ch/pub/simpl/ For more information: http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm - Crypto Law Survey Credits: Thanks to to Eric Young, Rich Salz, Donald Lewine, Holger Reif and Bruce Schneier (author of Applied Cryptography), Peter Trei, Remo Tabanelli, Ben Laurie, Ulf Moeller, Michael Taylor for their contributions. ------------------------------------------------------------ Clifford Heath cjh(a)osa.com.au Open Software Associates Limited 29 Ringwood Street / P O Box 401 Phone +613 9871 1694 Ringwood VIC 3134 AUSTRALIA Fax +613 9871 1711 ------------------------------------------------------------ Deploy Applications across the Internet and Intranets! Visit our Web site at http://www.osa.com

1 0

Re: Does John Gilmore...
by Dave Hayes 17 Dec '03

17 Dec '03

> On Tue, 19 Nov 1996, Dave Hayes wrote: > > Black Unicorn writes: > > > Dave Hayes writes: > > > > > Again, you confuse free speech with free broadcast. > > > > Isn't broadcast a subset of speech, especially in this culture? > > > That which is broadcast is certainly speech. > > > Trying to draw some kind of "right to be broadcast" as a result is > > > stupidity or ignorance, or both. > > Then I suppose you want to control all mailing lists, USENET groups, > > and web pages. These are broadcasts, and of course they have no rights > > other than what you seem to want to give them. > If I owned it, of course I would control it. If you really owned it, you would not need to control it. > You are simply exhibiting the symptoms of a spoiled brat because you have > been fortunate enough, thus far, to rely on the benevolance of whoever is > providing you your newsfeed. Methinks you know not to whom you are speaking to. Those that know may see just how the seeds of assumptions are sown in this person's mindset. > The fact that control is not exercised, does not mean it doesn't > exist. In reality control is exercised in many ways. The fact that control exists does not mean it is effective, necessary, or appropriate. Unchecked need to control is merely an outward sign of a lack of inner control, which is a disease most control freaks have. > Thus your attempt to demonize me merely exposes your ire for the system as > it now exists, your fanciful dreams of how it should be aside. I am not attempting to demonize you...you do that to yourself well enough. I have no interest in your support or opposition, other than as a tool to show those who can see where certain specific attitudes come from. > This is where you fail, with the basic inability to distinguish ownership > of intellectual content and the right to compell its broadcast by whomever > might control the medium. I maintain that it is neither appropriate nor in any sense beneficial to apply this kind of draconian control to internet communication in the general sense. > > > Learn the difference. Go to law school before you argue free speech > > > concepts in any detail. > > "Laws" do not cover the net's "multicast" technology. > >Snort< I suppose you live in the only true anarchy? Why is it that when less regulation is desirable, the kneejerk response is to declare that desire anarchistic? Human attempts at creating and imposing "law" are arbitrary, inefficient, and subject to change based on the whim of those who claim to own their implementation. > > Distinguishing communication types so as to control those who use them > > is not going to solve your problem. You are much better off, from a > > practical standpoint, learning to control what you see and hear rather > > than attempting to control others. > I'm not sure what the above babble means. Hence your attempt to control others. > I'm not sure you are either. Hence your inability to understand the concept of "honor". > > One does not need a school to see this, it sits under one's nose like > > a milk moustache. > This is the uneducated man's excuse. "Education" has very little to do with knowledge and a lot more to do with external approval, in the sense you appear to be using it. "Indoctrination" and "Conditioning" are the two terms that best fit your apparent notion. We all know how far those have gotten us in the past 2000 years. One can see this "progress" by looking at the net's attempts to control Mr. Grubor... ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet A king who feared wasps once decreed that they would be abolished. As it happened, they did him no harm. But he was eventually stung to death by scorpions.

4 4

Social Security workers in bribery plot
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Copyright c 1996 Nando.net Copyright c 1996 From staff and wire reports NEW YORK (Nov 20, 1996 4:42 p.m. EST) - Several Social Security Administration employees have been charged with giving confidential consumer information to credit card thieves in exchange for bribes as low as $10, authorities said on Wednesday. [...] The investigation began in February when investigators for Citicorp's Citibank found that a large number of Citibank credit cards had been sent to customers but never received. But the cards had been activated. [...] The Social Security Administration then conducted security reviews to determine if any employees had accessed files of individuals. Gimlett said the investigation was significant because it demonstrated "the reality that employees of government agencies or corporations who have access to personal information may take advantage of their position of trust to steal personal information and sell it for financial gain." [...]

1 0

No Subject
by Giulio 17 Dec '03

17 Dec '03

Unsuscribe Cypherpunks Giulio <gexing(a)mbox.vol.it>

1 0

NT insecurity
by jmr＠rmisp.com 17 Dec '03

17 Dec '03

Well, for those uninformed out there who believe that you can penetrate an NT box using NTFSDOS, the problem remains that security in windows NT is a combination between the filesystem NTFS and the actual operating system, NT. NTFSDOS only allows reading the drives, not writing to them. NT also keeps the security registry keys/information in approximately 25 areas, not in 1 password file. So.. ya can't "erase a password file under NT" because they don't exist. There's my 2 cents for this 60+ letter a day mailing list. Justin Michael Robbins of Dreamage Technologies jmr(a)rmisp.com0000,0000,8080"> warlock(a)thepentagon.com Please use the 1-888-401-2862 Paging/Messaging system for immediate response.

3 2

Re: Rogue Governments Issuing Policy Tokens
by Hal Finney 17 Dec '03

17 Dec '03

From: "Timothy C. May" <tcmay(a)got.net> > The problem (for GAK) of "rogue governments" is this: a government such as > Libya or Panama, henceforth to be known as "Rogueitania," issues policy > cards to all of its citizens, and to all those visiting Rogueitania, and > perhaps through the mail to anyone who pays some fee. I don't think this would happen. Some kind of secret information or hardware is going to be needed to create policy tokens. (Otherwise anybody could make one.) That means that HP, and therefore ultimately the U.S. government, is going to have to approve those governments which are allowed to issue such tokens. HP will have to provide them some special hardware or something to make them. The tokens will only be accepted if they have proper secrets inside them. I can't see the U.S. allowing Libya and similar countries to create policy tokens. The whole point of this exercise is to prevent these countries from being able to use strong crypto. So they will certainly not be on the approved list. Does this represent an attempt to establish a de facto U.S. hegemony over the world, where the U.S. government gets to decide which other governments have access to crypto? Not necessarily; other countries will still have the option to use computers made outside the U.S. The fact of international competition will still exist. If the HP initiative does become a widespread standard (which I think is unlikely at this point) then we will see the same sorts of flight towards non U.S. computers that we now see towards non U.S. crypto companies. Why should an Israeli company buy an American computer with a policy chip that is ultimately under the control of the U.S. government when they can get one locally made which has no such restrictions? And of course all this focus on hardware tokens ignores the fact that the alternative of software-only crypto will still be present, both for the domestic market and for the international market where the products don't come from the U.S. This will represent additional competition which the HP proposal must face. For these reasons I don't think the HP idea solves the export problem for U.S. hardware and software makers. And the response by opinion leaders has ranged from ho-hum to negative, despite the self-serving cheerleading by HP management. Companies which try to sell computers with these chips in them risk getting a "big brother inside" (to use Tim's very effective slogan) reputation. I think this initiative is going nowhere. Hal

9 9

Re: US supporting dissidents? (was Re: Rogue Governments Issuing Policy Tokens)
by Alan Olsen 17 Dec '03

17 Dec '03

At 06:52 PM 11/20/96 -0500, Jeremiah A Blatz wrote: >Trademarks are not copyrights. There is no fair use for trademarks. In >addition, civil suits are not criminal trials. The USG can't throw >your ass in jail for making "big brother inside" stickers, but Intel >can sue your ass off. >In a related note, you may be safe from lible suits... Make you wonder how Mad magazine has gotten away with it all these years... (Maybe we could get Mad to print them! Would make an interesting cover...) ObSpyVSSpy: Mad TV (on Fox) has been running animated Spy V.S. Spy cartoons. (Usually one or two per episode.) Probibly best thing about the show. (I mentioned this because one "prominent Cypherpunk" at Orycon had not known about them.) --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Cyber Power in Forbes
by Duncan Frissell 17 Dec '03

17 Dec '03

Dayglo Yellow on dayglo pink cover of the December 2, 1996 Forbes. Wired Envy. CYBER POWER gives financial markets a veto over the President and Congress by Peter Huber DCF

4 3

RE: FUCK YOU punk
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

_______________________________________________________________________________ From: aga on Wed, Nov 20, 1996 15:24 Subject: FUCK YOU punk/was:Taking out the garbage To: freedom-knights(a)jetcafe.org Cc: cypherpunks(a)toad.com >If you try to make or enforce any rules and YOU DIE cocksucker! You might want to watch yourself. It would be hard to *not* see this as a direct threat... >Your presents shall be totally eliminated form this InterNet! ^^^^^^^ Yeah, Lucky! You better watch out, or there'll be NO CHRISTMAS!! :-) >Your connection will be TERMINATED at once! Suddenly, agatha is everyone's sysadmin... >fuck you punk, and fuck all of your "rules" Whether stated or not, there _are_ certain guidelines (or rules) we all should follow, just so we aren't *ASSHOLES*... >-aga

2 1