December 2003 - cypherpunks-legacy

RE: Silence is not assent (re the Vulis nonsense)
by Blanc Weber 17 Dec '03

17 Dec '03

From: Dale Thorn (in reply to Tim May) If you, Sandy, and the other offenders *really* want to keep the noise down, then next time ask John directly for a reply, and if none is forthcoming, say to the list *once*, "John will not answer up", etc., and let the subscribers draw their own conclusions from the silence, instead of from your inane "defenses". .......................................................... As for myself, I was not speaking for Gilmore nor defending him when I added my reply to the discussion. I brought up an item which others had overlooked (the fact that Vulis had challenged John to censor him) as specific reference to include in their judgement of his actions, as well as illustrating how Vulis had invested a lot of effort in motivating someone into just such a response. As I mentioned in another post yesterday, situations like this, where people overlook elements in an argument, are opportunities for others to "fill in the blanks" or add commentary to clear up the understanding of a situation. It is not unusual for cpunks to post their opinions about an event on the list. The cpunks have strong opinions regarding censorship and there are always arguments about the details of its impropriety or the place of it in a society; the list is a form of cyberspatial "virtual" society, and if the concept of censorship vs private property as it affects the list comes up, it is to be expected that the ideas will be addressed. So I (and others as well) were addressing the *ideas* of censorship & the actions of private property owners, arguing in regard of a more precise & correct understanding of the principles involved, as exemplified by John's actions - but not in place of his own "self-defense" of them. Frankly, most of the long-time members of the list would not need any such statements of defense from John in order to appreciate the nature of the circumstance and the reasoning for his symbolic 'censorship'. .. Blanc

2 1

Re: "Just call the police"...yeah, right
by Scott J. Schryvers 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >The name of the informal logical fallacy Tim May has *not* >made is 'argumentum ad hominem' (literally, 'an argument >to the man'; attacking one's opponent rather than dealing >with the subject under discussion; aka name calling). > >Having said that, while Tim May has not committed a logical >fallacy, neither has he advanced a logical argument. He >has merely stated his conclusory opinion of the other >person's comment. By itself, it adds little or nothing of >substance to the argument. > >Logos out > Uh logos... Deal with it. If I needed some one to walk me through a mailing list when it concerns constructive arguements I'd be requesting a moderated list and since I find moderated news groups to be nonproductive affairs I tend to find this mailing list perfect for my needs. As for judging if Tim has advanced the arguement or not that is for each person to decide not you. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMqXvk/+hzPlzwZAdAQF5Lgf/e3/99SUkd9aADGeS8UjYYcSxTuH8LxE5 AdvIRgLmv11BdTgcyK+q03MYV1gGjmZmtWtEuCiPN/O39gtMM4RYcz2/c5f7bMMA h8QwKP9h4RNA1dWgDDF54PQuKElMr9SBJJwLdyYwPddkjjVEs0tjFRoJv2MsEkmB nK3REFH75U6F7q0NZB8IHxBbYNDYbTejRcx5yfP+W1lg2cLK2lonis/G4X6Kj7gu BdNLn3PLS6qr1YgTB1gWQD5JzCN6FJ7Gw0snjALLFbG0QbiMLJd7TT/bWc8ExDoo HUg+U4OKZ/oPLzNMiZqvzn9gMjGKWz0+hQbi8kR1f8OT/5+bJ4CFjw== =xM3k -----END PGP SIGNATURE-----

1 0

No Subject
by Lurker 17 Dec '03

17 Dec '03

Could someone tell me where I can find a text file of *all* usenet newsgroups?

1 0

Suggestion for "the serious encryption customers" to end ITAR battle
by Ernest Hua 17 Dec '03

17 Dec '03

I think we can all agree that the level of confidence in software-only approaches to security is clearly lower than combination software plus hardware approaches. It is clear that what is available over the Internet is software. (It is much harder to distribute "hardware" as you can only really distribute design information. The closest analogy could be a FPGA program, a Verilog description or some other ASIC net list.) How about the following as an approach to resolving the dispute over encryption exports: 1. Allow arbitrary exports of software-only encryption. This means that PGP is exportable as is DES crypt libraries. 2. Restrict exports of hardware-only or hardware/software encryption. This means that smart cards, HP's crypto policy cards, crypto processors with tamper-resistant casing, etc ... are restricted. Why does this make sense? 1. Reality check on export control of software: Software is just too transportable to be restricted, no matter WHAT the software does. Any restriction on WHERE software may be or may go is just not feasible, and it's not going to get any easier in the foreseeable future. 2. Take John Deutch at his word: Deutch has claimed that "serious users of cryptography" would not trust software downloaded over the Internet. We clearly do not agree with him on this aspect, but if he truly believes it (and is not just making PR spin statements for the NSA), then he must believe that allowing software exports will not significantly increase the user base (and therefore, harm CIA's or NSA's intelligence capabilities), but it will shut up the software companies' complaints. 3. Give the NSA what it wants: Software tends to standardize. Encryption is only a small part of the chain of security measures. Other weaknesses are surely part of the NSA's target for intercepts (no self-respecting codebreaking agency should stick to exploiting only one class of failures; if it is, we should question the value we are getting out of the billions of dollars we blindly give to the NSA). If the NSA stops whining about what is too hard to break, then protocol weakness and other non-encryption problems could easily creep into standards, and the NSA would surely have an analytical advantage over anyone else. Since the NSA is happily bragging that it does not even need to crack the code to break in, it should be able to live with hardware-only export restriction. The fact that the NSA is no longer drawing any lines anywhere for software will leave the bad guys guessing as to what it can really decode. In addition, hardware manufacturers will probably have a tougher overturning export restrictions on hardware-enhanced solutions after that because software companies will probably not care. It is clear that the NSA only trusts hardware implementations, as it required Clipper to be manufactured in tamper-resistant cases. All constructive replies welcome. Ern

2 1

Confirmation for subscribe cryptography
by Majordomo＠c2.net 17 Dec '03

17 Dec '03

-- Someone (possibly you) has requested that your email address be added to or deleted from the mailing list "cryptography(a)c2.net". If you really want this action to be taken, please send the following commands (exactly as shown) back to "Majordomo(a)c2.net": auth 727e8b91 subscribe cryptography cypherpunks(a)toad.com If you do not want to this action taken, just ignore this message and no action will be taken. If you have any questions about the policy of the list owner, please contact "cryptography-approval(a)c2.net". Thanks! Majordomo(a)c2.net

1 0

Why Cryptography is harder than it looks?
by Brent Cunningham 17 Dec '03

17 Dec '03

Can you please either: 1) email me a copy; or 2) give me a pointer as to where I can get a copy; of Bruce Schneier's paper on "Why Cryptography is harder than it looks?" Much appreciated. - Brent Check out the Network Computing review of Entrust: www.nwc.com Brent Cunningham Nortel Secure Networks Post Office Box 190 Ramona, California 92065 Tel: 619 788-7676 Fax: 619 788-9696 Email: bc1(a)entrust.com www.nortel.com/entrust

5 4

[crypto] Avatar Protection?
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

A graphic-designer friend of mine and I were talking about VRML avatars, and custom design work, and could he offer a service designing them etc... His worry is that since everyone in the same virtual environment as his customer would see the designer avatar, wouldn't they also be able to easily rip off his work? (or his customer's property, take your pick.) I wasn't sure...it seems to me that I read something vaguely along these lines for a cryptography protocol of some sort.. The problem is this: Is there a way for a user to "view" the client's avatar (and in this sense, the user usually has to receive a copy of the code to render the avatar and render it on the local machine) but not save a copy? Assume that a client with no save feature is not a viable option...too easy to work around. I suppose an analogy would be: Is there a way for a person to see the plaintext, but not record it? I think that question really answers itself - no. How about alternatives? If the server of the environment only renders "views" (say, certain angles, or a bitmap) of the avatar, rather than sending the description file? Any other thoughts? Ryan

5 4

No Subject
by Jose Luis Delgado 17 Dec '03

17 Dec '03

unsuscribe cypherpunks

1 0

RE: Anyone considered adding crypto into Microsoft Outlook?
by Robert Barnes 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have downloaded, and strongly recommend, Jon S. Whalen's Microsoft Exchange Client PGP Command Extension. It adds PGP functionality to Exchange Client in a very neat and clean way. Rob -----BEGIN PGP SIGNATURE----- Version: 2.63ui iQCVAwUBMqYkarl39AMaT2JtAQHmtQP/Yu8rh5OkkMC1GVEnz4hY6xFczeDM0Y3U 7toMIDZLVnDwRXuoo9+10sUMnB289mkjoi54fuAhbkjDKYejXVIFilJoSFq+s5FZ K0Rdcaj8qv6VkJwL63gXMdXsFlxHIyQ/oK9/3r7tBgFyzab3tcjVXUGRy/NE5sLD osrJm4WzfVU= =+ffh -----END PGP SIGNATURE-----

1 0

Re: Strong-crypto smart cards in Singapore and Germany
by um＠c2.net 17 Dec '03

17 Dec '03

Peter Gutmann writes: >The standardisation committee of the German banks have also produced >an electronic wallet which should have 25 million (yes, 25M) users by >January of next year. Again, this is a pure electronic wallet, with >2-key triple DES and 768-bit (to become 1024-bit) RSA encryption. >[...] This looks like a very nice system, and unlike Mondex doesn't >rely entirely on the hope that criminals can't get at the data on the >card. For 'security reasons', all transactions are logged in what is called 'shadow accounts'. Not what I would call a very nice system.

1 0