December 2003 - cypherpunks-legacy

White House statement on CDA decision (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 26 Jun 1997 14:21:06 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: White House statement on CDA decision THE WHITE HOUSE Office of the Press Secretary June 26, 1996 STATEMENT BY THE PRESIDENT Today, the Supreme Court ruled that portions of the Communications Decency Act addressing indecency are not constitutional. We will study its opinion closely. The administration remains firmly committed to the provisions -- both in the CDA and elsewhere in the criminal code -- that prohibit the transmission of obscenity over the Internet and via other media. Similarly, we remain committed to vigorous enforcement of federal prohibitions against transmission of child pornography over the Internet, and another prohibition that makes criminal the use of the Internet by pedophiles to entice children to engage in sexual activity. The Internet is an incredibly powerful medium for freedom of speech and freedom of expression that should be protected. It is the biggest change in human communications since the printing press, and is being used to educate our children, promote electronic commerce, provide valuable health care information, and allow citizens to keep in touch with their government. But there is material on the Internet that is clearly inappropriate for children. As a parent, I understand the concerns that parents have about their children accessing inappropriate material. If we are to make the Internet a powerful resource for learning, we must give parents and teachers the tools they need to make the Internet safe for children. Therefore, in the coming days, I will convene industry leaders and groups representing teachers, parents and librarians. We can and must develop a solution for the Internet that is as powerful for the computer as the v-chip will be for the television, and that protects children in ways that are consistent with America's free speech values. With the right technology and rating systems - we can help ensure that our children don't end up in the red light districts of cyberspace.

1 0

Final Version of RealPlayer 4.0 with RealVideo Available for FREE Download
by RealAudio & RealVideo News 17 Dec '03

17 Dec '03

Dear RealPlayer User, Thank you for using RealAudio and RealVideo. We are pleased to tell you that the final versions of RealPlayer and RealPlayer Plus 4.0 with RealVideo and RealAudio have been released. You can upgrade to version 4.0 by visiting: http://www.real.com/40/index.html RealPlayer 4.0 features better video quality over dialup connections, direct access to daily news and entertainment, and more. RealPlayer Plus 4.0 offers several enhancements to the free RealPlayer: - The Best Quality Audio and Video at 28.8 - One-button Scanning for the Best Live Audio and Video on the Web - Instant Access to Your Favorite RealAudio and RealVideo Content - Free Telephone Technical Support - 30-day Money Back Guarantee RealPlayer Plus 4.0 is available from: http://www.real.com/40/order.html We hope you enjoy RealPlayer and RealPlayer Plus 4.0! Rob Glaser Chairman & CEO Progressive Networks --------------------------------------------- For information about this e-mail including how to subscribe to or unsubscribe from future announcements, please visit: http://www.real.com/mailinglist/index.html

1 0

breaking RSA in hardware (was Re: Comparing Cryptographic Key Sizes II)
by Adam Back 17 Dec '03

17 Dec '03

Peter Trei <trei(a)process.com> writes: > > [DES breaking] > > [useful stats] > > So, to summarize: > > Using GNFS, on clients with 128M of memory, you could factor a 512 > bit modulus in 28,000 MIPS years. With 500,000 MIPS years, you could > factor a 600 bit modulus. > > Using QS, in 500,000 MIPS years you could factor a 512 bit modulus on > machines with modest memory requirements. Remarkably close to my original figure :-) (same as DES I said, you estimate DES to be 475,000 MIPS). So, even though GNFS is faster, if we don't have the hardware, it'll be better to use QS because using GNFS whilst continually paging will be even worse. > The effects of memory speed and bandwidth would slow things down > somewhat. Yup. With DES software is not at all an efficient way to break DES, compared to a Wiener machine. Unfortunately the press releases have had very little to say about the true cost of breaking DES with hardware. Perhaps it would be interesting to look at the economics of a well funded attacker breaking a 512 bit RSA key. If we asume that they would do it in software, and had to buy the machines, would you be better to buy fewer workstations with 128Mb or lots with 16Mb. Factor of 17 speed up using GNFS acording to your estimates of DES, and Lenstra's for GNFS RSA. So perhaps we're looking at motherboard $100, cpu $100, PSU+case $100 + 16Mb RAM $100 = $400. The same, but with 128Mb $1100. So that's a 1100 / 400 = 2.75 ratio. Clearly buying the larger memory PCs is the way to go. Overall GNFS is 6x cheaper it would appear. However, really the interesting question is how much would it cost to break RSA in hardware. How expensive would it be to build a custom hardware machine to break RSA. What building blocks would be needed. How much memory. What would be the most efficient approach. Would it be cost effective to use NTTs RSA chip? What would be the most efficient way to distribute the memory. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Adults Only!
by Lola.X＠worldcom.ch 17 Dec '03

17 Dec '03

Nude Spring Break 1997!! http://www.spring-break97.com/ Naked Teenage Girls Partying on Miami and Ft Lauderdale Beaches!! THOUSANDS OF ALL ORIGINAL PICTURES!! XXX, AMATEUR, TEENS, LESBIANS, AND MORE!!! See These Real Teens NUDE or In Little G- String Bikinis! Fresh New Tender Breasts Barely covered! http://www.spring-break97.com/ Special NEW Section: Nude Runaway Teenagers!!! BONUS!!!!!!!!! Instant Access To Over 1,800 WebSites!! Special Voyeurism pictures, 1,000's of celebs, S and M, teens, amateurs, gay-lesbians, XXX, older women, older guys younger girls, Blowjobs, cumshots, free video sex, much much more! SPRING BREAK '97 WHAT ARE YOU WAITING FOR???????????? http://www.spring-break97.com/

1 0

Re: NEWS.COM - Rumor Mill
by Declan McCullagh 17 Dec '03

17 Dec '03

Not a rumor -- it's true. Crowell was wandering around wondering what was going on. The excuse was that ~60 votes were scheduled on the Senate floor yesterday. -Declan At 14:26 -0700 6/26/97, Alan Olsen wrote: >No Freeh lunch? > > >http://www.news.com/Rumors/0,29,,00.html > >At the end of the article... > >While hackers were getting busy, the crypto honchos were >getting dissed in D.C. Apparently, a group of bigwigs, >including Louis Freeh of the FBI, William Crowell of NSA, >Peter Neumann of SRI, and Ray Ozzie of Lotus, flew all the >way out to the nation's capital for a Senate Judiciary >Committee hearing on cryptography, only to be informed 20 >minutes before the meeting that it had been canceled. >Grumbling ensued as the various participants stormed back >to Dulles airport. The meeting may pick up after the July 4 >recess.

1 0

Supreme's decisions...
by Jim Choate 17 Dec '03

17 Dec '03

CDA...Yeah! Assissted suicide...Boo! ____________________________________________________________________ | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

ATMs a better target (was: breaking RSA in hardware)
by Steve Schear 17 Dec '03

17 Dec '03

At 10:51 PM +0100 6/26/97, Adam Back wrote: >Peter Trei <trei(a)process.com> writes: >> > [DES breaking] >> >> [useful stats] >Perhaps it would be interesting to look at the economics of a well >funded attacker breaking a 512 bit RSA key. If we asume that they >would do it in software, and had to buy the machines, would you be >better to buy fewer workstations with 128Mb or lots with 16Mb. Factor >of 17 speed up using GNFS acording to your estimates of DES, and >Lenstra's for GNFS RSA. > >So perhaps we're looking at motherboard $100, cpu $100, PSU+case $100 >+ 16Mb RAM $100 = $400. The same, but with 128Mb $1100. > >So that's a 1100 / 400 = 2.75 ratio. Clearly buying the larger memory >PCs is the way to go. > >Overall GNFS is 6x cheaper it would appear. > >However, really the interesting question is how much would it cost to >break RSA in hardware. How expensive would it be to build a custom >hardware machine to break RSA. What building blocks would be needed. >How much memory. What would be the most efficient approach. > Seems that unless future crypto breaks compromise something everybody can appreciate, they be little lasting PR value. Colin Plumb, colin(a)nyx.net, said >I don't know if everyone is aware, but all of the ATM cards floating aroud use DES to protect the PIN. With ine key sealed in tamper-proof. Wouldn't *that* be a fun key to have? >The details are published somehwere. Basically, you encrypt some card info to get a 16-character hex string. Some 4 nybbles of that, reduced mod 10 (so 0-5 are more likely than 6-9) are the "master PIN". >An offset from this (added per-digit, mod 10) is stored in clear on the card to allow programmable PINs. But most cards ship with the offset set to 0 and the default PIN is the master PIN. >You just need a few people with closed accounts to volunteer their ATM cards to mag stripe readers. The work would be somewhat greater since you need to do multiple decryptions to get a full validation; you'd need to do weed out the impossible in stages. >I'm not sure if the fraud possibilities (it lets you recover the PINs from stolen ATM cards) are worth it, but it would sure raise a ruckus... -- > -Colin The crack project should publish all schematics and source prior to the project start and the key server should definitely be offshore, since US regulatory agencies might step in to prevent the experiment from reaching its conclusion. I think one of the list's lawyers should investigate the legal risks to the participants. I have an account I'm willing to donate for the experiment. --Steve PGP mail preferred Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear | tel: (702) 658-2654 CEO | fax: (702) 658-2673 First ECache Corporation | 7075 West Gowan Road | Suite 2148 | Las Vegas, NV 89129 | Internet: azur(a)netcom.com --------------------------------------------------------------------- I know not what instruments others may use, but as for me, give me Ecache or give me debt. SHOW ME THE DIGITS!

1 0

EAR cookbook anyone?
by Rich Graves 17 Dec '03

17 Dec '03

We would like to distribute strong encryption (PGP, Netscape, MSIE, Kerberos, SSH, lynx-ssl, etc.) to people affiliated with our institution without prejudice to their current location, as the Fortune 100 can do with PGP. Today I got management to agree that it would be worth my time to ensure that we do so legally and publicly (though we had already decided to distribute said software to new and continuing affiliates worldwide regardless). There's a lot of examples of ITAR CJR's online, but I don't see any examples of EAR whatchamacallits. Are we really going to need some lawyer for this, or can't I just send Commerce a form letter, say, tomorrow afternoon? Form letters my department can fill in and sign, but paying a lawyer would require a level of bureaucracy that I'd rather not deal with. The deadline in any case would be August 25th. -rich i'm back... if i haven't responded to your mail sent the last week and a half, it's probably because it just wasn't interesting. nothing personal.

1 0

No Subject
by hs 17 Dec '03

17 Dec '03

1 0

Rep. Lofgren on McCain/Kerrey (good. long.)
by geeman＠best.com 17 Dec '03

17 Dec '03

[Congressional Record: June 25, 1997 (Extensions)] [Page E1320] >From the Congressional Record Online via GPO Access [wais.access.gpo.gov] [DOCID:cr25jn97-18] ENCRYPTION BILL: AN EXERCISE IN DECEPTION ______ HON. ZOE LOFGREN of california in the house of representatives Wednesday, June 25, 1997 Ms. LOFGREN. Mr. Speaker, last week the Senate Commerce Committee reported a bill, S. 909, sponsored by Senators McCain and Kerrey, which largely embodies the latest administration proposals to deal with encryption technology. This misguided legislation (S. 909) would be a great leap backward in the effort to reform current American export restrictions on encryption and remove serious impediments to the competitiveness of our Nation's high-tech industry. In addition, by proposing unprecedented domestic controls on the use of encryption, the McCain-Kerrey bill also poses serious threats to fundamental civil liberties and privacy rights. I believe that the Senate effort is propelled largely by a lack of understanding of both the worldwide prevalence of strong encryption and the technical challenges posed by the massive key recovery-escrow infrastructure envisioned in the bill. Earlier this week, Mr. Dan Gillmore, columnist for the San Jose Mercury News discussed the problems with S. 909 and strongly urged a rejection of the McCain-Kerrey approach. I submit his column into the Congressional Record. [From the San Jose Mercury News, June 23, 1997] Encryption Bill: Federal Exercise in Self-Deception (By Dan Gillmor) As a bill bearing his name zipped last week through the Senate Commerce Committee he heads, Arizona Republican John McCain said, ``This bill carefully seeks to balance the concerns of law enforcement with individual privacy concerns.'' The legislation, co-sponsored by Nebraska Democrat Bob Kerrey and two other Democrats, was the latest futile attempt in Congress to achieve the impossible: compromise on an issue that fundamentally has no middle ground. The issue is encryption, the scrambling of digital information. Try as they might, lawmakers must eventually understand the reality. When it comes to the privacy of personal information in the digital age, we have two simple choices. Either we allow people to encrypt their messages, using scrambling and unscrambling ``keys'' to which only they have access, or we do not. Governments are certain that bad people will use encryption to help achieve bad ends. They're right. But their cure would shred our basic liberties. So the Clinton administration and its allies--the McCain- Kerrey legislation is widely viewed as an administration- approved plan--are pushing a policy that would force us to put descrambling keys in the hands of third parties. Then, when law enforcement people wanted to see our communications, they'd simply get the keys from that third party. The McCain-Kerrey bill pretends to stop short of that. It would force government agencies to use only electronic hardware and software that included this key-recovery scheme. It would also require the same system for anyone using a network that is funded in any way by federal funds, including virtually all university networks. While one section calls the system ``voluntary'' for private individuals, the rest of the legislation would make it all but impossible to resist. Hardware and software companies, which so far have resisted the government's moves, will be much more likely to simply give in and build this key-recovery method into all of their products if they have to build it into ones bought by the government. Consumers need options, not monolithic products. Another section of the bill would, in effect, require even private citizens to use such software--and therefore give their keys to the third parties--if they want to buy anything online. People tend to use what they have in front of them. There's nothing wrong with the idea of letting a third party hold onto a descrambling key in certain cases. As former White House official Jock Gill noted recently on an Internet mailing list, all government communications should use such a system so the public can keep an eye on what the government is doing in our name and with our money. We'll need to create a system, of course, where such oversight doesn't end up forcing the public to use exactly the same technology for its own encryption needs--or at least keep private keys out of the hands of centralized third parties. Companies, meanwhile, will need to hold onto the business- related keys of employees, so that vital records won't be lost when someone leaves or dies. But I can't think of many companies that will be happy about giving the vault keys to third parties they can't control. Private citizens also should consider giving their keys to trusted third parties, just as they give their house keys to neighbors when on vacation trips. I intend to do just that-- but it's none of the government's business who gets my personal encryption key. I need strong encryption, as the digital age arrives, because more and more of my life will exist on these public networks. The practical difficulties of setting up a centralized key- recovery system are immense. Even if it could be done, I would never trust such a government-run system to be even remotely secure from corruption. I remember the Social Security employees who sold personal information to outsiders. I've also seen too much evidence that governments tend to abuse liberties when they have too much power--and the McCain-Kerrey bill would allow virtually anyone at any level of law enforcement to have access to private information on the flimsiest pretext, not even requiring a court order. Kerrey's participation in this latest travesty is sad. He needs no lessons in courage. He lost part of a leg in Vietnam. Later, as he stood up to the know-nothings who would ban flag-burning, he noted that our strength comes partly from our ability to express ourselves even in ways that offend many others. Now, however, Kerrey is aligning himself with a much more dangerous crowd of know-nothings: those who'd ban our right to keep private information private. He may believe this is about finding common ground; if so, someone has fed him falsehoods. His proposal, if enacted, would create the worst invasion of our fundamental liberty in many decades. If you care even slightly about your privacy in the future, pick up a pen today and write your Senators and member of the House of Representatives. Tell them to reject the Clinton- McCain-Kerrey approach. Tell them you value your privacy and won't give it up without a fight. And remind them that you vote. ____________________

5 6