December 2003 - cypherpunks-legacy

2
by TruthMailer 17 Dec '03

17 Dec '03

Anon-To:

1 0

Re: spook pressure on crypto exports
by Adam Back 17 Dec '03

17 Dec '03

Ian Grigg <iang(a)systemics.com> writes: > Bill said: > > ... and have been trying to work on the Irish...) > > and Adam said: > > Ireland is new to me. What's their problem? > > Ditto! I'd like to know because ... > > > Who's exporting things to attract spook export attention over there? > > Systemics is an Irish company, and so is Baltimore, and we both > are 'exporters' depending on one's viewpoint. So's SSE (subsidiary of Siemens-Nixdorf). But that's mostly/all defense stuff, so they're presumably in thick with the military intelligence, and export permission would be a snip for them. > I don't know about Baltimore, but there is not a lot of pressure > they can put on Systemics, as the majority of the Cryptix effort is > now handed over to non-Systemics people. That's the beauty of > freeware. Ireland allows intangible export, no permission required, same as UK. They do say they would like a list of customers after the fact, but that's just would like, not you are required to give or else. (Clearly it would be a bit difficult to list the customers off your open access web page). For tangible exports you need permission, much as in the UK. I get the impression that the `open for business' attitude (love that 10% corporate tax break, is systemics getting this?) would mean you'd get an easier time than in the UK. They promise fast efficient turn around on export applications. (Unlike NZ MFAT, reread Peter Gutmann's story of down under intrigue on http://jya.com/nsazeal.htm amazing, nearly bankrupted the company!) > In contrast, I have been told that Ireland represents a prime place > for this sort of stuff, as there are no restrictions whatever. I think it's better than say UK. But clearly not `no restrictions' at least for tangible exports re above comments. I don't know how this works out in practice, what they give tangible export permission to, etc. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Netscape, 128-bit export
by Ariel Glenn 17 Dec '03

17 Dec '03

from their web site, at http://www.netscape.com/flash2/newsref/pr/newsrelease428.html --- MOUNTAIN VIEW, Calif. (June 24, 1997) -- Netscape Communications Corporation (NASDAQ: NSCP) today announced the United States Department of Commerce has granted the company permission to export Netscape Communicator client software with 128-bit encryption capabilities. Available for immediate download from the Netscape Internet site, Netscape Communicator with strong encryption would allow users worldwide to enjoy far greater protection for their information when communicating with certified, strong encryption applications on Intranets and the Internet. Netscape also received approval to export Netscape SuiteSpot server software featuring 128-bit encryption capabilities to certified banks worldwide. VeriSign will be providing a special-use digital certificate which enables the encryption. This will allow Netscape Communicator users to access their banking information from almost anywhere in the world and communicate using strong encryption with those banks which have implemented Netscape SuiteSpot servers and completed the certification process. --- some pr crap deleted --- International users who have Netscape Communicator do not need to download a new version of Netscape Communicator to take advantage of the strong encryption capabilities being announced today. Negotiation of the strong encryption between international versions of Netscape Communicator and Netscape SuiteSpot servers approved for export to banks occurs through a unique mechanism based on a special-use digital certificate. etc... ----- So... is this new approval for export of 128-bit encryption only for encryption between the users and these banks, or is it general? If it's general, is GAK built in or not? And if not, how did they get approval? Ariel Glenn / AcIS R&D / Columbia University ariel(a)columbia.edu #include <stddisclaimer.h>

1 0

New PGP signatures
by Mark Grant 17 Dec '03

17 Dec '03

Could I humbly request that people don't post the new (SHA?) PGP signatures to the list for the time being as it's a pain in the ass for those of us outside the US who don't yet have the ability to read them. PGP 2.6.x error handling doesn't know what to do with them and it breaks our mail-processing code. Mark

6 7

Political Prisoner of Intel
by Mike Duvos 17 Dec '03

17 Dec '03

http://www.rahul.net/jeffrey/ovs -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $

1 0

Re: Comparing Cryptographic Key Sizes
by Declan McCullagh 17 Dec '03

17 Dec '03

Thanks, Adam, for sending this along. As it turns out, I'm working on an article about encryption and privacy that will appear in Time Magazine next month. Yesterday I photocopied a few pages of Applied Crypto and printed out the (I believe) February 1996 paper on recommended key lengths and passed them around the office. Your summary is even more handy. -Declan ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0

Re: New PGP signatures (fwd)
by Mark Grant 17 Dec '03

17 Dec '03

On Mon, 23 Jun 1997, William H. Geiger III wrote: > You really need to modify your mail-processing code as you are going to > see more and more of these. You should also start work on implementing the > PGP/MIME RFC as you will be seeing more of these messages. It's kind of hard to modify the code when I'm still waiting for the PGP 5.0 code to be made available. I can't do a lot until people finish OCR-ing it. > Nothing personal but your code should not "break" on any data that is sent > to it. PGP 2.6.x doen't have a problem with these signatures it just > returns a error code and goes on it's way. Precisely; it returns an error and drops out. It *does not* output the signed message to stdout as it would do if it were an RSA-signed message, so it just looks like an empty message. At the moment I have better things to do, but I guess if people are going to use non-standard message formats they don't want us to read what they write anyway. Mark

2 1

1
by TruthMailer 17 Dec '03

17 Dec '03

1

1 0

Re: Hettinga's e$yllogism
by Secret Squirrel 17 Dec '03

17 Dec '03

>1. Government has copy of keys >2. Government misuses keys. > >Simple enough for you? Too simple. Escrow for ecash isn't to allow forging cash, or stealing it. It allows tracing it. If you tell financial experts that making ecash traceable under court order is goint to make electronic commerce impossible, they'll laugh. They already use systems which are even less private than that. Anon

2 1

Re: Hettinga's e$yllogism
by winsock＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

>1. Government has copy of keys >2. Government misuses keys. > >Simple enough for you? Too simple. Escrow for ecash isn't to allow forging cash, or stealing it. It allows tracing it. If you tell financial experts that making ecash traceable under court order is goint to make electronic commerce impossible, they'll laugh. They already use systems which are even less private than that. Anon

1 0