December 2003 - cypherpunks-legacy

Re: Apple crypto engineer position available
by Mark Altenberg 17 Dec '03

17 Dec '03

On 4/14/98, Robert Hettinga blathered on like this: >...Hint 1: Whatsisname Sidhu, > >who negotiated the world's first RSA license, and who probably could have >invented digital commerce on the internet all by himself if he only knew >what he had, already bought and paid for, wasted in a mail and LAN >protocol, buried in the bowels of the MacOS... >...Anyway, a more clueful Sidhu, (who, to be fair, couldn't have understood >what was coming) could have, with just a little of the right prompting :-), >taken some of the money you guys gave to, say, Steve, for instance :-), and >bought the blind signature patent at firesale prices from DigiCash ($10 >million is chump change, even to Apple, even then, :-)) at last year's >greater-fools exchange of ownership at "the world's greatest financial >cryptography company" (my name, not theirs).... > Quite amazing to look at all of the innovation that went on at Apple and wonder what could have been. From my perspective, the big mistake with Apple's first implementation of crypto was that it was part of an architecture (yep, PowerTalk). After close encounters with this and other wonderfully "flexible architectures", I've learned (the hard way) that this is one of the best oxymorons in computerdom. Architectures seem like wonderful, grandiose ways to solve a bunch of problems at once, but they usually lead a Titanic-like existence, eventually sinking into the abyss and taking almost everything with it, including products, businesses, reputations - you name it. Well, an amazing thing happened. Just before PowerTalk started taking on serious water, someone managed to throw DigiSign (Apple's digital signature technology based on RSA public keys) into its own life boat; Apple actually built a separate library for DigiSign that didn't require PowerTalk. But, unfortunately, there was leak in this boat, too. You see, the model for DigiSign's certificates was based on a heirarchy and required a certificate authority and all of the requisite infrastructure. No one had really done this yet so Apple had to do more than create DigiSign and put it into the Mac OS - they had to get this infrastructure in place, too. Now, even though Apple had the help of RSA and BBN, there was this even bigger problem of just helping people get it. The best way to help people understand technology is to make it accessible so almost anyone can play with it and use it. This is what Apple is known for - making technology so accessible that people just go nuts, doing things with it and taking it places no one ever dreamed. That's how Apple catalyzed the transformation of the publishing industry. Requiring a CA to make DigiSign work simply made this impossible. A peer to peer model, allowing people to create and sign their own certificates would have been far more appropriate for Apple's creative users. Then came PGP... C 'est la vie! Mark ---- mark(a)altenberg.com

2 2

Re: Gary L. Burnore, Registered Sex Offender in Raleigh, NC
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

beep(a)ix.netcom.com (Pamela Gross) wrote: > >You're conveniently omitting a few details. He's not just "accused", but > >he was CONVICTED. His right to privacy went away when he committed a crime > >and was PUBLICLY tried and convicted by a court in Santa Clara, CA. That > >conviction is a public record, just like Ron Guilmette's tax lien that > > Is this who you are? > > What exactly is a tax lien? Why did Gary post yours? Were you having > a fight of some kind? Actually Gary Burnore's original beef was with an anonymous whistleblower who notified the victim's mother and school officials of Gary's pedophelia before he was ever arrested for it. (How would a mere troublemaker out to allegedly "harass" poor Gary have even known about Gary's sexual exploits before they became public? And how would he/she have known the identity of the victim which is still non-public information?) Back then he was accusing the poster of "libelling" him and "harassing" the victim. The situation only became public when Gary chose to publicly accuse an anonymous usenet poster of being the same person who had sent the private e-mails which tipped off the victim's mother and high school principal. Unable to track down the whistleblower and subject him/her to the typical DataBasix sort of harassment, he attacked the remailer that was being used, instead. See: http://infinity.nus.edu.sg/cypherpunks/dir.97.11.13-97.11.19/msg00432.html And, yes, one of Gary's forms of harassment against another person was to dig up a 10 year old tax lien on the individual and post it to usenet in an attempt to embarass him and intimidate him into silence with the threat "there more where that came from". See: http://infinity.nus.edu.sg/cypherpunks/dir.97.11.13-97.11.19/msg00424.html When the victim's mother evicted Gary Burnore from her home and eventually advertised for a new roomate in the ba.market.housing NG back on 5/8/97, someone made a followup remark on 6/5/97 which said: "XXXXX finally booted her pedophile boyfriend, Gary L. Burnore, out of the house! Last I heard, he was high tailing it for Raleigh, NC." Note that this was well before Gary ever registered as a sex offender in NC. Gary, never able to able to leave well enough alone, just had to follow up on the post, even though he has wisely chosen to have DejaNews delete his reply. I'm wondering if Gary is worried that someone will expose the fact that his girlfriend with whom he was living and sleeping and whose daughter he molested was also a high-ranking official at a public television station which did business with Gary L. Burnore's company DataBasix. Was that conflict of interest ever disclosed? And since this is the same Gary Lee Burnore who used to confidently declare "I have nothing to hide", I guess it was assumed he wouldn't mind if the truth about him and his sexual quirks were revealed using publicly-available records posted on a public website by the state of North Carolina. And, no, I'm not any of the individuals named above. Careful, Gary. False accusations of libel might just motivate some people to prove that the allegedly libellous statement were, in fact, true. You apparently bluffed and lost.

1 0

RE: Apple crypto engineer position available
by Pablo Calamera 17 Dec '03

17 Dec '03

Bob, In general I agree with your points however your historical perspective on Apple Crypto is far from complete. You forgot to mention that while Apple was flailing there where key people who actually did crypto work and managed to ship great products inspite of Apple. Those same people tirelessly tried to evangelize/evolve the technology within Apple to no avail. We're talking pre-Vinnie and pre-Jon here. And in Gursharan Sidhu's defense, he knew exactly what he had when we got the RSA license! Pablo Calamera Security Architect WebTV Networks, Inc. voice: 650-614-2749 fax: 650-614-6442 -----Original Message----- From: mac-crypto(a)vmeng.com [mailto:mac-crypto@vmeng.com]On Behalf Of Robert Hettinga Sent: Tuesday, April 14, 1998 7:00 PM To: Mac-crypto(a)vmeng.com; net-thinkers(a)vmeng.com; cypherpunks(a)toad.com; cryptography(a)c2.net; dcsb(a)ai.mit.edu Subject: Re: Apple crypto engineer position available Please note, this is *not* a flame. I'm not getting even *slightly* warm, here... :-). At 6:20 PM -0400 on 4/14/98, Somebody, Waay Up There at Apple, wrote to me, offline: > I don't get it. Yup. The old irony meter is pegged, alright... :-). > >At 12:00 PM -0400 on 4/14/98, Mike Barnick wrote: > > > > > >> Apple is looking for a senior engineer to work on providing cryptographic > >>APIs on the operating system. > > > >:-). > > > >I see the law of conservation of irony still holds... > > > >Cheers, > >Bob Hettinga Tell ya what, Somebody, I'll give you three hints: Hint 1: Whatsisname Sidhu, who negotiated the world's first RSA license, and who probably could have invented digital commerce on the internet all by himself if he only knew what he had, already bought and paid for, wasted in a mail and LAN protocol, buried in the bowels of the MacOS. We still haven't seen what's in that RSA license to Apple, but, given RSA's financial straits at the time the license was issued, I bet it reads more of a pornographic act than a legal agreement. :-). I for one would be interested how transferrable it *still* is. Like, if Apple builds a Mac crypto toolbox, does that mean that anyone writing code using the crypto toolbox has a license to use the algorithms therein? I bet so, but the world will never know. The technology, (RSA, anyway) has a countdown clock on it now, so it's almost moot. Don't even get me started on ECC, which is, of course, marvellous, but equally squandered. Anyway, a more clueful Sidhu, (who, to be fair, couldn't have understood what was coming) could have, with just a little of the right prompting :-), taken some of the money you guys gave to, say, Steve, for instance :-), and bought the blind signature patent at firesale prices from DigiCash ($10 million is chump change, even to Apple, even then, :-)) at last year's greater-fools exchange of ownership at "the world's greatest financial cryptography company" (my name, not theirs). Heck, if Apple had bought DigiCash outright, and just *fired* everybody, and only used the *technology* (kind of dumb to fire David Chaum, but, hey, it's my limb, and I'm not coming off of it), Apple could have put blind signatures into that Macintosh crypto tool box, and the world really *would* think differently. :-). That's because, someday sooner than most people think, all these cryptographic functions, particularly the financial crypto functions like blind signatures, and probably even something like MicroMint, will be buried deep in every operating system. Apple could have had crypto for the rest of us, same as it ever was, way ahead of schedule, same as they always do. But, no, they fired Sidhu, instead. Causing his whole staff, and every crypto-clueful person at Apple, to quit in disgust. :-). What's funny is, Apple *still* has this enormous competitive advantage if they still want it. Because, even though they're goliath, Microsoft can't do crypto very well right now. They've got this homunculus called the Justice Department's antitrust division sitting on their sholder, and they don't want to do anything to upset Dammit Janet. (I immediately have this ludicrous picture my head of Ms. Reno in wet underware, with Riff Raff [Carville, right?] leering at her.) Not to mention the Wrath of the Whole Rest of the Computer Business, voted through their pocketbooks on capital hill. ;-). Actually, Microsoft's trying to do strong crypto anyway, bless their hearts, but they're not going to do it for long, given all the flying monkeys headed in their general direction. Fortunately, compared to the antitrust division and their minions, the FBI is a mere gnat's fart, believe it or not. That's because, to torture dear Mr. Wolfe, "no Buck Rogers, no bucks": Digital Commerce *is* Financial Cryptography, and all that. So, all it really takes from Apple to have this huge advantage, crypto-wise, is for it to have more cajones than grey matter, which, unfortunately, is exactly the inverse problem at 1 Infinite Loop, the last I looked. Apple being a founding signatory to the Key Recovery Alliance Program is a marvellous example of that. Look, it's a complement, okay? You're *smart*, right? You just have no --, well, anyway, on to the next hint... Hint 2: Jon Callas, who was not only CTO for PGP, but, through being both clueful and at the right place the right time, ended up CTO for all of Network Associates. NA is now (or will be soon, after the TIS merger's done) the 900-lb cryptogorilla nobody's supposed to think about, but can't get out of their minds. Of course, this is the same Jon Callas who used to work for the aforementioned Sidhu, and who, for fun one day, thought up a really *really* spiffy, rock-solid way to extract real live entropy from the normal operation of any Macintosh. And I don't mean memory conflicts either. :-) What? What's entropy? Hmmm... Well, there's this book you can read, it's called "Applied Cryptography". It's by a former Mac maven named Bruce Schneier. You might want to look it up there. Entropy, of course, brings me to the the final hint, Hint 3: Vinnie Moscaritolo, the guy whose name is written all over Apple's new job discription for a crypto engineer. The guy who now works for Jon over at PGP-now-NA. Vinnie, who, while he was at Apple Developer Technical Support last year, asked you guys to set up a crypto engineering department, not to mention a crypto toolbox, not to mention a crypto API. Who left in disgust shortly after the aforementioned Sidhu, but not because you fired Sidhu, because, in typical Vinnie fashion, he practically venerated Sidhu's clueness about commerce, because Vinnie saw it as an opportunity (Marines are wierd that way). :-). Who is probably making waay too much money to come back now, and who would have probably taken a pay *cut*, even at *DTS* salaries, to do the job had you offered it to him even a year ago. Ironic, isn't it? In the final bit of irony, Somebody Else, in Apple Evangelism at the time, who was not even especially crypto-clueful back then, and who will also remain nameless :-), once bandied about the idea of an actual crypto *evangelist* at Apple. Maybe even a digital commerce evangelist, who, of course, would be one and the same (digital commerce being financial cryptography and all). The irony there is that said evangelist, if hired, would end up spending all his time evangelizing *Apple*, and not the developer community, who of course, are clueful and don't need evangelizing about such things. Such are things at the new Apple, I guess. Of course, Somebody Else also doesn't work at Apple anymore either. He works in, you guessed it, another financial cryptography company. I even yelled at him about his antics at Apple, even though he's not there anymore, while we were at the Hansa Bank party at Serenity during FC98 on Anguilla this year. :-). Now, what I said *then* was a flame, you better believe it, because back *then*, when Somebody Else was at Apple, it cost me actual money. This time, with you, Somebody, it's free of charge, and so I'm not nearly so worked up. Cheers, Bob Hettinga PS. To save you the cost of a white paper, Somebody, or maybe you can just pay us for it, already :-), go look at "Digital Commerce for the Rest of Us", a longish rant Vinnie and I wrote almost two years ago. For some strange reason, it's still pretty current. ;-). It's at <http://www.shipwright.com/rants/rant_15.html> Raines Cohen actually moshed it a bit and stuck it into the inaugural issue of NetProfessional magazine, god rest it's soul, so you might have seen some of it there as well. ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Cylink Corporation to Submit SAFER+
by David Honig 17 Dec '03

17 Dec '03

http://www.newspage.com/cgi-bin/NA.GetStory?story=b0414070.403&date=19980415 &level1=46545&level2=46549&level3=626 Cylink Corporation to Submit SAFER+ Algorithm to the National Institute of Standards and Technology April 15, 1998 SUNNYVALE, Calif.--(BUSINESS WIRE) via NewsEdge Corporation -- Non-Proprietary, Royalty-Free Algorithm will be Evaluated as a Replacement for Current Data Encryption Standard Demonstrating once again its commitment to deliver freely available encryption technology to the market, Cylink Corporation (NASDAQ:CYLK), a pioneer in commercial cryptography, today announces it plans to submit the SAFER+ algorithm to the National Institute of Standards and Technology (NIST). NIST is reviewing encryption algorithms that will replace the current Data Encryption Standard (DES) which has been used for more than 20 years. The new standard is called AES, or Advanced Encryption Standard. The evaluation will take approximately two years. SAFER+ is a royalty-free, non-proprietary encryption algorithm. Developed by world-class and world-wide cryptographers, SAFER+ is an enhancement of SAFER, which was first published in 1993. Since then, SAFER survived the scrutiny of many of the world's top cryptographers. Built on the proven track record of SAFER, SAFER+ is designed to meet the next generation of security requirements. Cylink estimates SAFER+ to be five times faster than DES, and ten times faster than Triple-DES. "Once again, Cylink is delighted to offer break-through technology to NIST and the information security community," said Chuck Williams, chief scientist at Cylink. "SAFER+ is the most recent example of our legacy of pioneering the use of cryptography in practical business solutions, including public key, SAFER, triple-DES, key recovery." SAFER was originally developed by Professor James Massey, a Cylink founder, and funded by Cylink. SAFER+ was sponsored by Cylink and jointly developed by Massey and Dr. Lily Chen, chief cryptographer at Cylink Corporation. Cylink is recognized as a pioneer in commercial cryptography since its commercial implementation of Diffie-Hellman public key management in 1984. It has: -- Developed the first public key management co-processor application specific integrated circuit (ASIC) for public key management acceleration; -- Brought to market the first triple DES (data encryption standard) encryption algorithm ASIC, and the first high-speed triple DES encryptor. -- Introduced several new products including a certificate-based access control system, a certificate-based LAN security system, and the world's first asynchronous transfer mode (ATM) cell encryptor. About Cylink and Algorithmic Research Cylink Corporation and its wholly owned subsidiary, Algorithmic Research, are leading providers of encryption-based network security solutions. Their products enable the secure transmission of data over networks, including local-area networks (LANs), wide-area networks (WANs), and public packet-switched networks such as the Internet. Cylink and Algorithmic Research serve Fortune 500 companies, multinational financial institutions, and government agencies worldwide. For more information, visit our web sites at http://www.cylink.com and http://www.arx.com. ------------------------------------------------------------ David Honig Orbit Technology honig(a)otc.net Intaanetto Jigyoubu Steel : Meatspace :: Encryption : Virtual space

1 0

BXA Encryption Export Seminar - San Jose, April 28
by John Gilmore 17 Dec '03

17 Dec '03

I think some cypherpunk representatives should attend this seminar. It's often useful to hear what the BXA is saying when they talk to exporters instead of a court or the press. You will probably learn something about crypto export law, too. If you have a portable cassette recorder, see if you can record it for future reference "and for others at my company". I'd go, but I have a bunch of committments on that date. Let me know how it turns out! John Bureau of Export Administration - U.S. Department of Commerce presents ENCRYPTION CONTROLS SAN JOSE, CA April 28, 1998 * 8:30 AM - 5:00 PM Hyatt San Jose * San Jose, CA ENCRYPTION CONTROLS - As a result of the release of new rules governing the export of encryption items previously controlled on the U.S. Munitions List, the export licensing responsibilities were transferred to the Department of Commerce (except those specially designed, developed, configured, adapted, or modified for military applications). This full-day program is being held to instruct and assist the exporting community with this change in jurisdiction. Representatives from BXA and the National Security Agency (NSA) will explain: the background and current U.S. policy, the main elements of the controls, License Exception KMI and the licensing process for encryption cases, and legislative initiatives and other issues to watch in the future. WHO SHOULD ATTEND? - This seminar is designed for exporters, freight forwarders, carriers, international trade consultants, attorneys, and others who support and advise exporters. If your organization is involved in a technology-related industry, especially computers, electronics, defense goods/services, etc., this seminar is a must. ENCRYPTION AGENDA 8:30-8:35 Opening 8:35-8:45 Overview of morning 8:45-9:00 Encryption Policy * What is it? * How does it affect your company? 9:00-9:15 Encryption Regulations * What's new? * What's different * How to classify an encryption product 9:15-10:15 Encryption Licenses and the inter-agency review process * Validated * Encryption Licensing Arrangements * Foreign Nationals 10:15-10:30 BREAK 10:30-11:00 Mass Market Encryption Software * Helpful Hints 11:00-12:00 License Exceptions: TMP - GOV - BAG for encryption items 12:00-1:00 LUNCH 1:00-1:45 License Exception Key Management Infrastructure (KMI) * Recoverable encryption items * Non-recoverable 56-bit DES with a plan 1:45-2:15 Key Recovery Agents 2:15-2:45 Exports over the Internet 2:45-3:00 BREAK 3:00-3:30 Next Steps 3:30-4:00 License practice/policy 4:00-4:45 Questions & Answers ABOUT THE INSTRUCTORS - The instructors are experienced export administration specialists and licensing officers from BXA's Washington, DC headquarters and Western Regional Office. The instructors - who played a major role in drafting the new encryption regulations - are available throughout the seminar to answer your questions. ACCOMMODATIONS - Special conference rates have been arranged with the Hyatt San Jose for those who need rooms. Please make your reservations directly with the hotel by calling (408) 993- 1234 or toll free (800) 233-1234. Mention the "BXA Seminar." Note: The hotel is conveniently located minutes from San Jose Airport and is also easily accessible by automobile. The Hyatt offers free parking. QUESTIONS?- For more information on the Encryption Controls topics, please call BXA's Western Regional Office at (714) 660-0144. For information about registration, contact the Federation of International Trade Associations at (800) 969-FITA or (703) 620-9098. REGISTRATION Note: Space is limited and will be accepted on a space availability basis . The Registration Fee for the Seminar is $125/person and includes continental breakfast, AM & PM breaks, luncheon and seminar materials. The registration fee is not refundable after April 22, 1998. Cancellation prior to that date is subject to a $25 administrative charge. To guarantee placement for the Encryption Controls Seminar in San Jose, FAX your registration to (703) 391-0159, and charge the fee on a MC, VISA or American Express, or mail your registration with your check payable to FITA-BXA to FITA, 1851 Alexander Bell Drive, Suite 400, Reston, VA 20191. Attendee Name(s): ____________________________________________________________ Company Name: ____________________________________________________________ Street Address: ____________________________________________________________ City, State, Zip: ____________________________________________________________ Phone: _______________________ Fax: _________________________ [ ] Enclosed is my check for $___________ ($125/person) [ ] We prefer to pay by credit card: ____ MC, ____ Visa, ____ AMEX Amount $_________ Acct #_______________________________ Expiry date:__________ Cardholder Name: ___________________________________________________ Cardholder Signature:________________________________________________ Sponsored by The Federation of International Trade Associations (FITA) (For information about FITA, call toll-free (800) 926-FITA)

1 0

Commerce Secretary attacks crypto export limits
by Trei, Peter 17 Dec '03

17 Dec '03

http://www.news.com/News/Item/0,4,21120,00.html?st.ne.fd.mdh Crypto policy called a failure By Courtney Macavinta Staff Writer, CNET NEWS.COM April 15, 1998, 11:40 a.m. PT URL: http://www.news.com/News/Item/0,4,21120,00.html The government's policy restricting the export of strong encryption products has failed and is boosting the foreign market by hog-tying the U.S. industry, Commerce Department secretary William Daley conceded today. [...] But the software industry and privacy advocates were most intrigued today by Daley's admission that the administration's export limits on encryption (technology that secures digital communication) are hindering U.S. companies' ability to compete with global manufacturers. The export policy went into effect last January, and is overseen by the Commerce Department. Under the rules, software makers that are granted crypto export licenses must submit proof of their plans to build key-recovery features into their products after next year. Key-recovery systems make it possible for law enforcement agents--who have obtained a court order--to access computer users' private key that unscrambles their digital messages or files. "The ultimate result will be foreign dominance of the market," Daley said. "This means a loss of jobs here, and products that do not meet either our law enforcement or national security needs." There has been an ongoing fight to overturn the export limits. But a compromise hasn't been reached with law enforcement officials, who assert that access to keys is needed to combat a new wave of high-tech crime in which suspects can cover their tracks with crypto. [...]

1 0

Commerce Report on the Digital Economy
by John Young 17 Dec '03

17 Dec '03

Thanks to Jay Holovacs we've put Daley's press conference remarks and an executive summary of the "The Emerging Digital Economy" at: http://jya.com/daley-ecom.htm And we offer the main text of the full report at: http://jya.com/emerg-dig.htm (164K, plus 11 images) It's available from Commerce in separate HTML chapters or the full text with appendices in PDF (300 pages) at: http://www.ecommerce.gov/emerging.htm

1 0

NT
by nobody＠nsm.htp.org 17 Dec '03

17 Dec '03

Anyone know how to completely crash a NT workstation with no possibility of recovery?

5 4

Entropy Gradient Reversals
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

http://www.rageboy.com/allthewords.html

1 0

BioInfoWarFare? / Re: sorry
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Mark Hedges wrote: > > *sigh* actually, that wasn't bad english, it was just accidental > >html email....i didn't realize netscape would do that and i apologize. > >ooooooooooooooooo > >colin the feeling that its > > cjm1(a)execpc.com all a lot of oysters > >maroney and no pearls. > >ooooooooooooooooo > > It's 'it's', not 'its'. > > Good English does not coherence generate. Sounds like a biological agraphia warfare attack, followed by a logic bomb... Hhmmm...I smell a Platypus?

1 0