December 2003 - cypherpunks-legacy

RE: RSA in perl illegal to export (Re: Junger et al.)
by Ernest Hua 17 Dec '03

17 Dec '03

I still have a few of those shirts left (I ate the cost ... along with a few copies of Secret Power). If anyone wants to do this, I will be happy to donate the T-shirt (and be an "arms" supplier). In fact, one of the people who expressed an interest in buying the T-shirt wanted to send one to Dave Letterman (Letterman was hot at the time). Did you ever do it? Ern -----Original Message----- From: Chris Liljenstolpe [SMTP:cds@mcmurdo.gov] Sent: Wednesday, July 08, 1998 3:31 PM To: Adam Back; jim.burnes(a)ssds.com Cc: Ernest Hua; egerck(a)laser.cps.softex.br; cypherpunks(a)toad.com; cryptography(a)c2.net Subject: Re: RSA in perl illegal to export (Re: Junger et al.) Greetings, There are t-shirts out there with both human readable and machine readable (bar code) versions of the RSA in 3 code.... Wear it when boarding an international flight.... They even state that they are a munition and ITAR controlled in BIG letters on the back... Chris On Wed, Jul 08, 1998 at 11:04:44AM +0100, Adam Back wrote: > > Jim Burnes writes: > > Obviously there is no difference between 10 lines of PERL and > > 1500 lines of assembler (or machine code). > > One of Peter Junger's examples (I think used in the case) is the RSA > in 2/3 lines. He actually obtained the US export administrations > written decisions on which of a small collection of titchy programs > was exportable. RSA in 3 lines of perl they stated was illegal to > export. > > So fun things with RSA are possible because they have decided that it > is not exportable, so perhaps you could export it on a floppy, or as > your .signature, with media cameras rolling, and try to get yourself > arrested for willful violation of dumb export laws. > > Adam > -- > Have you exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ > > print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> > )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc `

1 0

CTIA Daily News from WOW-COM - July 8, 1998
by CTIA Daily News 17 Dec '03

17 Dec '03

============================================= Welcome to today's edition of the CTIA Daily News from WOW-COM. Please click on the icon / attachment for the most important news in wireless communications today. =============================================

1 0

Re: Initial summary/analysis: Junger v. Daley
by John Young 17 Dec '03

17 Dec '03

Thanks to Greg for the excellent summary and analysis. Responses by Peter Junger and his attorneys, those involved with Bernstein and Karn, and others on the technical and legal interpretation would be welcome. On the interplay among the three cases: We have heard that there was meeting in DC of the three teams with the US side. And that there may have been a report on this meeting at the recent DC security conference. Is there a public report available? Note: Greg meant to quote Judge Gwin on source code: "all but *un*intelligible to most people." The contrast between Patel and Gwin remind of the campaign of Wassenaar members to claim relaxation of crypto controls while not truly doing so, as in the recent Irish and US press release deceptions. More are expected as the US trade and crypto czars make their global rounds to arrange overt-covert deals for marketing munitions. The complicity of the banks and giant corps is not surprising with their legacy of doing just that -- as one defense expert says, expect ex-gov crypto watchdogs to aid the market titans to lure government buyers while peddling cheap knockoffs to voters. Amazing that the NYT sent up that trial balloon for government access to key strokes in lieu of GAK. Who's pushing that, working on the technology?

1 0

Ephemeral, was RE: Junger et al.
by Ed Gerck 17 Dec '03

17 Dec '03

Regarding my comment below: >Ed Gerck writes: >[...] > > BTW, I think that Gwin was struggling to express the notion that > > source code (syntax) is a device whenever there is a clear binding > > between that source code and known semantics, together with proper > > pragmatics (the enviroment, as defined in semiotics), in order to > > perform the desired function. > I received some private postings which questioned it by questioning its logical consequences, as for example: >So the judge should forbid publishing/export of Applied Cryptography >and the PGP Book with source code, right ? > First, IMO, this subject is hard to discuss because it is politically involved and also applies just to a particular set of countries -- so it is not based on a "universal" ruling. Further, I also think it is absurd to try to outlaw cryptography because it is essential and not just to obtain privacy (as in my posting on logical semantics and crypto, some months ago [1]). In fact, I think that cryptography is needed to provide *secure routing* [1] (a property that is more basic than secure content and which I think will be impossible to forbid in the future). However, I also think that the arguments being thought by each side may carry their own intrinsic worth. Further, even though the whole subject is IMO ephemeral because unworkable, some of those arguments may have a far reaching consequence and transcend the issue. Should we overlook that? IMO, no. Even thrash can be recycled ;-) My remark above was in this line of reasoning. So, it ought not to be extrapolated to printed books -- I am not at all concerned about the legal aspects. In fact, laws can be wrong and IMO this is a clear example. But, regarding printed books -- yes, the comment above (and others in that line) are right. If this logic exercise is carried to its fully immoral end, then books should not be allowed to carry complete and workable source code. Which does not show that the argument is illogical, just immoral. Technically, the argument is sound. As Hume pointed out a long time ago, if we were guided only by reason and logic then surely I should prefer to destroy the rest of the world instead of enduring even a small pain in one of my fingers. While this shows that logic is not all, it also shows that one cannot deny logic by moral or ethics but rather define what precedes what in case of conflict, for each society. While this can have different answers for different societies, eg where in some suicide is moral, the cryptography issue may take a different twist if the link to secure routing is further investigated and cryptography is not only used just for secure content as it is today. Thanks, Ed Gerck =========== Reference: [1] http://www.mcg.org.br/trustdef.htm#A.4.1 ______________________________________________________________________ Dr.rer.nat. E. Gerck egerck(a)novaware.cps.softex.br http://novaware.cps.softex.br --- Meta-Certificate Group member, http://www.mcg.org.br ---

1 0

RE: Junger et al.
by Trei, Peter 17 Dec '03

17 Dec '03

> -----Original Message----- > From: Mok-Kong Shen [SMTP:mok-kong.shen@stud.uni-muenchen.de] > Anonymous wrote: > > > Does it matter who might 'read' the material, in regards to the > protection > > of free speech? Whether it is written so that Russians or computers > might > > be able to read it? If source code is written on a napkin, it can be > > currently exported, but what if tomorrow a vendor announces a 'napkin > > computer' which can directly read from napkins akin to a super-low > densiy > > floppy disc. > > Put the source code on a neuro-disk and you can export it under > any crypto law that can ever be invented till eternity. > > M. K. Shen [Trei, Peter] Tell that to the thousands forbidden to leave the nations which claim or claimed to own them, on the basis that they once had access to state secrets. The thankfully defunct Soviet Union regularly forbade dissidents to emigrate, on the basis that at some point in their lives they had had access to 'sensitive' information. I have no doubt that similar restrictions could be put in place in other nations. Peter Trei

2 1

Re: Lotus Notes signature / encryption
by Charlie_Kaufman＠iris.com 17 Dec '03

17 Dec '03

>Could someone kindly tell me about the drawbacks of the Lotus Notes >signature / encryption system (export version)? I guess my first question would be "compared to what?". Compared to the Lotus Notes domestic version, the crypto is weaker in two ways. First, there is a backdoor by which all but 40 bits of each symmetric key is encrypted under a public key whose private half is known to the U.S. government. This encrypted value is included in all messages where the key is passed aroung. Depending on how you feel about breaking 40 bit keys, this means it is somewhere between easy and trivial for the U.S. government to eavesdrop on your communications It also uses 512 bit RSA keys for distribution of encryption keys, which makes it attackable by attackers other than the U.S. government. While no one has ever publicly demonstrated breaking a 512 bit RSA key (last I heard), the workfactor is well understood and it's clearly feasible (and in fact overdue). Compared to exportable versions of S/MIME or SSL, the crypto is considerably stronger. Against attackers other than the U.S. government (and even a paranoid would admit there are other attackers to be concerned about (e.g. the French government)), the workfactor to attack the symmetric keys is 64 bits - a little shakey but not the weakest link in most systems. Further, RSA signature keys are 630 bits, which is better than most exportable systems. Compared to non-exportable (but internationally available) systems, like PGP and strong S/MIME and SSL, the crypto is substantially weaker. Another aspect to consider is the strength of the PKI. Lotus Notes uses an organizationally based PKI, meaning that to a large degree your security depends on the trustworthiness and competence of your system administrator. With PGP, your security is under your own control to a much larger degree. For people who are more security aware than their administrators (as most PGP users are), the PGP PKI offers better security. For people who are less security aware than their administrators (as most Lotus Notes users are), the Lotus Notes PKI offers better security. Finally, a "drawback" that might be relevant to this group is the fact that because the Lotus Notes export version has a key-escrow-like backdoor, using it offers tacit political endorsement for the U.S. government's contention that key escrow is a technically practical compromise between the needs of users for privacy and the "needs" of government to know all the secrets of everyone on the planet. In my mind, this argues strongly in favor of using real strong crypto if that is an option, but using weak crypto as an alternative is offering tacit political endorsement for the even more dangerous contention that weak crypto is good enough. Your mileage may vary. --Charlie Kaufman (charlie_kaufman(a)iris.com)

1 0

Re: IP: "CyberCash can't oust credit cards"
by Dave Birch 17 Dec '03

17 Dec '03

Ryan Lackey said >I think resistance to new payment schemes on the part of a merchant is in >cost and effort to set up. Having a free apache commerce plugin which >handles >a variety of payment systems... What's wrong with this model is that it imports historical physical models that are irrelevant on the Net. Why does the merchant take payments at all? Imagine this scenario: you go into the Good Guys and buy a Walkman. The clerk gives you a ticket. You go round to your branch of Wells Fargo and get a cashiers cheque made out to the merchant, walk round to the merchant's branch of BankAmerica -- or BankBank, or whatever it's called now :) -- and deposit the cheque in the merchants account. BankBank gives you a receipt which you take back to the Good Guys and pick up your Walkman. Now, apart from all of the walking around, this is not a bad system. The Good Guys don't need cash registers, links to First Data etc etc. The Good Guys don't need to put up stickers saying "we take Visa", because the bank takes everything. The Good Guys don't care how you paid. The bank is much better placed than the merchant to handle the risks associated with payments and therefore the information asymmetries associated with the payment are significantly reduced (there's a good article about this in the Federal Reserve Bank of Atlanta's Economic Review, 1Q98). On the Net, there's no walking around. In the physical world, it clearly makes no sense for every bank to build a network out to every merchant: hence it makes sense to have physical payment instruments (e.g. notes, cheques) and credit/charge cards. On the Net, though, every participant is connected. When you buy a book from Amazon, what is the point of sending your credit card details to Amazon just so that they can send the details on to an acquiring network, third-party processor etc. Surely it makes more sense for merchants to have deals with payment agents (this is the model in OTP, Smart Access etc). When you press the button marked "Pay" on your browser, wouldn't it be more natural for a message to go to your bank than to the merchant? Thus, I get a "ticket" from Amazon saying "you owe $20 for this book". I pass the ticket to a payment agent (which may be a bank) and pay them (the negotiation being between my wallet and the agent"). The agent sends me a receipt to keep: I send the receipt to Amazon and they send me a book. Alternatively, perhaps the receipt let's me play Doom for a month or get ten upgrade to an item of software or whatever. All Amazon care is that the money has been paid: what do they care whether I used DigiCash or Mondex, Visa or MasterCard? You might argue that the merchant would discount for cleared funds (pay by Mondex and get 2% off) but I think that its frankly too much bother for them to work out N different prices by M different payment methods. I would imagine that just a merchants run loyalty schemes ("double points if you buy cornflakes") then so would payment agents ("double points for DigiCash") but each could operate their business independently. I would argue that the idea that merchants take payments is outdated. Since merchants don't care about cypherpunk favourites such as bearer instruments and anonymity, they'll be perfectly happy to have an acquiring account with BigBank and get a statement at the end of the month that details the payments taken and says "Money collected $1000, our fee $50, deposited to your account $950". Now, the merchant hasn't had to buy a commerce server, negiotiate 10 different acquiring agreements, implement SET or do anything else. Hey, so it's 5%: so what? Regards, Dave Birch. === mailto:daveb@hyperion.co.uk ===== http://www.hyperion.co.uk/ ===

1 0

Re: Rats in the Walls
by Reeza! 17 Dec '03

17 Dec '03

At 07:21 PM 02 07 98 +0200, Anonymous wrote: >"Reeza!" <howree(a)cable.navy.mil> wrote: > >> At 04:41 PM 02 07 98 +0200, Anonymous wrote: >> >and there are indeed safe havens elsewhere, >> > >> >"Educate, don't Agitate" >> > >> >> Tell me more,,, > >You and who's army? > What army? I'm in the navy, and I'm getting sick of it.

1 0

Re: Covert Access to Data and ID
by John Young 17 Dec '03

17 Dec '03

Froward From: Anonymous To: die(a)pig.die.com Cc: jy(a)jya.com Subject: Intel plans for world domination Date: Wed, 8 Jul 1998 10:51:04 -0500 Good afternoon gentlemen, I've been reading the correspondence on the possibility of govt keystroke access with some interest. I'm in a slightly odd position as I'm responsible for security in one of the larger wintel companies. As such I've been getting quite a feeling of deja vu reading your mails. Intel and others are moving in exactly this direction with a number of initiatives, most notably the PC98, PCXX, and "Wired For Management". WfM in particular is very scary - one of the components is a facility for PC's to download and run digitally signed software before the OS is booted - between "the end of BIOS initialisation and when control is transferred to a high-level OS" in the words of one Intel document. The code is verified by routines embedded in the BIOS and will allegedly use some subset of X.509v3 and PKCS#1. As so often happens in circumstances like this I can't risk passing documents directly as I can't be sure of their provenance - I really have no idea which ones are now considered trade secrets and which have been made public. Instead I recommend you have a look at the Intel WfM site http://www.intel.com/ial/wfm/ with particular reference to the "Pre-Boot Execution Environment" (PXE) and "System Management BIOS" (SMBIOS). The Microsoft pc98 site is at http://www.microsoft.com/hwdev/pc98.htm and the Intel one at http://developer.intel.com/design/pc98/. ---------- And, DM reminds of the DIRT program Ray Arachelian first posted here: There's an article on page 37 of the July 6, 1998 issue of NetworkWorld about a new software product for Windows machines that is basically a trojan horse that allows access to all keystrokes and files on a system from a remote "America's Most Wanted"-type HQ. I can't find the article online at www.networkworld.com, but you can go the the company's site at http://www.thecodex.com/dirt.html to see it. Sale of DIRT is "restricted to military, government, and law enforcement agencies", the article says.

1 0

Join StarDates.com, The Internet's Best FREE Dating Service!
by hizaici72＠prodigy.com 17 Dec '03

17 Dec '03

That's right! Stardates.com is the internet's best FREE dating service. No gimmicks, no free trials that expire, just FREE Click the link below: http://209.2.134.99/ and select JOIN FREE from the menu options to fill out our on-line application. All personal information is kept strictly confidential. We even have an anonymous email system to keep your email address private. So if your your looking to meet people, join Stardates.com Hey, what do you have to lose? Sincerely, Michael Sole Vice-President StarDates **************************************************** Bulk Email Advertising Works Best!! This Could Have Been Your AD !!! For Advertising Information Please Calll 1-510-653-4709 Evenings PST **********************************************

1 0