December 2003 - cypherpunks-legacy

F.U.D. ... or "The Webmaster of this site is on more than weed"
by Ken Williams 18 Dec '03

18 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, I came across a funny article about a "CIA, DEA, FBI, Lucent Technologies, Replay.com, Seed-bank.com Grand Conspiracy" at http://members.tripod.com/~spookbusters/sunnysnooping.htm Made for some interesting reading, and certain aspects of the site do merit discussion/investigation. Regards, Ken Williams Packet Storm Security http://www.Genocide2600.com/~tattooman/ E.H.A.P. Head of Operations http://www.ehap.org/ ehap(a)ehap.org NC State CS Dept http://www.csc.ncsu.edu/ jkwilli2(a)unity.ncsu.edu PGP DSS/DH/RSA Keys http://www4.ncsu.edu/~jkwilli2/pgpkey/ _____________________________________________________________ Get Your Private, Free, Encrypted Email at http://www.nsa.gov -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQEVAwUBNmKwiJDw1ZsNz1IXAQFV/Qf/TJLUEDFq8wJhgO7LLEAbBnwnZHm8jWjm 7J5KquhZXopBzZtTXb/GCitu7Wzo+MZZLi2UrtPysnyEJGgBBAqLN38NShwwS4bT iwd5MyUW37l4Ha4S2rn3HdneVcJlHLn53y9f6xaMDyW1uXbbVtfDEdXCnFXO5In1 URraEyPeNCYvvj5n2gcUeePIK1N+zLHgyRcaaAgjpVWFo6/lV/51YuLbWtC7obqS J76Ixeu1qbLV9LiYq4BsiBB8E+AemZ3Cq8U/8L1zjiUNxj5APgVG3QlNV1jjdO9H t/8c0s602IcVJJYMZhhBs4eCNvIi1dpi5Hn7VeUxsKnANm8OwJm6Fg== =GUk5 -----END PGP SIGNATURE-----

1 0

more FUD!
by Ken Williams 18 Dec '03

18 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Interesting FUD-related thread on my message board that is tied in to the mail i just sent... http://www.genocide2600.com/~tattooman/wb/messages/1011.html Regards, Ken Williams Packet Storm Security http://www.Genocide2600.com/~tattooman/ E.H.A.P. Head of Operations http://www.ehap.org/ ehap(a)ehap.org NC State CS Dept http://www.csc.ncsu.edu/ jkwilli2(a)unity.ncsu.edu PGP DSS/DH/RSA Keys http://www4.ncsu.edu/~jkwilli2/pgpkey/ _____________________________________________________________ Get Your Private, Free, Encrypted Email at http://www.nsa.gov -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQEVAwUBNmKxg5Dw1ZsNz1IXAQFkfggAxXMR36cFDQj7drU1u2mqOrNyxIl9Ao0t SwqmoRApPwZgfnS9AG4OvVFj4DZ/vcU0YQp+lNFdlJmP/xI4CpSN+8iKS03avYdD IlasuNLV26bICpqy4cZvux1bZl2W3aaKyfPhK6nA27E83C+O3itiihqkPj/BW91Y jgCF9acVGp/axdGqjtevxXEn2cF7jqR3XzekNTtYjOj1kKhTcto9B6eZzlFu1xBy RHQa95t6SeIKsmXaEbAK0J+ztn5YomuLTT1knlZg0z3myCQ/FOuyy9/DPIU99ijv mSaGoByccUH72/H0pTyUHhmSMYAW2tTQyWqJdKnHwMGcn7V5INa1Jg== =EwZu -----END PGP SIGNATURE-----

1 0

custom protocol = job security
by Anonymous 18 Dec '03

18 Dec '03

At 08:54 AM 11/30/98 -0600, Brown, R Ken wrote: >> Dianelos Georgoudis[SMTP:dianelos@tecapro.com] described a security system > >If I was a bank I would be very wary of proposals like "We would write our >own transmission protocol. " That seems to introduce yet more complexity, custom protocol = job security

1 0

Re: F.U.D. ... or "The Webmaster of this site is on more than weed"
by Anonymous 18 Dec '03

18 Dec '03

Ken Williams writes: > I came across a funny article about a "CIA, DEA, FBI, Lucent > Technologies, Replay.com, Seed-bank.com Grand Conspiracy" at > http://members.tripod.com/~spookbusters/sunnysnooping.htm This is a critique of an article describing a way to do anonymous email and how to use remailers. The original article proposed using the Lucent privacy proxy at www.lpwa.com as an intermediary to a free email server like hotmail. The critique got all hot and bothered over the fact that Lucent is a government contractor and so the original post must have been a plant by the FBI. In fact, the LPWA-Hotmail technique is suitable for moderately secure anonymity but not for lawbreaking. This poster has used the technique occasionally for over a year. It is certainly better than hotmail alone, since hotmail includes the originating IP address in its outgoing email. By using LPWA, the originating IP field holds the LPWA IP address, and the actual originating IP address is not revealed. However, as LPWA clearly states in their privacy policy (http://lpwa.com:8000/policy.html) they keep logs of connections, and will make those available to law enforcement if presented with a court order. This would make it possible to track down the originating IP which sent the mail. Despite its limitations, this technique has the advantages of ease of use and moderate security. All you have to do is to set the lpwa.com proxy in your browser, and use hotmail for email. You can both send and receive email, which is hard to do with any other technique. It is comparable in security and convenience to the late anon.penet.fi server, which did much to increase awareness of anonymity technologies on the net. (The original article was titled "Quick and Dirty Anonymity", which seems an accurate enough description.)

1 0

Re: "Export" controls
by Michael Motyka 18 Dec '03

18 Dec '03

> Export farce is just a neat way of scaring companies and individual > contributors from developing and providing cryptographic systems > within US. > 100% accurate, but old, conclusions. > Anyone providing domestic crypto runs the risk of violating EARs. > Manufacturers are ultimately responsible when their products end up > overseas... > Can you give me an example of a commercial vendor who has suffered because someone bought a "dangerous" product ( Windows, for example ) at retail and carried it out of the country in a suitcase? My guess would be that anything sold at retail would pose no problem for the manufacturer unless domestic regulations were in place. Even then the retailer is the first in line for questioning. > [ For example, try to buy one of IBM crypto-cards - give them a call > and ask what does it take to purchase one with hard crypto on it > Save me the phone call and describe your experience. BTW - IBM derives a large portion of its revenues from government contracts. They would be pretty easy to convince. An non-dependant might be different. > Would a US citizen have to produce ID in order to buy ? > Not until there are domestic regulations. Except for firearms, cigarettes, alcohol and prescription drugs I can't think of any. My guess would be that start-up manufacturers could get their tails twisted long before the retail shelf: Personal Audits Business Audits Supplier problems ( caused by similar techniques being threatened or applied ) FCC EMI Test Delays and Failures Credit Problems Lots of Traffic Tickets for everyone. It could be fun to try an embedded product. Make some development kits then try to license it. Let a manufacturer with some resources handle the heavy lifting. If you have trouble with that give 'em the bird - just write a damn book, source, VHDL etc. You can even export that. My favorites are: Secure phone - I know it exists already but still fun Disk encryptor - SCSI/EIDE, a bump in the wire between the motherboard and the disk drive. With its own smartcard/keypad interface, keys are never seen by OS. It doesn't solve the security problem while the system is on but it sure as hell makes the disk useless to opponents once it has been shut off. Good storage. Effectively shredded if you destroy the smart card or forget the key. The proper way to keep your data as long as the courts respect the Fifth Amendment. Oh well, Mike

1 0

Re: Securing data in memory (was "Locking physical memory (fwd)
by lcs Mixmaster Remailer 18 Dec '03

18 Dec '03

Bill Stewart wrote: > Back in the mid-80s, Princeton University got some SDI money for the > Massive Memory Machine Project, researching what you could do if > you had enough memory for anything you wanted. Even with the > CS approaches of the time, you'd do a lot of things differently. > Their non-massive toy machine was a 1.5MIPS VAX with 128MB RAM - > which took 10 extension racks to hold all the RAM. > These days 128MB is cheap, as are 500 MIPS P2s, but 50GB of RAM > is still bigger than most machines' busses will hold, > and even 2GB of DRAM is a lot bigger and more power-hungry than > most laptops can really support, much less 2GB of fast SRAM. There used to be a rule of thumb that you'd want roughly a megabyte per megahertz. Today, with our 200+ MHz processors, we tend to have considerably less memory than this. My Gateway PC from a couple of years ago came with a 200 MHz Pentium Pro but only 32 MB of memory. Most PCs today are not well balanced architecturally. They should really have a couple hundred megabytes of memory. Memory is cheap enough today that this can be added, but the motherboard configuration may limit the amount. If you had this much memory, swapping to disk would be a smaller problem. As for the idea of running without a disk drive, see the handheld PDAs like the PalmPilot and the Microsoft WinCE machines. The problem with these from the security standpoint is that the memory is non-volatile. With a PC, we don't worry too much about junk in memory because we turn it off occasionally. We are concerned about the disk because that is where the persistent storage is. But with a memory-only machine, you end up using your memory as a de-facto disk drive, so that the contents of memory become just as sensitive as the contents of disk would be on a PC. Someone who gets hold of your PDA can dump out memory and find sensitive data which is stored there. Theoretically you can use a password to protect data, but then there are tradeoffs between security and ease of use, and you may end up leaving data exposed for extended periods. But speaking of using passwords to protect data, how about an encrypted swapfile for a PC? There are fast enough ciphers today that the virtual memory system could encrypt data as it swaps to the disk, and decrypt as it loads back into memory. You'd type in the passphrase at boot time. This would solve the problem of sensitive data leaking onto the disk via the swapfile. There could still be traces in memory, but at least this most obvious leak would be plugged. You don't have to wait for apps to be rewritten to use secure memory allocation drivers, you get the benefit immediately. Can existing encrypting-filesystem drivers be used for swapfiles?

4 3

Re: y2k+oil refineries
by Anonymous 18 Dec '03

18 Dec '03

North's "scrap the refinery, the chip broke" scenario was forwarded to comp.software.year-2000 by Paul Milne, resident doomsayer, foul-mouthed religious fanatic, economic Marxist, and all around kook. It prompted a very knowledgable reply which pointed out how silly the whole idea was, from someone with relevant experience. Maybe next time Detweiler could check c.s.y2k to filter out North's nuttier ideas before forwarding them here. Author: SAG Email: stephen.and.marilyn.goldstein(a)worldnet.att.net Date: 1998/12/01 fedinfo(a)halifax.com wrote: > > From GN: > > Category: > Noncompliant_Chips > Date: > 1998-11-30 13:28:22 > Subject: > Fuel Production Plants > > * * * * * * * * > > I have one very, very reliable source within that industry who tells me that > the oil refining industry can't cope with the task. I am told that the problem > of embedded systems can NOT be fixed EVER, no matter how much time were > allowed. WHY? Because the refineries themselves would have to be dismantled to > uncover these embedded systems. Essentially, the refineries would have to be > destroyed and rebuilt!!! These embedded systems are buried within enclosed > systems. Identifying, testing and replacing these systems is too impractical. > It is financially unsound to do so. The better option is to build new ones. > There is no time to do this with less than 400 days left and the time to build > a new refinery is 3 to 5 years. > > So, what does this mean? My sources, especially the most reliable source tell > me that it means that on January 1, 2000... the oil and gas refineries will > cease operations. These facilities also have converted their inventory > management control systems to small inventory levels so that inventory levels > are running about 1 to 2 days capacity. A few years ago, the industry averaged > a 1 to 6 month supply in storage tanks. Not so today. > > The results: By 1/5/2000 there will be no gasoline, no diesel fuel, no > natural gas, no heating oil, no fuel oil products at all. This means trains > will have no fuel. Trucks will have no fuel. Cars will have no fuel. Electric > Power Plants will have no oil for fuel, nor coal... because there will be no > fuel to power the vehicles to get it to them. So, there will be no > electricity. And you know the remaining domino schematic from that point. > > ====== > > I have no way of knowing whether the embedded systems are just that, embedded > in such a way that they can not be accessed. I imagine that some could be > under fifty feet of concrete or otherwise inaccessable. If this is so, then > there is not the slightest doubt at all, that it is indeed all over. Period. > > I am not going to bandy about the issue of whether this source is reliable or > not. It makes no difference. The only thing I am concerned with is whether > these systems are in fact inaccessable. I know that not every system is > inaccessable. The question is whether there are enough inaccessable systems to > mean that the refineries etc. will not function. > > Of course, I would love to hear someone counter this with evidence showing > that what has been related above is not true, or it is an urban myth etc. > But, I would like 'evidence'. Not conjecture or inuendo or suppositions. > > If it were so, that there were indeed these inaccessable systems, would the > companies involved let it be known publically? I think not. > > If this report is accurate, the remediation is 100% moot as I have said all > along, and you can kiss your butt good-bye. I'm not sure if I want to play this game Mr. Milne -- you offer this article which is, conjecture, innuendo and supposition but demand that any counter story be documented by "evidence." That's pretty tough and, frankly, I'm not up to the task as my knowledge is with electric power plants -- not oil refineries. They do, of course, share some important characteristics and so I'll give it a try. The approach will be from two perspectives -- first, I'll explain some power plant construction practices that contradict the refinery story; second, I'll offer another review of the nature of the "embedded" systems that might be at issue. Power Plant (and refinery) construction . . . . Remember, power plants and refineries are: o Capital intensive o Make increased use of computerized process control systems o Operate a continuous manufacturing/conversion process employing high temperatures and pressures. Typical design life of a coal-fired power plant is 40 years. During that period, any number of components *will* fail and *will have to be replaced.* Wouldn't make much sense to put a $500million investment at risk 'cause a $20.00 part failed in some inaccessible location. Thus EVERYTHING is accessible. You want evidence and I'm not about to take you on a power plant tour but even if you've never been inside a power plant the construction practice is similar to that found in many other industrial settings and, if you've ever been aboard a naval vessel or taken a cruise, ships. These settings are nothing like your home (or even an office) with all the infrastructure components nicely hidden behind walls -- pipes are exposed and clearly labeled -- power and control cables are laid in exposed cable trays and risers. Electronic components are often mounted in racks with easy access from front and back -- probably not at all like your computer or home theatre configuration. All this is to PERMIT MAINTENANCE, REPAIR and MODIFICATION. So you need to understand that the problem isn't just maintenance, in general, or for y2k. Process plants need to be modified frequently -- market conditions demand a change in inputs or outputs. Can't get enough sweet crude? Exxon doesn't close the refinery -- they modify it to handle the new feedstock (I got the grand tour from a fellow I knew who worked at Exxon's Baton Rouge refinery, years ago). Want some pictures? Here are a few from several "continuous process" industries: http://www.powerprocesspiping.com/, http://www.bdmechanical.com/ppiping.htm, http://silverweb.nf.ca/m&m/cb-p&p.htm, and http://www.shambaugh.com/process.htm. Now consider the nature of these embedded components. This has been the subject of much discussion in csy2k. I'd like to suggest that there are three broad categories of components in this context: o The control system(s) -- SCADA -- one or more intelligent nodes build on traditional minicomputer, or more recently, microprocessor-based server technology. These are very accessible -- they're in, adjacent to, or very near, the control room. In an even more modern "distributed control system," some of the capability will be located in different areas of the plant. Nevertheless, they still have to be very accessible -- stuff breaks -- memories get hard, multibit errors, disk drives fail, etc. o Remote devices -- the control systems can't run without data and so you have dozens to thousands of remotes -- devices that measure process parameters (temperature, pressure, mass flow, volumetric flow, acceleration and mechanical position (valve position or tank levels)) and a smaller number of remotes that can act on SCADA commands (start a motor, open a valve, etc.) Though most of these devices are pretty dumb, some may have a bit of silicon-based intelligence and therefore susceptible to y2k problems. BUT, they all have to be accessible because 1) they malfunction or need to be recalibrated and 2) plant modifications often require removal/replacement to accommodate process changes. o Embedded systems -- I think that the consensus is that the real embedded systems are those systems that are not obviously run by a computer -- the power plants water chemistry analyzer or the refineries gas chromatograph. These are on the site but they're not in the "plant" -- they're in the lab -- very accessible. Now "accessible" doesn't always mean you can walk right up and touch it! Guess where the flue gas monitoring remotes (temperature, opacity) are located -- top of the boiler or in the stack. But here's the scenario -- opacity indicator increases (flue gas has more smoke in it) but the stack gas "looks" clear. Do you shut down the plan on environment limits or do you send a maintenance man to replace the remote? Now is it possible that conditions would be different at an oil refinery. Sure, like I wrote at the beginning, I'm not really familar with these. But, really, we'd be looking at some obtuse examples -- imagine that rather than using a tank level indicator to see how much gasoline is in a tank, someone came up with the bright idea of putting a strain gauge *under* the tank and determing the amount of product in the tank but computing the weight on the gauge and using that to compute the amount of product. The device fails and, we'll all agree, it is not practical to replace it. Does the refinery stop using the tank? I wouldn't think so. They retrofit a traditional tank level indicator (float) to provide the needed information. HTH, SAG

2 1

Big Brother Banks? FDIC has snooping plans
by Robert Hettinga 18 Dec '03

18 Dec '03

--- begin forwarded text <snippetasnippeta> >Big Brother Banks? FDIC has snooping plans >By David M. Bresnahan >Copyright 1998 WorldNetDaily.com > > > Are you a potential criminal? Are you a threat to banks, airlines, a >potential spy, or perhaps an IRS tax protester? The government >would like to know and they are about to force banks to be their >detectives. > >The federal government wants banks to investigate you. Soon your >banker will know more about you than anyone else in town. Banks >must not only determine your correct identity, they must also know >how you make your money, and how you spend it. Once you >establish a pattern of deposits and withdrawals, banks must inform >federal agencies when you deviate. > >Bank customers may soon find themselves explaining to the FBI, >Internal Revenue Service, and the Drug Enforcement Agency why >they made a $15,000 deposit to their bank account. According to >current Federal Deposit Insurance Corporation plans, banks will >soon establish "profiles" of their customers and report deviations >from those profiles. > >If you sell a car, for example, and place the proceeds in your >account while you shop for a new one, a red flag may go off in the>bank > computer. Such a situation puts law abiding citizens in a >situation where they must prove they are innocent, says Scott >McDonald of the watchdog group Fight the Fingerprint. > >An uproar from grass roots Americans is the only thing that will >stop the current plans for the FDIC "Know Your Customer" >program, according to McDonald. His organization has led the >charge against the national ID, medical ID, and computerized >information about private aspects of people's lives. > >A recent announcement by the FDIC provides for citizen comment >prior to implementation of their new banking regulations. The >deadline for comments is Dec. 27, 1998. > >"The FDIC is proposing to issue a regulation requiring insured >nonmember banks to develop and maintain 'Know Your Customer' >programs," according to a recent FDIC information package sent >to Congress to provide notice of proposed rulemaking, and to >banks for comment. > >"As proposed," the 29-page FDIC document begins, "the >regulation would require each nonmember bank to develop a >program designed to determine the identity of its customers; >determine its customers' source of funds; determine the normal >and expected transactions of its customers; monitor account >activity for transactions that are inconsistent with those normal and >expected transactions; and report anytransactions of its customers >that are determined to be suspicious, in accordance with the >FDIC's existing suspicious activity reporting regulation. By >requiring insured nonmember banks to determine the identity of >their customers, as well as to obtain knowledge regarding the >legitimate activities of their customers, the proposed regulation will >reduce the likelihood that insured nonmember banks will become >unwitting participants in illicit activities conducted or attempted by >their customers. It will also level the playing field between >institutions that already have adopted formal 'Know Your >Customer' programs and those that have not." > >Many banks across the country have already begun to implement >such programs, according to the FDIC. A quick search of the >Internet found many stories in press accounts of problems reported >at such banks. There have been a number of stories dealing with >banks requiring fingerprints to open accounts and to cash checks. >There are several lawsuits presently underway testing the right of >banks to make that requirement. > >McDonald has been fighting that issue, along with fingerprints on >driver's licenses for some time. He pointed out the many errors >found on credit reports and suggested that banks will soon make >similar errors when they begin creating profiles of their customers. > >The FDIC is selling the planned regulations by pointing out the >need for prevention of financial and other crime. > >"By identifying and, when appropriate, reporting such transactions >in accordance with existing suspicious activity reporting >requirements, financial institutions are protecting their integrity and >are assisting the efforts of the financial institution regulatory >agencies and law enforcement authorities to combat illicit activities >at such institutions," says the FDIC. > >The proposed regulation is, according to FDIC spokesperson Carol >A. Mesheske, authorized by current law. It comes from the >statutory authority granted the FDIC under section 8(s)(1) of the >Federal Deposit Insurance Act (12 U.S.C. 18189s)(1), as amended >by section 259(a)(2) of the Crime Control Act of 1990 (Pub. L. >101-647). > >The FDIC claims that the law requires them to develop regulations >to require banks to "establish and maintain internal procedures >reasonably designed to ensure and monitor compliance with the >Bank Secrecy Act. Effective 'Know Your Customer' programs >serve to facilitate compliance with the Bank Secrecy Act." > >The proposed regulations will mandate that all banks insured by >the FDIC must maintain an intelligence gathering department that >screens out customers and keeps an eye on existing customers. >Before you decide to move your money to a credit union, you >should know that the FDIC is not the only federal organization >making such plans. > >"Each of the other Federal bank supervisory agencies is proposing >to adopt substantially identical regulations covering state member >and national banks, federally-chartered branches and agencies of >foreign banks, savings associations, and credit unions. There also >have been discussions with the Federal regulators of non-bank >financial institutions, such as broker-dealers, concerning the need >to propose similar rules governing the activities of these non-bank >institutions," reports FDIC attorney Karn L. Main in the proposal. > >The purposes for the regulation are to protect the reputation of the >banks, to facilitate compliance with the law, to improve safe and >sound banking practices, and to protect banks from being used by >criminals as a vehicle for illegal activities. > >Current customers will be subjected to the new regulation in the >same way new customers will be scrutinized. The FDIC does not >wish to permit any loop hole which would leave any bank >customer unidentified or unsupervised. > >Each bank will create profiles. The first profile will determine the >amount of risk a potential customer might present by opening an >account. The system of profiling potential customers will be >different from one bank to the next, since the FDIC does not >provide a uniform program. The purpose of the profile is to >identify potential customers who might use a bank account for >funds obtained through criminal activity. > >The next profile will be one that is used by automated computers >to determine when suspicious activity is taking place in an account. >When activity in the account does not fit the profile, banks will >notify federal authorities so they can investigate. > >Banks are expected to identify their customers, determine normal >and expected transactions, monitor account transactions, and >determine if a particular transaction should be reported. > >The FDIC has sent copies of the proposal to all banks and is >asking for input. The questions asked by the FDIC in the proposal >do not ask whether the regulations should be put into place, only >how to implement them in the best way. None of the questions in >the proposal are directed to bank customers. > >The FDIC reassures banks that because the requirements will be >universally applied to all banks it will not hurt their business and >drive away customers. The proposal does not mention penalties for >non-compliance, nor is there any mention of regulations to provide >access to bank records by customers so errors can be found and >corrections made. > >"If 'Know Your Customer' programs are required, insured >nonmember banks can more easily collect the necessary >information because customers cannot turn readily to another >financial institution free of such requirements," stated the proposal. > >Comments from the public may be sent to Robert E. Feldman, >Executive Secretary, Attn: Comments/OES, Federal Deposit >Insurance Corporation, 550 17th Street N.W., Washington, DC >20429 or faxed to (202) 898-3838 or e-mailed to >comments(a)FDIC.gov. > >-------------------------- >GunsSaveLives Internet Discussion List > >This list is governed by an acceptable use >policy: http://www.wizard.net/~kc/policy.html >or available upon request. > >To unsubscribe send a message to >majordomo(a)listbox.com > >with the following line in the body: > >unsubscribe gsl > >GUNSSAVELIVES (GSL) IS A PRIVATE UNMODERATED LIST. >THE OWNER TAKES NO RESPONSIBILTY FOR CONTENT. ALL >RIGHTS RESERVED. <snippage...> --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: more FUD!
by HaB 18 Dec '03

18 Dec '03

Hello. First time poster. Been reading for awhile now and I feel like a goof for having to ask, but what does FUD stand for anyway? Thanks... HaB

3 2

Sternbot on RSA
by Eric Cordian 18 Dec '03

18 Dec '03

Vin has now cloned his vigorous defense of the RSA patent to several Usenet newsgroups, posting his "summary" of the discussion. Sternlight now leaps in, to add his two cents worth. In talk.politics.crypto David Sternlight <david(a)sternlight.com> wrote: > I simply cannot believe the post by Cordian below. His argument seem to > be: Good morning, David. We've missed you on the Cypherpunks List. > 1. I am right and the court is wrong. No, David. Vin's argument is that since the patents were upheld in court, no knowlege of the specific algorithms or methods used to construct the patented entity pre-dated the work which led to the patent. In point of fact, such things do not automatically invalidate patents. Certainly the concept of trapdoor functions, their cryptographic utility, and that multiplication of primes was such a function, were known prior to the development of the RSA Public Key Cryptosystem. I vaguely recall that encipherment by modular exponentiation has also been published as an algorithm, albeit prior to the recognition that it had utility in constructing public key systems. > 2. I vaguely recall a paper that might have been prior art. Certainly the notion that the difficulty of factoring composites could be employed in the construction of cryptographically useful things was prior art. The description of encryption by modular exponentiation I recall would have been additional prior art. > 3. It is disingenuous to say there has been no invalidating prior art > even though the court has found the patent valid. There is a huge difference between "prior art" and "invalidating prior art" under patent law. Indeed, to invalidate the patent, it would have been necessary not only to find a description of the mathematical methods used in the construction of the RSA algorithm, but also a claim for the specific use for secure communication over insecure data links. > 4. Cylink's arguments must be right even though they lost in court. Some of Cylink's points were factually accurate. A system which permits the patenting of applied mathematics, which many engineers could have independently derived, is hardly likely to stun us with a brilliant interpretation of the various shades of meaning surrounding such claims and counterclaims. Again, losing in court does not equate to ones facts being in error, any more than it equates to the mathematics being patented being unknown prior to their incarnation in the patented application. > 5. RSA won because nobody could afford to litigate against them, even > though Cylink did. RSADSI's aggressive litigation posture discouraged people from ignoring their patent, and given that the patent could be licensed for much less than a lengthy court fight, kept litigation to a minimum. Cylink was pretty much the sole exception to this, and that was a legal fight internal to PKP. > 6. Anyone can patent anything and nobody could afford to oppose them > (N.B. Presumably not IBM, not DEC, not DuPont, ..oh well, you get the > idea) Yes, David. Practically anything can be patented. The power of patents is in defending them, not in applying for them, or in receiving them. > 7. Rich, smart companies with big legal departments license bogus > patents rather than litigating. Well, that depends on how you define bogus. I consider patenting applied math to be bogus. Your mileage may vary. > 8. Someone who opposes me is a troll. Someone who responds to a one line comment about the mathematical underpinnings of RSA being previously known, with several multipage essays whose central thesis is that such a claim cannot possible be true, because the patent would have been invalidated by the courts, is a troll who either understands nothing about how patents work, or is blowing a foghorn on behalf of the patent holder. > 9. If someone takes the time to oppose me, someone must be funding him. Vin has already outed himself as someone who has done work for RSADSI. He has vociferously defended various key recovery schemes implemented in their products against critics. This, combined with his rabid insistance that the RSA patent is something novel and unique, does equate to what some of us might describe as a "vested interest" in the matter, directly funded or not. > 10. The patent office never refuses patents on "method and apparatus" > except in the case of perpetual motion machines. Patent examiners generally rely only upon the material presented with the patent application when reviewing it, and expect people to do their own searches, and correctly cite related patents. Litigation is generally the means by which patents are challenged, not by the patent office refusing them, except in extrordinary circumstances, perpetual motion machines being one well-known example. > 11. Security Dynamics is paying for those who oppose me. I merely asked if Vin intended to bill them for the time he spent writing his rants. A rhetorical question. > 12. Such opposition is "a tirade". Suggesting that I would have to retire my nym after criticizing the RSA patent and taking several pages to say a paragraph of material certainly qualifies as a tirade in my book, especially when combined with a lot of irrelevent innuendo unrelated to the topic being discussed. > 13. No corporations are buying products with GAK, key recovery, etc. > (N.B. in That is what "no corporate demand" means). To an economist, perhaps. It would be more accurate to say that demand as a function of whether such features are included is a pretty flat function. > 14. Someone who opposes stronger escrow/GAK/key recovery than RSA is > offering must be suspect. Your point here eludes me. > I could go on ... And you usually do, and on, and on, and on... > but it seems to me, knowing nothing about the parties involved and > having no views on their personalities, that on the basis of the post > below Cordian is uh, um, er, a few clauses short of a syllogism. I simply believe that patents on applied math are inappropriate. Given that they are allowed, it seems silly to cite the fact that the courts uphold them as evidence for anything, particularly claims that they are new, novel, and non-obvious. -- Sponsor the DES Analytic Crack Project http://www.cyberspace.org/~enoch/crakfaq.html

1 0