- cypherpunks-legacy - lists.cpunks.org

Anon
by rod＠wired.com 17 Dec '03

17 Dec '03

Who has made the strongest case _against_ anonymity on the Net that you have ever heard? Someone intelligent and theoretical rather than trapped in some child porn or commerce pov. Thanks, Rod R o d e r i c k S i m p s o n rod(a)wired.com A s s o c i a t e P r o d u c e r T h e H o t W i r e d N e t w o r k www.braintennis.com www.wiredsource.com

6 7

SSLeay Legality FAQ
by cjh＠osa.com.au 17 Dec '03

17 Dec '03

Folk, Here's version 1.4 of the SSLeay Legality FAQ. Additions since 1.3 are in the areas of import/export controls in various countries. Enjoy! ---------------------------------- Cut Here ---------------------------------- SSLeay Legality FAQ Version 1.4 Outline: Disclaimer Legality/Patent Rights table Export Considerations Patent Considerations References For more information Credits Disclaimer: This document may contain gross errors, and neither Clifford Heath nor Open Software Associates Limited accept any liability for same. Users should do their own research and receive professional legal advice. With regard to the legalities of using SSLeay, there is a number of geographical considerations, and a number of kinds of legal considerations. Legality/Patent Rights table: I've broken the legal considerations into "legal" (will the govt come after you :-) and "license" (who do you need to pay patent royalties to). Algor: Location: Purpose: Legal: License: Ref: DES world-wide any mostly# public domain RSA US indiv/free only RSAref free RSA RSA US commercial RSAref/BSAFE from RSADSI* RSA DH US ? mostly# Cylink+ DSA/DSS (based on Diffie-Hellman) RC4/2 US any mostly# from RSADSI RSA RC4 elsewhere any mostly# seems safe IDEA US/Europe/Japan indiv/free mostly# free ASCOM IDEA US/Europe/Japan indiv/commercial mostly# $US15, ASCOM ASCOM IDEA US/Europe/Japan company site mostly# from ASCOM ASCOM IDEA elsewhere any mostly# free SAFER world-wide any mostly# free Safer MD2 world-wide PEM only yes free@ rfc1319 MD5 world-wide any yes free@ rfc1321 SHA world-wide any yes free Any(!) France any only with (almost unobtainable) permit Any(!) Russia any only with permit Notes: * RSADSI's patent on RSA (#4,405,829) runs out on 20 Sep 2000. RSAref is free under certain terms, otherwise can be licensed through Concensus. BSAFE is stronger and has RC4 but requires purchase and royalties: $25K up front, royalties the larger of 2% or $2, royalty prepayment of $5000 per annum required in subsequent years covers 50% of royalties over the following year. + DH by itself cannot be used for digital signatures - the El Gamal extension provides this. CYLINK claim their DH patent covers El Gamal. The US patent #4,200,770 runs out on 29 April 1997. The Canadian patent (#1,121,480) registered 6 April, 1982, runs out in 1999. @ Acknowledgement is required - see the RFC. # Many countries have nominal export controls, including the UK and Australia, but I only know of them being enforced in the USA. MD2/5 and SHA are not subject to export controls anywhere that I know of. Export considerations: The USA has regulations under ITAR (International Trade in Arms Regulations) which categorises "cryptographic and ancillary devices" as munitions. Two classes of export licenses are granted: Distribution Licenses or DL's and Individual Validated Licenses or IVL's. To get an IVL you must say who the customer is and why he needs DES (or 3X DES, etc.). One may then use the IVL to export to the approved end user. Thousands are granted every year and very few applications are rejected. Systems which use cryptography for decryption only, authentication only (e.g. Kerberos authentication as available from Cybersafe and others), or can only be used for protecting financial data (e.g Cybercash etc., as long as it cannot be used for arbitrary messaging) are more-or-less readily granted a DL. DLs have also been granted for some implementations of RC4/40 bits (e.g Netscape). Canada has back-to-back agreements with the USA's ITAR controls, so it's easy to get crypto from the USA to Canada but you can't export from Canada. More information is available from Customs Canada (Revenue Canada) and Department of External Affairs and these URLs: http://axion.physics.ubc.ca/ECL.html - Excerpts from the Export Control List of Canada, and http://insight.mcmaster.ca/org/efc/pages/doc/crypto-export.html Canada's export controls. Many other countries have export controls (UK, Australia and others), but enforcement is less stringent than in the USA. In Australia, export of cryptographic software is controlled by Customs Regulations 13B (military technology) and 13E (Dual Use Technology). The regulations are administered by the Defence Signals Directorate - mail to "Director, Strategic Trade Policy and Operations, Dept of Defence, Anzac Park West Offices APW1-1-OA1, Canberra, ACT" or fax (06)266-6412 and ask for their "Australian Controls on the Export of Technology with Civil and Military Applications". The Australian regulations are also online at http://www.austlii.edu.au/cgi-bin/sinodisp.pl/au/legis/cth/consol_reg/cer43… Software is defined as "one or more programs fixed in any tangible medium of expression", which explicitly leaves electronic shipment uncontrolled. Don't carry or mail media with SSLeay-based software out of Australia - email or FTP it instead! The UK Gov't is funding a project at Royal Holloway College which contains Key Escrow provisions. Watch for the EC DGXIII introducing European legislation under the banner "European Trusted Services", or visit http://www.modeemi.cs.tut.fi/~avs/eu-crypto.html, ftp://ftp.dcs.rhbnc.ac.uk/pub/Chris.Mitchell/istr_a2.ps, ftp://ftp.cl.cam.ac.uk/users/rja14/euroclipper.ps.Z France disallows *import* and use of crypto technology without a permit, and Russia requires a permit for use also. Patent considerations: According to 35 U.S.C. 271 (a), "whoever makes, uses, offers to sell, sells or imports ... infringes the patent." In other words, you better ensure that you *compile out* and patented algorithms unless you intend to license them, even if the code is not executed. In fact, if you are in the USA, merely ftp'ing SSLeay into the USA is a breach of various patents. (Eric, you might consider splitting it into two ftp archives, one for the USA and an additional one for the rest of the world.) References: RSA: http://www.rsa.com/ CYLINK: http://www.cylink.com/products/security/ ASCOM: http://www.ascom.ch/Web/systec Safer: ftp://ftp.isi.ee.ethz.ch/pub/simpl/ For more information: http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm - Crypto Law Survey Credits: Thanks to to Eric Young, Rich Salz, Donald Lewine, Holger Reif and Bruce Schneier (author of Applied Cryptography), Peter Trei, Remo Tabanelli, Ben Laurie, Ulf Moeller, Michael Taylor for their contributions. ------------------------------------------------------------ Clifford Heath cjh(a)osa.com.au Open Software Associates Limited 29 Ringwood Street / P O Box 401 Phone +613 9871 1694 Ringwood VIC 3134 AUSTRALIA Fax +613 9871 1711 ------------------------------------------------------------ Deploy Applications across the Internet and Intranets! Visit our Web site at http://www.osa.com

1 0

No Subject
by Giulio 17 Dec '03

17 Dec '03

Unsuscribe Cypherpunks Giulio <gexing(a)mbox.vol.it>

1 0

Re: U.S. CIA employee caught spying
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Mon, 18 Nov 1996 17:05:47 -0500 (EST), Tim Scanlon wrote: >This is on the local DC news; >Harold Nicholson age 46, a CIA employee was arrested for spying today >at Dulles airport. He allegedly has been working for the Russians >for the past 2 years. Here's a good question to ask: "Why are we getting security policy from the [un]intelligence agencies?" What will get mentioned, however, will be: "If he'd been using PGP we'd never have caught him. This is why we need GAK!" # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

2 1

Re: Anon
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:06 PM 11/20/96 -0700, Roderick Simpson wrote: >Who has made the strongest case _against_ anonymity on the Net that you >have ever heard? Someone intelligent and theoretical rather than trapped in >some child porn or commerce pov. > >Thanks, >Rod Recruiting for a future Brain Tennis I take it? The Thursday Computer columnist for the WSJ (whose name escapes me) is a possibility. I don't know how strong he is but he is consistently opposed. I wouldn't recommend L. Detweiler though he is opposed to anonymity. How about Esther Dyson? DCF

1 0

CAVE Report
by John Young 17 Dec '03

17 Dec '03

We've put the CAVE-based report at: http://jya.com/tr453.htm (46 kb with 7 images) CAVE = Cellular Authentication and Voice Encryption algorithm. Nokia, for one, uses a CAVE algorithm to secure its latest toy.

1 0

Re: Why I Don't Read SF Much Anymore
by Hal Finney 17 Dec '03

17 Dec '03

From: Duncan Frissell <frissell(a)panix.com> > The problem with straight SF for me is that computers and networks have > changed the future so much that (in the words of the motto of the SF > Writer's Association) The Future Ain't What It Used to Be. The science > fictional futures of my childhood are now dead as doornails. And I can't > enjoy contemporary SF that doesn't include a healthy dose of computers and > networking. I find this to be largely true as well. The cyberpunk genre does the best job at grappling with the impact of communications tech but it is traditionally dystopian. It would be nice to see a story about better living through crypto. What fiction can people recommend which presents crypto/privacy issues realistically? How about this new book that Neal Stephenson is working on, does anyone know what it's about? His short story, "Hack the Spew", a few months ago (in Wired, I think?) had a strong crypto flavor. Hal

2 1

Re: Anon
by Hal Finney 17 Dec '03

17 Dec '03

As I mentioned a couple of days ago, science fiction writer David Brin has an argument against not only anonymity, but _privacy_ as well. Where cypherpunks tend to think of privacy as both beneficial and inevitable, Brin sees it as harmful and doomed. He has an article in the December 1996 issue of Wired discussing his ideas. BTW cypherpunk Doug Barnes is also quoted several times in the long article in that issue by Neal Stephenson (Snow Crash, The Diamond Age) about the undersea cables that carry most transnational information traffic. Hal

6 8

Re: 1996 Codebreakers
by Sean Roach 17 Dec '03

17 Dec '03

>Adam Shostack <adam(a)homeport.org> writes: >> I just got a review copy of the new (1996) ed. of Kahn's The >> Codebreakers from my local used bookstore. Its a little disapointing, >... >> & DH. Nothing on Cypherpunks, little on how privacy can be enhanced. The above was stripped from a reply made by Dr Dimitri Vulis. I have just one question, was the copy that you purchased hardcopy or paperback? I found the paperback in a school library and found that it said that the technical portion had been abridged to save space, (and money). I cannot say that I read the whole text, only the first half chapter and then some skipping around trying to find the RSA algorthim. I later found it in a periodical to which I am subscribed.

2 1

Re: Anderson & Kuhn's "Improved DFA" paper
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

HP just announced their big new plans for international exportable crypto using tamperproof PCM-CIA smartcards with multiple tamperproof GAK plugins. Anderson&Kuhn just announced the latest in a series of attacks on "tamperproof" hardware crypto modules by Israeli, UK, and US cryptographers. Obviously it must be a conspiracy :-) It's also an opportunity for some well-timed press releases. Clipper 1's reputation was severely damaged by Matt's attack. Anybody know if HP's giving out samples, and if there are real or test GAK plugins for them? HP URL http://www.dmo.hp.com/gsy/security/icf/main.html The paper was posted to coderpunks, and it's on ftp://ftp.cl.cam.ac.uk/users/rja14/dfa Here's the intro: --------------------------------------------------------------------- Improved Differential Fault Analysis Ross J Anderson, Markus G Kuhn In [1], Biham and Shamir announce an attack on DES based on 200 ciphertexts in which one-bit errors have been induced by environmental stress. Here we show an attack that requires less than ten ciphertexts. Furthermore, our attack is practical in that it uses a fault model that has been implemented in attacks on real smartcards. In [2], Biham and Shamir show how their method can be extended to reverse engineer algorithms whose structure is unknown. Our attack can also be extended to such cases and is more efficient there too. In [3], Boneh, De Millo and Lipton discuss how such techniques can be used to attack RSA. Again, their attack is theoretical only, We show how to do it in practice. -------------------------------------------------------------------------- # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

3 2