- cypherpunks-legacy - lists.cpunks.org

Re: Please send me SSL problems...
by jsw＠neon.netscape.com 17 Dec '03

17 Dec '03

In article <9509210118.ZM154@tofuhut>, jsw(a)netscape.com (Jeff Weinstein) writes: > I don't think that the API that SSLRef export is not particularly interesting. Yikes!! I can't believe I wrote that. What I meant was: I don't think that the API that SSLRef exports is particularly interesting. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

Re: House National Security committee guts SAFE, worse than nobill
by Jonah Seiger 17 Dec '03

17 Dec '03

At 2:17 PM -0700 9/9/97, Declan McCullagh wrote: >This version of SAFE, in fact, is //much worse// for crypto freedom than >having no bill passed at all. True. <...> >It's time for advocates of crypto-freedom to turn obstructionist and >oppose all legislation dealing with encryption. And expect to accomplish what? To stick our heads in the sand now would just make it easier for the FBI to roll right over us. We still need to fight the expected FBI key recovey amendment when the Intelligence Committee and Commerce Committee vote this week, and then onto the floor (perhaps next year). Not to mention the Senate. This battle is FAR from over. It would be a serous mistake to give up now. Best, Jonah PS: Interestingly, Reuters is reporting that the Administraon has "serious problems" with the Dellums/Weldon Amendment: Clinton official not backing new encryption plan WASHINGTON, Sept 9 (Reuter) - The Clinton administration has serious problems with a new congressional proposal to tighten export limits on computer encoding technology even though it prefers the approach to one contained in earlier legislation, a top official said on Tuesday. Under Secretary of Commerce William Reinsch told Reuters that an amendment approved by the House National Security Committee earlier on Tuesday would give the secretary of defense veto power over encryption export decisions. "Giving the secretary of defense a veto is inconsistent with the president's executive order and inconsistent with the policies of four prior administrations," Reinsch said. "The administration thinks all relevent agencies should have a seat at the table and none should have a veto." Under current policy, enacted by presidential order last year, encryption export requests are reviewed by the Departments of State, Defense, Energy, Commerce and Justice, along with the Arms Control and Disarmament Agency. The most powerful encryption products cannot be exported unless they contain a feature allowing the government to decode any messages covertly. The amendment, authored by Rep. Curt Weldon, Republican of Pennsylvania, and Rep. Ron Dellums, Democrat of California, would require the president to set "the maximum level of encryption strength that could be exported from the United States ... without harm to the national security of the United States." Products at or below the established level could be exported after a one-time review specified by the secretary of commerce with the concurrence of the secretary of defense. The proposal virtually gutted the bill to which it was attached. The original bill, written by Virginia Republican Rep. Bob Goodlatte, would greatly relax export controls. Reinsch said the administration supported the "harm to the national security" standard. "It gives the administration the authority it needs," he said. "We'd much rather have this than (the original)." Software companies, civil libertarians and Internet user groups all favor relaxing the current limits and expressed strong concerns about the Weldon amendment. The amendment appeared to outlaw differential treatment currently accorded to some encryption products used by financial institutions or subsidiaries of U.S. companies. Reinsch said that section of the amendment "could be more artfully drafted." He also criticized the proposal for not requiring companies to export products with features allowing for government access to coded messages, an approach known as key recovery. The current policy "links all of the parts together and uses export controls as a device to move towards key recovery," he said. "We believe export controls should include key recovery." --Aaron Pressman((202-898-8312)) Tuesday, 9 September 1997 18:02:46 RTRS [nN0972124] * Value Your Privacy? The Government Doesn't. Say 'No' to Key Escrow! * Adopt Your Legislator - http://www.crypto.com/adopt -- Jonah Seiger, Communications Director (v) +1.202.637.9800 Center for Democracy and Technology pager: +1.202.859.2151 <jseiger(a)cdt.org> http://www.cdt.org PGP Key via finger http://www.cdt.org/homes/jseiger/

11 18

Letter sent to SJ Mercury staff on CA SJR-29 ...
by Ernest Hua 17 Dec '03

17 Dec '03

Date: Tue, 9 Sep 1997 13:26:34 -0700 (PDT) From: Ernest Hua <hua(a)chromatic.com> To: business(a)sjmercury.com, computing(a)sjmercury.com, state(a)sjmercury.com Subject: Why no coverage of CA resolution on Encryption? Cc: hua(a)chromatic.com Why was there no coverage of CA State resolution SJR-29? I find it using the search facility at: http://www.sen.ca.gov/www/leginfo/SearchText.html And the result is at: http://www.sen.ca.gov/htbin/ca-billpage/SJR/29/gopher_root2:[bill.current.s… The on-line magazine has a full article by Will Rodger on this: http://www.zdnet.com/intweek/daily/970908b.html Apparently there was some attempt by the Clinton Administration to cover up their lobbying effort. I don't understand why the Administration would care about a California state RESOLUTION of all things. Why does the Clinton Administration want to prevent a state legislature from speaking its mind? And what's with this attempt to claim "copyright" on that fax? Please get some answers on this! The US Senate/House will be voting on important encryption legislation in the coming days. The people of this country deserves to have a open, informed, serious discussion of one of the most important privacy issues of the information age. We cannot afford to let a few intelligence and law enforcement agencies dictate policy TO us against our will. Ern

1 0

Re: Patents and trade secrets was: Encryption algorithms used in PrivaSoft
by Pat Farrell 17 Dec '03

17 Dec '03

thad(a)hammerhead.com (Thaddeus J. Beier) writes: > At this point, in this country, a patent is secret until it is issued. This will change in the US fairly soon. It is fallout of one of the world-wide trade and tarriff treaties -- we have to make our patent process be more in line with the rest of the world. One of the big technical challenges that the PTO and PRC have is how to release in-process patents securly. (PRC is the systems integrator for the PTO's APS (advanced Patent System) that had all the text and images of all patents since 1970 online.) They have even talked about putting patents on the WWW, but actually doing it is quite a way off in the future. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: USA Today on Fear of Credit Cards over Net
by Randy Catoe 17 Dec '03

17 Dec '03

At 07:35 PM 9/20/95 -0400, Perry E. Metzger wrote: > >Re: The risk of credit cards. > >I suppose that indeed there are large risks elsewhere in the credit >card system. However, I think that the credit card system itself is >stupid and insecure and ought to be scrapped -- sending around account >numbers as magic keys to get payment is a stupid move. Its not >suprising how large credit card fraud is. > >One of the great hopes I have for cryptographic technology is its >ability to lower the incidence of fraud, and thus lower transaction >costs a lot. Someday, hopefully, everyone will be able to be a credit >card merchant because you won't have to trust the merchants not to >steal. > >Perry > > I'm told that the revenue lost to fraud in the credit card industry is around .15 percent of the gross purchase value. I'm also told that the credit card companies actually face higher costs from disputes, i.e. when you call them up and busy out a person to resolve a question on you bill. Randy

2 1

Re: Net Papa: Global Internet Taxes Inevitable
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

> --------------------------------------------------------------------- > This mail is brought to you by the e$pam mailing list > --------------------------------------------------------------------- > (09/09/97; 12:00 p.m. EDT) > By Douglas Hayward, TechWire > > Cerf co-developed the > TCP/IP[LINK] protocol on which all Web and Net transaction depend. Net-Papa bullshit! > ..."If something is becoming an infrastructure that is important for > people's daily lives, then governments will have the right to be > concerned about the public's safety and well-being," Cerf said. Absolute Bullshit! Bit tax comes down to taxing thinking! This guy might have been a (past tense) a smart programmer but he'd better shut up about the rest... jfa -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C

1 0

PRNG state (and conditioning) (was Re: netscape's response)
by Carl Ellison 17 Dec '03

17 Dec '03

If you are looking for PRNG conditioning code, feel free to snarf code from http://www.clark.net/pub/cme/html/ranno.html I'm assuming your new PRNG has enough state (more than 64 bits) that the 128-bit key (or later, larger keys) is worth its bits. I'm assuming you solve the problem of finding enough entropy bits for seeding the PRNG and considering how to keep as much of that entropy as possible in your PRNG seed (rather than, for a silly example, distilling it to an unsigned int for driving rand() ). For example, the state in ranG (from the giveaway code) or in ranM may not by itself lead to a secure PRNG, but when it drives a one-way function (e.g., ranH, ranD, ranN) the state is still serving a purpose. [ranG keeps 186 bytes of state while ranM keeps 32KB of state.] - Carl

1 0

Re: "random" number seeds vs. Netscape
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Philip L. Karlton said: > > I agree, but I have a hard arguing with those that asser that the security > of UNIX is weak enough that given what we are doing for the patch it will > be easier to become root from a logged in account than to hack the seed. > Why would you have to argue with them? When they say that's it's easier to become root from a logged in account tell them, "Good, that's just as it should be!" It's a feature, not a problem! Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: FROM A FRIEND . . . (the joys of boating)
by landon＠netcom.com 17 Dec '03

17 Dec '03

>On 21 Sep 1995, Jeff Weinstein wrote: >> My understanding is that we can not >> export our US-only product, except to canada - for the use of canadian >> citizens. I also believe that it is illegal for anyone except US citizens, >> permanent residents of the US (green card holders) and Canadian citizens >> to use it, even within the US. I'm not a lawyer, and I've not read >> all of ITAR myself, so I could be totally wrong... > > All the same, if anyone wants an easy and economical >way to get around ITAR, have someone do your cypto software development >just north of the border (Vancouver's just north of Seattle and close >enough to Silicon Valley, with excellent net-access) or at least just >publish it here first. here's a possible bullshit wrinkle. i'm not a lawyer, but one of my bosses was, once. said boss owned a boat that was of canadian registry. he was a canadian citizen with a green card. he *claimed* that, even when docked in the SF bay area, his boat was technically considered canadian territory, due to some maritime law malarky. US authorities theoretically had to go through various hoops to legally board his vessel. i wouldn't try to halt a SWAT team, or even the local fuzz, with this tidbit of legal gaga. but doing crypto development on such a vessel might hold up in court for something as squishy as ITAR. naturally, commuting to canada is probably a *lot* cheaper than owning a boat. the uninitiated have little idea what these holes- in-the-water really cost.... :-) -landon (returning to lurk-mode)

1 0

Re: netscape bug
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Vlad Nuri said (with some exerpting) > > none of the articles mention that the cracker must have login access > to the computer that the random numbers are generated on. is this true? > does the code require knowledge of the PID etc. that can only be obtained > by a login to the system that the netscape session is running on? It's been noted on this list before that some programs give uid information out...sendmail comes to mind...this GREATLY narrows the search for a pid. > P.M. notes that anywhere there is a data-driven buffer overflow (which > he suspects are all over netscape) he can get code to execute anything > he wants. this reminds me of the > Morris internet worm that ran exactly the same way. it used a > bug in the finger demon that caused a string buffer overwrite > (via strcpy, instead of strncpy) to execute customized code. > > my question: I have not seen the specifics of how this works. does > this require specialized knowledge of the native machine language on the > host machine? or is it just used to cause something like a core dump > to get a command line or something like that? It requires knowledge of how the stack is set up and of assembler for the target. Most people in computer science know at least one assembler and could easily add enough of another to launch an attack like this. I did one once to attack one of my programs as an example for a class. Please don't overestimate the difficulty of this attack or underestimate the number of folks out there that are qualified to launch it. It's just that most of us would rather be writing constructive code:) Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0