- cypherpunks-legacy - lists.cpunks.org

Re: Kerberos v5's experience with ASN.1
by Theodore Ts'o 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: Cypherpunks Lite <cp-lite(a)comsec.com> Date: Sat, 2 Sep 1995 13:55:38 -0400 From: jis(a)mit.edu (Jeffrey I. Schiller) However, the problem with ASN.1 isn't its waste of space (which actually isn't that bad for a mechanism for encoding arbitrary objects). While I won't argue about the rest of Jeff's note about the use of ASN.1 being a mistake, I do want to point out that certain ASN.1 types are in fact very wasteful of space. Most notable of these is the ASN.1 Generalized Time --- which encodes the a timestamp in ASCII. ASN.1 GeneralizedTime therefore requires 17 bytes to encode, an over four-fold increase in the amount of space needed to store a time, compared with a 4 byte representation of "number of seconds since 1970". This is deadly in a protocol which has to store lots of timestamps, which is the case in Kerberos V5. We could have gotten around this problem by merely storing an integer whenever we needed to store a timestamp, instead of using the ASN.1 abstract type. Then it would have only taken 6 bytes (ASN.1 adds a 2-byte overhead for each object which you store). - Ted -----BEGIN PGP SIGNATURE----- Version: 2.6.1 Comment: Processed by Mailcrypt 3.2, an Emacs/PGP interface iQCVAwUBME9xO0QVcM1Ga0KJAQGiQwQAhSu4WpeVZ+hsN+o+NvWMwP8JK0GojhuI vWE1M3iIZttz4iMEbsziZ1KzWlkFTL8AKVWkzDAZ8t5lNMis9qObCfaQPQkKTLwJ UV20GjebckOzFx7Rp9OPDDI536cepvcjFN0cQkWtmiW2KP04TU9zr4caD4cfozDJ XYGZavYmpBQ= =9YUm -----END PGP SIGNATURE-----

1 0

Re: GAK
by terrell＠sam.neosoft.com 17 Dec '03

17 Dec '03

>Date: Sun, 3 Sep 1995 21:25:26 -0400 (EDT) >From: Brian Davis <bdavis(a)thepoint.net> >Subject: Re: GAK >On Fri, 1 Sep 1995, Timothy C. May wrote: > >> At 10:56 PM 9/1/95, Buford Terrell wrote: >> >> >If you've ever watched Not_at_all_Funny Home Videos or any of the >> >American Urinal school of tabloid television, you soon start feeling >> >that the real threat to privacy is not the guvmint, but all of >> >the yoyos with their little cam corders running around pointing them >> >at people. >> > >> >Security cameras in ATMS and at airline ticket counters do more >> >to threaten you privacy than do FIBBIE wiretaps, and PGP won't >> >protect you from them. (and usually neither will the courts). >> >> I absolutely agree with this, though this doesn't mean I'll stop worrying >> about the government's plans for key escrow (GAK), about limits on key >> lengths, or about other efforts to thwart strong security. > >I, of course, know of the "dislike" of GAK here. I am curious to know, >however, if the "dislike" is because government would have access under >any circumstances or if the primary worry is that government will cheat >and get access when most would agree that they shouldn't (either by the >judge "cheating" or a TLA stealing it). > >In other words ... if it took agreement by a review board composed of >non-LEA members of this list, would the escrow be acceptable?? > >EBD > In my case, it's simply a matter of principle: the government has no right to know what I'm saying. Search warrants may allow them to get to "things" that I have, but the First and Fifth amendments make words sacred. If the government can eavesdrop on my conversation, then my speech is no longer free. A review board consisting of cypherpunks has no more right to listen to my private conversations than does the FBI, so I would not agree to that proposal either. --buford

1 0

Re: ASN.1 and Kerberos version 5
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Sat, 2 Sep 1995 13:55:38 -0400 >From: jis(a)mit.edu (Jeffrey I. Schiller) >I'll say it. I was the person who pushed for the use of ASN.1 in Kerberos >version 5. I had this disease at the time that made me think that ASN.1 was >a good idea. I got better, unfortunately we have been living with the >results of my braino for quite some time now... poor Ted. Jeff, I'm collecting lists of ASN.1 problems as well as better solutions. If you'd care to contribute.... Otherwise, I'll post the results when they're firmed up. I got some *great* material from Burt Kaliski at the P1363 meeting and that needs to be folded in, so I know it's not soup yet. - Carl

1 0

Fade to Black... / Re: Socio-Economic Cults (Re: Cypherpunk Cults)
by Anonymous 17 Dec '03

17 Dec '03

John Smith wrote: > A Japanese man holes up in his house and shoots at those who try to > take him away. A Caucasian man outside shoots back, fearing that the > Japanese is a spy, whose information will lead to Japanese victory in > the war. Both men are shooting, both fear for their lives. And in > each case, the fear could arguably be justified, based on the > information available to each man at the time. A black man holes up in his car, shooting at a white cop wearing the same uniform as the guy who shoved a toilet plunger up his ass the day before. The cop shoots back, fearing that the black man is a drug dealer who will molest his children, plant a bomb on an airplane, and evade taxes. Both men are shooting, both fear for their lives, and both hate what the other man represents in their mind and life experience and would like to see him dead. The Jap picks them both off, from a rooftop, and lives happily ever after. ILoveAHappyEndingMongel

1 0

Re: Notes from NIS&T Key Escrow Export conference.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:59 PM 9/7/95, Pat Farrell wrote: >>"If keys are escrowed, what purpose does a 64 bit limit serve?" > >This question was asked, it seems like a zillion times, but >probably no more than four or five times. > >It is a bit of a belt and suspenders idea. But it also shows how >scared they are about real encryption. > >It is clear that this meeting is a shame. Everyone in industry ^^^^^ Sham? Or shame? Or, likely, both? Your account of the meeting merely confirms my worst fears. But don't they say the Chinese character for "crisis" also means "opportunity"? (Sort of the way the English word "oversight" has two very different and opposite meanings.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Key Escrow Papers
by John Young 17 Dec '03

17 Dec '03

We have scanned several of the handouts at the NIST Key Escrow Issues Meeting of September 6 (not present Sept 7). Perhaps someone, Pat Farrell or another, would be willing to make them available on a homepage or ftp site. If so we will send them over. If nobody volunteers we will send them by our puny e-mail contraption. Here's what we have ready to send: 1. The outlines of meeting topics of Raymond Kammer of NIST and Michael Nelson of the White House. (7kb) 2. Discussion Paper No. 4, "Example Potential Solutions for the Draft Export Criteria for Software Key Escrow Encryption," which offers example solutions for each of the ten criteria. (7kb) 3. The Business Software Alliance's dissenting blast at the government's key escrow proposal and export limit. This paper was loudly applauded. (19kb) 4. Trusted Informations Systems's "Thoughts on the NIST Escrow Issues Meeting Discussion Papers." (27kb in 2 parts) 5. TECSEC Incorporated's "Private Escrow Key Management: A Method and its Issues." (13kb) 6. Dorothy Denning's "Comments on Draft Criteria for Software Key Escrow Exportability" and "Comments on Issues for Key Escrow Agents." (8kb) Two other papers will be scanned later: 7. National Semiconductor's "Commercial Cryptography Ideas for Success" (9 pp. of large type) This contains graphics of the CAKE program and a "Proposed NIST Escrow Certificate Heirarchy" which cannot be easily distributed by us, so we offer this by fax. 8. TECSEC's "The Merger of Technology and Cryptographic Key Management" (6 pp.). Note 1: It was Michael Nelson of the White House who said that the reason to maintain the 64-bit limit for export was because the key escrow methodology had not yet been proven reliable and that the security agencies insisted on the relatively weak system in case key escrow failed. Note 2: At the B-2 breakout session there was strong debate on a proposal for a "Criteria Zero": Before addressing any of the details of Criteria 3, 4 and 9 as presented to us, Group B-2 registers its view that export under general license of strong encryption should not require key escrow. A vote on the proposal was 7 yes, 7 no and 13 absentions. It was not reported to the plenary session.

1 0

Re: Notes from NIS&T Key Escrow Export conference.
by Pat Farrell 17 Dec '03

17 Dec '03

"Peter Trei" <trei(a)process.com> writes: > I think we can infer from this that the USG has, or soon expects to have, > the ability to brute 64 bits of key. That is what I heard (implied) too. If not today, in a reasonably foreseeable future. Remember, this is not an issue today, only weirdos such as the c'punks care today. The govies move slowly. They are setting the stage for tomorrow. >> It is clear that this meeting is a shame. Everyone in industry > A shame certainly, but I suspect you meant 'sham' (not a spelling flame, > the difference in meaning is important). Sorry for the typo, yes, I meant sham, fake, theater, all smoke and mirrors, nothing sincere, etc. See reference to "stage" above. All typos are mine. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

2 1

Re: Cylink
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

> WSJ, Sept 19, 1995. > > Cylink Claims Right To Key Technology Involving > Encryption > > ... > > Sunnyvale, Calif. - A Silicon Valley company asserted a > legal claim to a key technology for protecting electronic > commerce, following an arbitration ruling. > > ... The arbitrators > ruled that RSA hasn't had the right to sublicense the > Stanford patents since 1990. > > Cylink said it would seek royalties from companies that > have licensed software code from RSA and are > redistributing it, arguing that they are infringing the > Stanford patents. > This was reported in the San Jose Mercury News today, as well. They reported that Cylink licenses the patents for $50,000. I'm assuming that the main patent in question is the Diffie-Hellmann patent (only 1 year and 7 months to DH Freedom Day!). Since PKP (and Bidzos, now president of RSA) always said that DH covered all public key encryption, it would seem that any RSA licensee would also need a license from Cylink. The Merc article said that RSA's and Cylink's interpretation of the arbitrators' ruling were completely opposite. I haven't seen a copy of the ruling. The Merc says that "Outside observers tend to take RSA's view of things." I'm stunned that an arbitrator could make a uniterpretable ruling on something so cut and dried, but then, IANAL. I've called both PKP and RSA, I haven't been able to talk to anybody about it yet. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-8624

1 0

Unlicensed net.psychotherapy
by Damaged Justice 17 Dec '03

17 Dec '03

[somewhat snipped from raw lynx dump] Daily Double Scoop Graphic Just enough Net news. By John Motavalli Is Psychotherapy On The Net Legal? HOW DOES ONE OFFER PSYCHOLOGICAL HELP ONLINE? Very cautiously. The issue of whether the practice of psychology or psychiatry online is legal still appears to be a bit unclear. Psychologists have to be licensed to practice in each state. If they're doing psychotherapy over the Internet, and they're offering therapy to people in states where they're not licensed, are they breaking the law? Sacramento psychologist Ronald L. Mann, Ph.D., has a [8]site, allowing a visitor to "e-mail a question (about anything from relationships to career changes)." This service costs you $20 a question. Dr. Mann, who is licensed in California only, said he's not breaking the law because he is not offering psychotherapy online. "Technically, psychotherapy is about exploring unconscious thoughts and feelings and making interpretations about these earlier memories, feelings, and linking them to present circumstances," Mann said. "I'm uncomfortable (professionally and personally) doing psychotherapy on the Internet. I think people need a personal face-to-face relationship that will provide emotional support when they get into intense powerful emotional material. I can't offer that through e-mail. What I can offer is good sound educational advice and point them in a good direction." Doug Fizel, deputy director of public affairs at the [9]American Psychological Association in Washington, D.C., said the question of the legality of online psychiatry is under study. "That really has not been worked out yet within the APA," he said. "It does really raise a lot of good questions, as to whether someone in California can legally offer therapy to someone in New York. You also have to ask whether someone can truly enter into a genuine therapeutic relationship online." Mann noted a recent correspondence he had with a young man who has some personal problems. "He is in college, and he has very poor self-esteem. He's really anxious in his relationships with other people, he has trouble sustaining relationships. We talked (by e-mail) about what it takes to have comfortable relationships with other people, and early childhood issues." I said this sounded like psychotherapy. "I know it's not psychotherapy," Mann replied. "I could have said, 'Why don't we do this [a treatment process]. I didn't. I actually think psychotherapy wouldn't work very well via e-mail." Adds Fizel, "It's more a question of ethical practice -- the difference between law (which a state would determine) and ethical practice (determined by an organization like ours)." He concludes that "So far, the questions have been raised, but the answers haven't been found." 8. http://www.ronmann.com/ 9. http://www.apa.org/

1 0

Re: NSA and Netscape Crack
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim wrote: >> If the "flaws" are being found by our group, as John notes, just what is >> the NSA doing in the _second_ role it is supposed to have, it's "COMSEC," >> or communications security, role? and then Thomas wrote: >Gee Tim, NSA is "helping" us out by creating Clipper and new key escrow >mechanisms ;) > >"I'm from the NSA, I'm here to help your crypto..." In the relatively short time I've been on this list, Cypherpunks have bruted, and then found a weakness in, two kinds of Netscape software. [A fine public service, IMO. Congrats to all involved.] I don't expect to know NSA's specific brute-force capability, but does anyone know if the NSA has *ever* found a glaring weakness in software and then told its author(s) or owner(s) about it? Do "we" perform the "COMSEC" role Tim was speaking of better than the NSA? JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMF9VHW1lp8bpvW01AQFZkwQAiQWJMfdP+5v0CozYH59ZGWUhpaKxgX15 vdVCdSzHgaN6sj5aLVL4yRI0bkVe/6nJ8I4Nj9cYS5K5AgbcmiRDLvEulc0Y+mwr B9rQBUcX7hM6lA+tEk2UpiGmR1xdh2U0Qpu93zT8T7MZtIc5dRReKeT21OXl4W96 NX4iONaceGY= =2nmI -----END PGP SIGNATURE----- Regards, Jim Ray "Censorship reflects society's lack of confidence in itself. It is a hallmark of an authoritative regime." -- Justice Potter Stewart ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

1 0