- cypherpunks-legacy - lists.cpunks.org

About ICF(International Cryptography Framework)
by Starr 17 Dec '03

17 Dec '03

Has anyone heard anything or been paying attention to the development of the ICF(International Cryptography Framework) standard. This seems to be an attempt of the US Gov and a FEW of our favorite corps to completely control cryptography standards as well as to have the keys to all cryptographical content. The only information I've found so far is on HP's website http://www.dmo.hp.com/gsy/security/icf/main.html I've also managed to get a hold of Ray Bamford (ray_bamford(a)hp.com)at HP who seems to have some PR role in this wool over the eyes attempt. It seems to be just another (souped-up, in disguise attempt at the clipper chip except on an International basis). When I spoke to him he told me that the only information that has been issued is what you seen in the technical paper, and that the info they have is extremely exclusive, even if you are a legitimate company working on cryptography issues, etc. Check it out...I would definitely like to hear your opinions as well as if any of you have more information on this subject(newsgroups, mail lists, etc). -spanky

2 2

Let you know!!
by sls123＠prodigy.net 17 Dec '03

17 Dec '03

Hi, Please forgive me for this e-mail, but I felt I just had to let more people know about this and get in on the ground floor! If you don't want to read it, please type "REMOVE" in the subject line. I won't contact you again. The program I am involved in incorporates "Spillover". Spillover is probably one of the best ideas ever developed for network marketing. Here's why: Anyone I sponsor after you, will probably be placed under you. You then earn commissions on these new people as if you had signed them up! Why? The way the program works I am trying to fill my downline and I can only have so many people on each level. After a given level is full, anyone else I sponsor "spills over" to the next level. This is where they start getting placed under you. So you see, it doesn't matter if you sign them up or I do, in the end the result is the same. I just signed up Monday and I already have 10 members in my downline, just from SPILLOVER! Nest Egg is in pre-Launch until April 1st, 1997 * You will receive check each month * * Free Sign Up! * The program just started, in fact it has less than 550 members. This IS the ground floor! The company is advertising in several major print publications next month! I have been in several MLM's and I can finally say; "This is the one I've been looking for!" If you know what it's like to lose sleep because your so exited, email me NOW! Don't miss this opportunity, email me for URL & sponsor information. Thanks, Mark

1 0

Free Samples, Software, and MoreI would like to invite you, as an internet user, to be part of a marketing test where you can get FREE software, FREE Samples, and FREE computer related money making offers from manufacturers nationwide. You may be asked to give your opinion, but there is no obligation.
by dans＠pleaseread.com 17 Dec '03

17 Dec '03

even if you had their addresses! If do not want to get anymore e-mail reports like this, please send email to dans(a)pleaseread.com with the word "REMOVE" in the subject or the body. -Lisa

1 0

Key Escrow Good, GAK Bad
by Ken Kirksey 17 Dec '03

17 Dec '03

> To me, Key Recovery cryptography is like using a condom with a >hole in it. No thanks. I agree in principle, and I doubt I would ever use a key recovery system if I had a choice. But, speaking as a network manager, I know that private key recovery (not GAK) can be an enhancement to security. I'll give an example. About a year ago, my boss wanted to protect his file of annual financial projections for the company from prying eyes on our Macintosh network. I installed CurveEncrypt on his machine, showed him how to use it, and gave him the standard lecture on choosing a good passphrase. I stressed that he needed to chose a passphrase easy to remember, because if he forgot it, there was no way to get his file back. Well, he forgot his passphrase. He spent an hour trying every combination he could think of, interjecting a curse here and there for color. He is now totally off using encryption to protect sensitive information. He refuses to use it, and he discourages anyone in the office from using it. I know that his position is unfair, but he _is_ the boss, so he makes the rules. And he is a typical computer user. If your average joe forgets his passphrase and loses two days worth of work, he's not likely to encrypt his work again. (Or he's likely to write down his passphrase in the future). If we were using a Key Escrow system, this situation could have been avoided. Yes, using a key escrow system is less secure that using a non-key escrow system, but I'd argue that using a strong key escrow system is better than using no encryption at all in situations like this. Our network is less secure that it could be because of one user's bad experience. Ken

5 4

Trade secrets / moderator liability
by Greg Broiles 17 Dec '03

17 Dec '03

As reported by Michael Froomkin's correspondent, the Uniform Trade Secrets Act <http://www.execpc.com/~mhallign/usta.html> (enacted with local modifications in, as I understand it, 40 states, among them California) says that third parties may be held liable for misappropriation of a trade secret where the third party knows or has reason to know that they are doing so. For example, California Civil Code section 3426.3 says: 3426.3.(a) A complainant may recover damages for the actual loss caused by misappropriation. A complainant also may recover for the unjust enrichment caused by misappropriation that is not taken into account in computing damages for actual loss. (b) If neither damages nor unjust enrichment caused by misappropriation are provable, the court may order payment of a reasonable royalty for no longer than the period of time the use could have been prohibited. (c) If willful and malicious misappropriation exists, the court may award exemplary damages in an amount not exceeding twice any award made under subdivision (a) or (b). And misappropriation is defined in California Civil Code section 3426(1)(b) as: (1) Acquisition of a trade secret of another by a person who knows or has reason to know that the trade secret was acquired by improper means; or (2) Disclosure or use of a trade secret of another without express or implied consent by a person who: (A) Used improper means to acquire knowledge of the trade secret; or (B) At the time of disclosure or use, knew or had reason to know that his or her knowledge of the trade secret was: (i) Derived from or through a person who had utilized improper means to acquire it; (ii) Acquired under circumstances giving rise to a duty to maintain its secrecy or limit its use; or (iii) Derived from or through a person who owed a duty to the person seeking relief to maintain its secrecy or limit its use; or (C) Before a material change of his or her position, knew or had reason to know that it was a trade secret and that knowledge of it had been acquired by accident or mistake. My other concern about moderator liability for approving/distributing trade secret material is in the criminal context. For example, the Economic Espionage Act of 1996 (HR 3723, now found at 18 USC 1831 et seq, <ftp://ftp.loc.gov/pub/thomas/c104/h3723.enr.txt> ) says that some trade secret violations are now a federal crime; and California Penal Code section 499c(b) also criminalizes some wrongful acts relating to trade secrets. Specifically, I think it's feasible to find aiding & abetting (and, more remotely, conspiracy) liability where a moderator knowingly and substantially contributes to public disclosure of a trade secret. It seems to me that there's a murky middle period, where the trade secret is known to some wrong people, but is still substantially a secret, where third party liability is present. But once a wide distribution of the secret is made, I don't think it's meaningful to talk about further distribution as misappropriation. If there's no common-sense "it's no longer a secret" safety valve, trade secret would provide time-unlimited protection to publically available information, which I think would be preempted by (or frustrate the purpose of) Congress' limited grants of protection to information via patent and copyright. But this is only my conjecture about how things ought to work, given the responsibilities created for third parties by statutes like the UTSA; I don't know of cases on this issue and given my work/bar review schedule, won't have time to find them any time soon. Also, as I mentioned in my previous message, I think there are good arguments that neither of the prominent trade secret disclosures I'm familiar with that have occurred (in part) via the list would create moderator liability. I'm mentioning moderator liability (and writing what's turning into a long message about it) not because I think it's an especially big danger but because I think it's an interesting public policy issue. I don't have the teeniest clue how other nations' laws might treat third parties who assist or enable the wide dissemination of trade secret materials. Perhaps other list members can offer a local perspective. -- Greg Broiles gbroiles(a)c2.net 510-986-8779 voice 510-986-8777 fax

2 1

Thanks.
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hi, Thanks for clearing up that file size query for me. You are right about that 258 (it's actually 256) header attribute. In that header is where the IMDMP special security option settings are stored (if they are indeed enabled). But the options are rarely ever used by most developers. For more information, download UDCM V2.0 from: http://members.aol.com/DataETRsch/udcm.html and view the help documentation. Also, the 256 byte header itself is encrypted with a 128-bit encryption code. Thanks again! :-) Jeremy... President DataET Research Data Engineering Technologies

1 0

Install UDCM properly before using it...
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hi again, The shareware version of UDCM *must* be installed before use. Run "install.exe" after decompression of the archive. JUST INCASE YOU DON'T KNOW WHAT THE HELL I AM TALKING ABOUT: Greetings! I am Jeremy K. Yu-Ramos, president of DataET Research, Data Engineering Technologies. I am sending you this message to let you know that DataET Research has recently initiated the distribution of UDCM, Universal Data Cryptography Module. UDCM implements a revolutionarily new, extremely advanced and sophisticated, digital data encryption algorithm named IMDMP, Integrated Mathematical Data Manipulation and Positioning. Extensive research shows that IMDMP is more advanced than DES, RSA, IDEA, and PGP. UDCM (the IMDMP algorithm)... o Is a royalty-free Windows DLL module featuring advanced cryptography. o Contains more than 140 procedures and functions. o Is a very cost-effective size of only 57 kilobytes. o Implements the IMDMP encryption algorithm. o Is more advanced than all of the industry standard encryption algorithms. o Allows encryption keys as large as 256 bytes (2048 bits). o Includes 18 sub-algorithms. o Processes all forms of binary and ASCII files. o Allows multiple encryption layer levels. o Has absolutely no back-doors or magical keys. o Does not store encryption keys in files. o Processes files as large as 2,147,483,390 bytes. o Has a 100% data preservation rating. o Includes Y2K compliant time and date locking features. o Has NCSC compliant data cleaning and wiping capabilities. o Includes file specific unique encryption features. o Includes file authentication guard features. o Includes unique encryption signaturing features. o Includes data importance and sensitivity stamping features. UDCM can be accessed through programs developed with popular application and database programming languages and environments such as: C, C++, Visual Basic, PowerBuilder, Delphi, OOP Pascal, Turbo Pascal, SmallTalk, dBase, Paradox, Access, Sybase, Oracle, etc. DataET Research has released a shareware version of UDCM named UDCM V2.0. To download UDCM V2.0 for free, please go to: http://members.aol.com/dataetrsch/udcm.html. I hope you will consider applying UDCM in the software you develop. Thank-you very much for your time. Jeremy... President DataET Research Data Engineering Technologies

1 0

Re: encryption program
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Path: perun!news2.panix.com!panix!news.mathworks.com!newsfeed.internetmci.com!hunter.premier.net!news-peer.gsl.net!news.gsl.net!news-dc.gsl.net!news.gsl.net!news.sprintlink.co.za!NEWS!not-for-mail From: Pierre van Rooyen <jvrooyen(a)liasec.infolink.co.za> Newsgroups: alt.security Subject: encryption program Message-ID: <32D39684.285B(a)liasec.infolink.co.za> Date: Wed, 08 Jan 1997 04:43:48 -0800 Organization: Secunda Lines: 22 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit If you are familiar with encryption please help me with the following Firstly I want to know if there are a encryption program currently used that are completely succure from hackers. In other words, information encrypted that no person is able to decrypt. Well if there isn't such a program I really think I have one that I have written myself. It is simple text that I have encrypted and so far no one was able to decrypt it. You can go and have a look yourself at http://www.lia.net/pvrooyen/encrypt.txt (CLICK HERE to go there now) If you think this program can be used please reply to this letter and I will give you more information. **PLEASE reply via e-mail ---> <a href="mailto:jvrooyen@liasec.infolink.co.za">CLICK HERE</a> to reply now. Hope to hear from you soon. Regards Pierre van Rooyen

4 4

Problems with UDCM V2.0?
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hi, If you are even having the slightest problem with UDCM, do not hesitate to send us a message at: DataETRsch(a)aol.com. Remember that the *shareware* version of UDCM MUST BE INSTALLED BEFORE USE. Run "install.exe" after decompression. JUST INCASE YOU DON'T KNOW WHAT THE HELL I AM TALKING ABOUT: Greetings! I am Jeremy K. Yu-Ramos, president of DataET Research, Data Engineering Technologies. I am sending you this message to let you know that DataET Research has recently initiated the distribution of UDCM, Universal Data Cryptography Module. UDCM implements a revolutionarily new, extremely advanced and sophisticated, digital data encryption algorithm named IMDMP, Integrated Mathematical Data Manipulation and Positioning. Extensive research shows that IMDMP is more advanced than DES, RSA, IDEA, and PGP. UDCM (the IMDMP algorithm)... o Is a royalty-free Windows DLL module featuring advanced cryptography. o Contains more than 140 procedures and functions. o Is a very cost-effective size of only 57 kilobytes. o Implements the IMDMP encryption algorithm. o Is more advanced than all of the industry standard encryption algorithms. o Allows encryption keys as large as 256 bytes (2048 bits). o Includes 18 sub-algorithms. o Processes all forms of binary and ASCII files. o Allows multiple encryption layer levels. o Has absolutely no back-doors or magical keys. o Does not store encryption keys in files. o Processes files as large as 2,147,483,390 bytes. o Has a 100% data preservation rating. o Includes Y2K compliant time and date locking features. o Has NCSC compliant data cleaning and wiping capabilities. o Includes file specific unique encryption features. o Includes file authentication guard features. o Includes unique encryption signaturing features. o Includes data importance and sensitivity stamping features. UDCM can be accessed through programs developed with popular application and database programming languages and environments such as: C, C++, Visual Basic, PowerBuilder, Delphi, OOP Pascal, Turbo Pascal, SmallTalk, dBase, Paradox, Access, Sybase, Oracle, etc. DataET Research has released a shareware version of UDCM named UDCM V2.0. To download UDCM V2.0 for free, please go to: http://members.aol.com/dataetrsch/udcm.html. I hope you will consider applying UDCM in the software you develop. Thank-you very much for your time. Jeremy... President DataET Research Data Engineering Technologies

2 1

More threatening e-mail from cocksucker John Gilmore and his cronies
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>Received: from dimple.pacific (max75ppp20.pacific.net.sg [203.120.75.20]) by darwin.pacific.net.sg (8.8.2/8.8.2) with SMTP id QAA15845 for <dlv(a)bwalk.dm.com>; Thu, 9 Jan 1997 16:33:17 +0800 (SGT) >Date: Thu, 9 Jan 1997 16:33:17 +0800 (SGT) >From: dimple(a)pacific.net.sg >Message-Id: <199701090833.QAA15845(a)darwin.pacific.net.sg> >X-Sender: dimple(a)pacific.net.sg >X-Mailer: Windows Eudora Light Version 1.5.2 >Mime-Version: 1.0 >Content-Type: text/plain; charset="us-ascii" >To: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) >Subject: Re: AHHHHHHHHHHHHHHHHHH!!!!!!! > >I HAVE NO IDEA HOW YOU GOT MY ADD. BUT I DON'T LIKE THE AMOUNT OF MAIL >YOU'RE SEBDING ME. I HAVE ALREDY ALERTED THE POLICE OF YOUR DOINGS AND IF >YOU STILL SEND ME MORE JUNKMAIL BY TOMORROW THE POLICE WILL ARREST. >THE DEADLINE IS 1O JAN 1997. > > > Dear Dimple, It sounds like the ASALA terrorist Ray Arachelian <ray(a)earthweb.com> has forged a subscription request in your name to the "cypher punks" mailing list! You can complain about his forgeries and net-abuse to his bosses: Jack D. Hidary <jack(a)earthweb.com> Murray Hidary <murray(a)earthweb.com> Nova Spivack <nova(a)earthweb.com> With luck, you'll have this dandruff-covered Armenian vandal extradicted to Singapore, where he'll be beaten with a rattan cane for his misdeeds.

1 0