- cypherpunks-legacy - lists.cpunks.org

Privacy panel at USENIX Conference
by Matt Blaze 12 Jun '93

12 Jun '93

Anyone who's going to be attending USENIX the week after next will want to make sure not to miss the privacy panel, to be held Friday afternoon (First session after lunch, I think). The topic to be discussed is anonymity on the net... Here's the official announcement: USENIX SUMMER 1993 TECHNICAL CONFERENCE June 21 -25, 1993 Cincinnati, Ohio Privacy Panel: Anonymity Servers - Finding The Bounds of Rights This USENIX Panel session will address anonymity servers, systems serving to sanitize e-mail and NetNews postings in order to conceal the source. We will explore the legal and ethical issues involved, and try to shed some light on the subtle complexities involving "the bounds of rights" such systems pose. Some of the issues are considerably more complex than they might first appear. Our panel will consist of Dan Appelman, John Gilmore, Johan ("Julf") Helsingius, and will be convened by Mike O'Dell. Biographies of the participants follow. Dan Appelman, Panelist Dan Appelman is a lawyer who practices computer and telecommunications law from his office in Palo Alto, California. He also teaches a course in telecommunications policy, law and regulation and has written and lectured about the legal issues in both the telecommunications and data processing industries. Dan is the lawyer the USENIX Association and several other amusing high-tech enterprises. He is a partner in the law firm of Heller, Ehrman, White & McAuliffe. John Gilmore, Panelist Among his other interests and accomplishments, John Gilmore is a dedicated champion of civil liberties in cyberspace. John was a cofounder of the Electronic Frontier Foundation and has campaigned aggressively for public availability of high-quality encryption systems. He was employee number five at Sun Microsystems, may well have written more APL interpreters than any other single human, and his most recent business venture is the founding of Cygnus Support, a software support company dedicated to the commercial viability of free software. He notes that he has never had time to attend college or buy a suit. Johan Helsingius, Panelist The last time anyone really referred to Johan Helsingius using his family name was while he was doing his military service long ago. As the memories are not too fond, he prefers to be called "Julf", a name based on a play on words involving 3 languages. He has been heavily involved in all manner of European Unix-related activities for longer than he cares to remember. He founded and still runs two successful consultancy and training companies, Penetron and Penetic, which manage to fund his well-developed tastes for global travel and exploring the native arcania. Most recently Julf established an anonymity server, anon.penet.fi, that quickly became the most popular anonymous posting service on the Internet with more than 20,000 users. Although he is based in downtown Helsinki, Julf tends to spend most of his time in airport departure lounges. Mike O'Dell, Provocateur Mike O'Dell is Vice-president of the USENIX Association and he is also Editor-in-Chief of the USENIX journal, Computing Systems. When he is not busy doing either of those two things, he is Vice-president of Engineering at UUNET Technologies, Inc., a commercial IP and UUCP connectivity provider. Mike's role in this panel, however, is to reprise his occasional role as Resident Crank and thereby provoke a lively analysis of the issues.

1 0

it's official: PKP sells out for Clipper
by L. Detweiler 12 Jun '93

12 Jun '93

>From the following document: >PKP will also grant a license to practice key management, at no >additional fee, for the integrated circuits which will implement >both the DSA and the anticipated Federal Information Processing >Standard for the "key escrow" system announced by President Clinton >on April 16, 1993. more weasel words: >Notice of availability of this invention for licensing >was waived because it was determined that expeditious granting of >such license will best serve the interest of the Federal Government >and the public. what else? ===cut=here=== From: jim(a)rand.org (Jim Gillogly) Newsgroups: sci.crypt Subject: DSA: NIST and PKP come to terms Message-ID: <16860(a)rand.org> Date: 11 Jun 93 20:56:44 GMT Sender: news(a)rand.org Organization: Banzai Institute This text was transcribed from a fax and may have transcription errors. We believe the text to be correct but some of the numbers may be incorrect or incomplete. --------------------------------------------------------------------- ** The following notice was published in the Federal Register, Vol. 58, No. 108, dated June 8, 1993 under Notices ** National Institute of Standards and Technology Notice of Proposal for Grant of Exclusive Patent License This is to notify the public that the National Institute of Standards and Technology (NIST) intends to grant an exclusive world-wide license to Public Key Partners of Sunnyvale, California to practice the Invention embodied in U.S. Patent Application No. 07/738.431 and entitled "Digital Signature Algorithm." A PCT application has been filed. The rights in the invention have been assigned to the United States of America. The prospective license is a cross-license which would resolve a patent dispute with Public Key Partners and includes the right to sublicense. Notice of availability of this invention for licensing was waived because it was determined that expeditious granting of such license will best serve the interest of the Federal Government and the public. Public Key Partners has provided NIST with the materials contained in Appendix A as part of their proposal to NIST. Inquiries, comments, and other materials relating to the prospec- tive license shall be submitted to Michael R. Rubin, Active Chief Counsel for Technology, Room A-1111, Administration Building, National Institute of Standards and Technology, Gaithersburg, Maryland 20899. His telephone number is (301) 975-2803. Applica- tions for a license filed in response to this notice will be treated as objections to the grant of the prospective license. Only written comments and/or applications for a license which are received by NIST within sixty (60) days for the publication of this notice will be considered. The prospective license will be granted unless, within sixty (60) days of this notice, NIST receives written evidence and argument which established that the grant of the license would not be consistent with the requirements of 35 U.S.C. 209 and 37 CFR 404.7. Dated: June 2, 1993. Raymond G. Kammer Acting Director, National Institute Standards and Technology. Appendix "A" The National Institute for Standards and Technology ("NIST") has announced its intention to grant Public Key Partners ("PKP") sublicensing rights to NIST's pending patent application on the Digital Signature Algorithm ("DSA"). Subject to NIST's grant of this license, PKP is pleased to declare its support for the proposed Federal Information Processing Standard for Digital Signatures (the "DSS") and the pending availability of licenses to practice the DSA. In addition to the DSA, licenses to practice digital signatures will be offered by PKP under the following patents: Cryptographic Apparatus and Method ("Diffie-Hellman") No. 4,200,770 Public Key Cryptographic Apparatus and Method ("Hellman-Merkle") No. 4,315,552 Exponential Cryptographic Apparatus and Method ("Hellman-Pohlig") No. 4,434,414 Method For Identifying Subscribers And For Generating And Verifying Electronic Signatures In A Data Exchange System ("Schnorr") No. 4,995,082 It is PKP's intent to make practice of the DSA royalty free for personal, noncommercial and U.S. Federal, state and local government use. As explained below, only those parties who enjoy commercial benefit from making or selling products, or certifying digital signatures, will be required to pay royalties to practice the DSA. PKP will also grant a license to practice key management, at no additional fee, for the integrated circuits which will implement both the DSA and the anticipated Federal Information Processing Standard for the "key escrow" system announced by President Clinton on April 16, 1993. Having stated these intentions, PKP now takes this opportunity to publish its guidelines for granting uniform licenses to all parties having a commercial interest in practicing this technology: First, no party will be denied a license for any reason other that the following: (i) Failure to meet its payment obligations, (ii) Outstanding claims of infringement, or (iii) Previous termination due to material breach. Second, licenses will be granted for any embodiment sold by the licensee or made for its use, whether for final products software, or components such as integrated circuits and boards, and regard- less of the licensee's channel of distribution. Provided the requisite royalties have been paid by the seller on the enabling component(s), no further royalties will be owned by the buyer for making or selling the final product which incorporates such components. Third, the practice of digital signatures in accordance with the DSS may be licensed separately from any other technical art covered by PKP's patents. Fourth, PKP's royalty rates for the right to make or sell products, subject to uniform minimum fees, will be no more than 2 1/2% for hardware products and 5% for software, with the royalty rate further declining to 1% on any portion of the product price exceeding $1,000. These royalty rates apply only to noninfringing parties and will be uniform without regard to whether the licensed product creates digital signatures, verifies digital signatures or performs both. Fifth, for the next three (3) years, all commercial services which certify a signature's authenticity for a fee may be operated royalty free. Thereafter, all providers of such commercial certification services shall pay a royalty to PKP of $1.00 per certificate for each year the certificate is valid. Sixth, provided the foregoing royalties are paid on such products or services, all other practice of the DSA shall be royalty free. Seventh, PKP invites all of its existing licensees, at their option, to exchange their current licenses for the standard license offered for DSA. Finally, PKP will mediate the concerns of any party regarding the availability of PKP's licenses for the DSA with designated representatives of NIST and PKP. For copies of PKP's license terms, contact Michael R. Rubin, Acting Chief Counsel for Technolo- gy, NIST, or Public Key Partners. Dated: June 2, 1993. Robert B. Fougner, Esq., Director of Licensing, Public Key Partners, 310 North Mary Avenue, Sunnyvale, CA 94033 [FR Doc. 93-13473 Filed 8-7-93; 8:45 am] --------------------------------------------------------------------- Forwarded by: -- Jim Gillogly Trewesday, 21 Forelithe S.R. 1993, 20:56

1 0

DH for email
by nobody＠rosebud.ee.uh.edu 12 Jun '93

12 Jun '93

Suppose you are communicating with someone using email about something which the government wouldn't like. Being careful, you use PGP or something similar. Later, the government gets wind of your activities. They seize your computer, recovering your encrypted secret key. You do not have copies of your old mail, but to your dismay, you discover that your email service provider keeps backups of old mail. Using a court order, the government is able to recover copies of all of your old email. The court orders you to reveal your pass phrase for your secret key. Any refusal will result in your being jailed for contempt. You are forced to comply. The result is that your old messages are decrypted and used against you as evidence. It would be good to have an alternative which would not be subject to this kind of attack. Diffie-Hellman key exchange is generally suitable for an interactive environment like an encrypted telnet session or a secure serial line. But it could be adapted to email by having each side create one or more "key halves" in advance, and exchanging these in an initial message. Future email could use a session key created by taking the next pair of key halves (one from each person). When the supply of key halves got low, more could be generated and piggybacked with the next email message. Such a system would be more secure against the kind of attack described here. There would be no possibility of reconstructing the session key used if the key halves were destroyed after use. You may choose to keep your own personal copies of email, but you can delete them and be secure in the knowledge that no attacker will be able to reconstruct them. A program like PGP could be created which would automatically take care of the bookkeeping involved with creating and exchanging key halves for the DH algorithm. Then users could have electronic conversations which were freer from the threat of being coerced into revealing their secret keys and having the contents of their mail exposed.

1 0

Mail logging
by Timothy Newsham 12 Jun '93

12 Jun '93

> > >I was rooting around soda for some other reason and stumbled upon the > >mail logs (!) for soda. I just sent myself some mail to generate a > >sample entry. It's got complete traffic analysis data, complete with > >to/from pairs, time of day, and message size. The goal of this list is not to turn off such "features" but to provide security in the face of these features, in hostile environments, environments not totally under our own control.

2 1

heavy Clipper ammunition
by L. Detweiler 12 Jun '93

12 Jun '93

This will be a short note. The apologists for Clipper on sci.crypt including Sternlight, Denning, Tighe, Goble, and others tend to ultimately fall back on the argument `What's the big deal? Its voluntary!' In some ways, this is their last and most desperate argument. Here are the critical reasons why that is not an acceptable excuse or redeeming feature. 1) Whether Clipper is *currently* voluntary is meaningless given the possibility that it could later become a legislated standard. The argument that it is `voluntary' is worthless unless there is an explicit *guarantee* of such. But, as the original Clipper announcement makes obvious, no such promise is made, apparently because it could not be adhered to. 2) As the CPSR statements point out, NSA has no legal authority to propose a domestic cryptographic standard. (That it pretends that President Clinton and the NIST are the actual purveyors is ugly deceit.) Nor, likely, would any such domestic authority ever be granted to the agency. In some ways, that's the whole point of NIST's cryptographic standards role: that it would be unchained and unmanipulated by NSA. Kammer's meek whimperings in the media prove this is clearly not the case. 3) I don't know who first suggested this, but there is every possibility that the entire plan with Clipper was to make it voluntary *initially* followed by a later legislative enforcement with its proliferation. After all, Clipper would give the NSA the critical `foot in the door' into domestic U.S. cryptography, at which point it would have a toehold to make further encroachments. Hence, the current arguments that `it's only voluntary' are perhaps the ultimate hypocritical lie.

1 0

Re: MAIL: logging that happens on soda
by smb＠research.att.com 12 Jun '93

12 Jun '93

According to Kelly Goen: > > Are you aware of the firewalls mailing list, it could be a HUGE > resource in terms of these questions. As to the Logs... I, for one, am not aware of this mailing list. Could you post info? To subscribe, send mail to majordomo(a)greatcircle.com, with the body of the message saying subscribe firewalls

1 0

test, delete me
by peb＠PROCASE.COM 12 Jun '93

12 Jun '93

This is a test; please delete.

1 0

Re: MAIL: logging that happens on soda
by Peter Shipley 11 Jun '93

11 Jun '93

>> Eric, most of us know this stuff >> you are making yourself look very unix illiterate. > >You're looking a little like a nerdsnob to me. > Gee can't a guy rib a friend in public?

1 0

No Subject
by XXCLARK＠indst.indstate.edu 11 Jun '93

11 Jun '93

According to nobody(a)alumni.cco.caltech.edu: > version 2.2 locks up 8088-based computers. Version 2.1 does not. > There is an unauthorized bug fix version, 2.21. I use 2.2 as it PGP 2.2 runs without a hitch on at least one 10 MHz+ XT box in which the 8088 was replaced with an NEC V-20 and an 8087 co-processor added when new... about six years ago. Probably far more XT boxes running, worldwide, than some are capable of imagining. Key generation on the XT is as exciting... and as fast... as a baseball game, but who generates new keys daily? Encryption speed is more than adequate. Not so high a brag-ability index as its companion box, a 486/66 EISA... but to use that machine for encryption seems an utter waste of processor power. `Course, if one can only afford a 486, I suppose one must make do as best one can...

1 0

List..
by Mr. Paul Danckaert (ACS) 11 Jun '93

11 Jun '93

Please remove me from the list for now.. I'm skipping out for a bit and don't want 10000 messages when I get back.. ;) Thanks.. Paul --- Paul Danckaert - pauld(a)umbc.edu --------------------------------------- ------------------------------------------------- Beware of the Leopard -------

1 0