- cypherpunks-legacy - lists.cpunks.org

No Subject
by nobody＠soda.berkeley.edu 04 May '93

04 May '93

Hola, I have been offered an opportunity to write on a regular basis for a National Underground Magazine. ZENGER. I am writing to the list to solicit a distilled list of Wiretap Chip Arguments. Ive got the masses of documents and understand the arguments but i am faced with limited space for the article. What does the list think is *vital* to let ZENGER readers know about? Remember this is a "not-necessarily-technical" crowd. (Although they are now realizing the need to include the computer underground Please post responses to the list since I am using a remailer. Ill post the national distribution sites when I receive the complete list.

1 0

Re: Privacy being free
by Stanton McCandlish 04 May '93

04 May '93

> > Sorry to get on your case yet again, Perry, but I just cannot accept that, > > and I don't think anyone else here can either. > > I accept it. > Freedom and privacy are things that take actual effort to maintain. > Either you pay the cost yourself or you expect others to pay it for you, > but the cost is there. Saying it "should" be free doesn't explain a lot. I think this is another map/territory confusion. The RIGHT and the defense, use, tools for, effect of, etc. of the right are not the same thing. It is like the distinction between philosophy and books about phil. The first is free. The second cost money as does instruction in philosophy, etc. Even the effects of philosophy can be costly. But the concept "philosophy" has no price tag. > I think maybe you mean that you shouldn't accept any intrusion, any > specific imposed cost, without fighting back. I agree. In addition to what I already said, I agree with this absolutely 100%. > I have a certain emotional resonance with "rights" talk, but I've found > that people will argue it forever unless (and even if) you get down to > brass tacks, talking about ideas that can guide individual actions by > individual people in individual situations in a practical way. Most astute. I agree with this also. That was one of the reasons I "put my money where my mouth was" and tried to dist. PGP on my BBS. -- Testes saxi solidi! ********************** Podex opacus gravedinosus est! Stanton McCandlish, SysOp: Noise in the Void Data Center BBS IndraNet: 369:1/1 FidoNet: 1:301/2 Internet: anton(a)hydra.unm.edu Snail: 8020 Central SE #405, Albuquerque, New Mexico 87108 USA Data phone: +1-505-246-8515 (24hr, 1200-14400 v32bis, N-8-1) Vox phone: +1-505-247-3402 (bps rate varies, depends on if you woke me up...:)

1 0

Re: PGP, and TANSTAAFL!
by Stanton McCandlish 04 May '93

04 May '93

> A-ha! You've just caused me to "un-lurk," Stanton; thanks for the great > opening. Hmm not sure if that is a good thing or not <wink> > > > Privacy should be free, just > > like freedom should be free, and the right to say what you want should be > > free. This is not to say well made tools for ENSURING these rights should > > be free. > > Here you seem to be confusing the issue. How can you say that privacy > (the right?) should be free, when defending privacy shouldn't be free? > Can someone walk up to you and _give_ you privacy? I always assumed you > had to be willing to go out and get it yourself, by hook or by crook. > Without defense of a right, the right is moot. _With_ defense of a > right, the right is moot: In that case, you already have what you want! No, no that is not quite what I am meaning. What I mean by "<insert fave right here> should be free" is that we should be presumed to have that right, and that it should not be abridged in any way whatsoever, especially not for a fee. As an example, we have a right to bear arms. You should not have to pay a fee for that right. You certainly *should* have to pay for the arms you bear, or make your own. I think YOU are slightly confusing the issue. Rights are not property, but are concepts. I argue that what one should pay for are items of property, as well as services, whether they are tools for excercising a right or not. You don't get things for free. But rights are not really "things" in that sense at all. Imagine if you had to buy an annual Free Speech Registration from the FCC. Without this registra- tion certificate, you may only use words in The Official FCC Dictionary, and may only construct phrases that follow the rules of The Official FCC Style Guide, and may only talk about subjects delimited in The Official FCC Subject Index; any violation of these policies will result in punishment not to exceed $10,000 and/or 10 years in prison. This may seem an absurd example, but one most of us are familiar with if we have read _1984_. And no, no one can walk up and hand you a box full of privacy. Rights are there or not there, conceptually speaking. I don't think that not defending a right makes the right moot, per se, though you may lose it. Thing is you should not have to defend it. Any attempt to extinguish a right is by def- inition a violation of it. Unfortunately, people are only too happy to violate other's rights, so we have to defend them. > I suppose I also have a "right to lunch," too, with the caveat that each > I must "ensure" my right to lunch by tripping down to MacDonald's and > buying it. Why bother with the right? What is free here? The fact > that MacDonald's is open for business? But I'm not even guaranteed that! No, the "right" is in your right to actually leave work, and go get something to eat. If you employer demanded a $15 dock in pay to take lunch, or refused to let you have your break (and in most states I believe there are labor laws that mandate that employees get a certain length-of-time break for every x amount of work) that would be a violation of your right to have lunch. Like- wise if someone put a gun to your head and said "thou shalt eat no lunch". > Are rights a useless construction? *I* don't think so, personally. > > While this is true, I would urge people to keep in mind that while we can > > be expected to pay for tools to help us maintain our rights, no one can > > charge us a fee for those rights themselves. Privacy is free, it is our > > birthright. > > I hope I'm not getting off list topic here on my first post, but the > "privacy is free" meme looks to be potentially damaging for us. How so? > Perhaps > you mean, Stanton, that privacy as a commodity should not be traded for > U.S. dollars, Deutsche Mark, or Mexican Pesos, but for some other > currency? Sweat, perhaps? If you pay in sweat, it isn't free--you > could have paid someone else to sweat for you. Surely this hasn't > boiled down to a question over valid currency for trade in privacy? Nope. I don't think privacy (or any other right) is a commodity. I see the 2 categories as mutually exclusive. When a "right" becomes a commodity, it is no longer a right, but a privilege. > I think the fundamental question here is whether rights are free. > [Whether they "should be" free doesn't mean ANYTHING; what does "should > be" mean?] Look around; you'll see a lot of people "fighting for their > rights" to do X. I don't think you can tell _them_ that "the right to > do X is free." Sure I can. All of us here, or many of us, are fighting for at least one of our rights, namely privacy. I have yet to see someone say that we should BUY our right, or that we are fighting to be allowed to purchase or get a license for that right. Rather we are fighting because some people in the govt with big egos or someother mental problem are trying to destroy that right, to nullify it. FIGHTING for the right may not be free, since again one must purchase tools to do that with, and also "services" (if you can call legal and court fees a service >:). But the right itself has no price tag. > Cheers, TANSTAAFL, and I hope I haven't offended Stanton over a minor point, Nope not at all. Few things offend me, and debate is one of the last things I'd be offended by. > P.S. If anyone knows what rights are, mail me. I'm extremely > interested. Don't perpetuate my possible topical error by sending it to > Cypherpunks, unless you think everyone else will be interested. (Maybe > Extropians would be...) I think they would indeed, and the cypherfolk also. I can think of few groups more concerned with our rights and protecting them. Thanks for the comments, this is a good thing to talk about, to hash out. -- Testes saxi solidi! ********************** Podex opacus gravedinosus est! Stanton McCandlish, SysOp: Noise in the Void Data Center BBS IndraNet: 369:1/1 FidoNet: 1:301/2 Internet: anton(a)hydra.unm.edu Snail: 8020 Central SE #405, Albuquerque, New Mexico 87108 USA Data phone: +1-505-246-8515 (24hr, 1200-14400 v32bis, N-8-1) Vox phone: +1-505-247-3402 (bps rate varies, depends on if you woke me up...:)

1 0

PGP
by HARUP16＠delphi.com 04 May '93

04 May '93

> I've yet to see many people who "need" PGP who cannot pay for > I'm wrong, but that's how I see it. In any case, while we may > doubts about the patentability of mathematical algorithms, tha > the world works. Certain property rights are reasonable. Argui > RSADSI has no rights to a patent on public key methods is a di > matter than arguing that someone's need and inability to pay i > taking software. I think what Matt was trying to get at is that privacy should be free The day that I feel the need to have to pay $100 to ensure that my business is nobody's business but my own is the day I leave this country for a nice outlet free desert island. I know that it was wrong to steal the RSA code for a shareware alternative, but you gotta understand the stakes here: Breaking a patend, or keeping the government from snooping on each and everyone of us. Sure, RSA is great, and they should get payed for their time programming, yap, yap, yap. But when Salk found a vacine for Polio, did he have a little fit and say "no! you are all going to die because I am a greedy little bastard", no, he made the vacine a sort of share-ware. I know there is a great deal of difference between death and software, but just tell that to to the people involved with Inslaw(hope you are all familiar with Promis software).

6 5

800 number -- Clipper poll
by Mike Godwin 04 May '93

04 May '93

Article 17194 (12 more + 1 Marked to return) in comp.org.eff.talk: From: JHIUOT&)(a)p918.f70.n109.z1.fidonet.org (JHIUOT&)) Subject: Clipper poll Date: Wed, 28 Apr 93 12:00:09 PDT Organization: FidoNet node 1:109/70.918 - No Montgomery Co Ba, Rockville MD Lines: 14 Communications Week magazine has a weekly telephone response poll. This week's question is: Do you agree with the Clinton administration's Public Encryption Management dire ctive for communications equipment? Yes: 800-242-CWKY No: 800-242-CWKN -- uucp: uunet!m2xenix!puddle!109!70.918!JHIUOT&) Internet: JHIUOT&)(a)p918.f70.n109.z1.fidonet.org

4 3

Re: A LEGAL way---maybe!
by Peter Honeyman 04 May '93

04 May '93

perhaps you missed my note last week, where i cited: %T patents and the progress of science: exclusive rights and experimental use %A rebecca s. eisenberg %J university of chicago law review %V 56 %N 3 %D summer 1989 %P 1017-1086 follow the footnotes. here's a quote to entice you: If basic research cannot be insulated from the patent system entirely, it might still be possible to reconcile a system of exclusive patent rights in prior discoveries with the interest of the scientific community in allowing subsequent researchers to enjoy free access to such discoveries by exempting the use of patented inventions in research from infringement liability. While the United States patent statute does not provide for such an exemption, the courts have long recognized, at least in principle, that a purely "experimental use" of a patented invention, with no commercial purpose, should be exempt from infringement liability. over and over, she reiterates that patent courts have consistently recognized the experimental use defense. peter

3 2

Shamir papers in postscript
by fnerd＠smds.com 04 May '93

04 May '93

I have the postscript versions of the papers of the two Adi Shamir talks I summarized last week. Shamir gives permission to distribute them freely. If anyone's interested, please mail to me, and depending on how many ask for them, I'll either mail directly or post to the list. -fnerd Titles: ``On The Generation of Multivariate Polynomials Which Are Hard To Factor'' and ``Cryptographic Applications of Birational Permutations'' by Adi Shamir Weizmann Institute FIRST ABSTRACT: In this talk we consider the difficulty of factoring multivariate polynomials F(x,y,z,...) modulo n. We consider in particular the case in which F is the product of two randomly chosen polynomials P and Q with algebraically specified coefficients, and n is the product of two randomly chosen primes p and q. The main result of this talk is that (with one trivial exception), the problem of factoring F is at least as hard as the factorization of n whenever P and Q are chosen from the same sample space, regardless of what may be known about its form. SECOND ABSTRACT: Many public key cryptographic schemes (such as cubic RSA) are based on low degree polynomials whose inverses are high degree polynomials. These functions are very easy to compute, but time consuming to invert even by their legitimate users. To make such schemes more efficient, we consider in this talk the class of birational permutations f over k-tuples of numbers, in which both f and f^-1 are low degree multivariate rational functions. We develop new families of birational permutations, and describe how to use them in new cryptographic schemes which are faster than the known schemes. --

2 1

FWD: Hearings by Congressman Markey
by John (FuzzFace/Fast-Eddie) McMahon 03 May '93

03 May '93

Date: 03 May 1993 09:12:58 -0400 (EDT) From: carl(a)malamud.com (Carl Malamud) Subject: Hearings by Congressman Markey To: announce(a)malamud.com Org: Internet Talk Radio Channel: Internet Town Hall Program: Special Program Release: May 2, 1993 (Hearings were on April 29, 1993) Content: Hearings by House Subcommittee on Telecommunications and Finance Chairman Edward Markey held oversight hearings on April 29 on the rights and responsibilities of individuals and organizations in cyberspace. A high tech presentation highlighting issues such as encryption, electronic invasions of privacy, fraud, civil liberties and computer crime, preceded a panel discussion. For the demonstration, a world-class team of four engineers from Sun and the San Diego Supercomputer Center brought in an HDTV, an ATM switch, an ISDN switch, a Russian satellite dish, a XEROX Liveboard, a BARCO projector with special video equipment, four Sparcstation 10s, a few Sparcstation 2s, and miscellaneous other equipment. The purpose of the demonstration was to show that while our current public policy makes distinctions based on industry, those distinctions have no meaning in the underlying technology. A television is a computer and a computer is a television; a computer is a telephone and vice versa. To demonstrate the latter point, Gage and his associates showed how a new AT&T cellular phone could be changed by any 13-year old into a scanner. The demonstration also showed how DES code could be pulled off anonymous FTP systems in Finland, yet US industry was unable to export this technology. The panel consisted of Raymond Kammer, Acting Director of NIST (National Institute of Standards and Technology), who provided testimony on technology standard setting issues including the government-endorsed "Clipper Chip" encryption technology; Mr. Bruce Sterling, noted science fiction writer on cyberspace and also author of the non-fiction book, "The Hacker Crackdown: Law and Disorder on the Electronic Frontier," which discusses computer crime and civil liberties; Mr. John Lucich, State Investigator with the New Jersey Division of Criminal Justice. Mr. Lucich combats computer and electronic fraud crimes by electronically infiltrating the underground computer bulletin boards of the "hacker" and "phone phreak" community; and Mr. Joel Reidenberg, Professor of Law at Fordham University Law School, who has studied how personal privacy is affected by telecommunications and computer technologies and the various privacy protections afforded citizens of different countries. We would like to apologize in advance for the very poor audio quality of this tape. The hearing room was quite antiquated, and was full of ungrounded electricity, lots and lots of electronic equipment, wireless mikes, and PA systems turned up way too loud. We hope the content makes the mind happier than the ears. Support for this program was provided by O'Reilly & Associates and by Sun Microsystems. ITH Program Files: 050293_spec_01_HALL.au (Testimony of John Gage) 050293_spec_02_HALL.au (Testimony of Panel) ITH Readme File: 050293_spec_HALL.readme (This File) For information on Internet Talk Radio, write to info(a)radio.com. More information on Internet Town Hall will be available shortly. For a current, partial listing of sites, write to sites(a)radio.com.

1 0

Need permission... or info...
by crunch＠netcom.com 03 May '93

03 May '93

Greetings, On the EFF Conference on the WELL, some people over there who are NOT in the cypherpunks list want to get the question list we generated at the last meeting. John G. posted it but no revisions were done. Is someone going to be adding more stuff to the list, and is it OK for me to cross post thje list into the EFF Conference on the WELL?? Thanx JD

1 0

PGP: Re: Tough Choices: PGP vs. RSA Data Security
by edgar＠spectrx.Saigon.COM 03 May '93

03 May '93

The conflict between RSA and PGP -may- be about to be solved. You all may recall my "announcement" of an effort to create a USA-Legal version of PGP by incorporating RSAREF code. Among several offers to help, I received the following messages: ======================================================================== To: spectrx!edgar (Edgar W. Swank) Subject: Re: PGP: USA-Legal PGP Project In-Reply-To: Your message of "Wed, 28 Apr 93 01:02:23 PDT." <ouiP3B12w165w(a)spectrx.saigon.com> Date: Wed, 28 Apr 93 12:37:30 -0600 From: "L. Detweiler" <szebra!longs.lance.colostate.edu!ld231782> >I confirmed with Jim Bidzos, President of RSA, who was >present at the meeting, that a USA Legal version of PGP could be >constructed by just replacing certain sections of code with free code >from RSAREF. Since source for both PGP and RSAREF are available, this >sounds like an easy job. Since no-one's actually done it yet, perhaps >it's not, but I will try. I hope I haven't bitten off more than I can >chew. At best, I can compile and test only the MSDOS version of PGP. I >will certainly need help if USA-Legal MAC, AMIGA, UNIX, etc. versions >are to be available. I'm sorry Mr. Bidzos didn't tell you, but the PGP development group is already looking very seriously into integrating RSAREF, and one person phr(a)america.Telebit.COM (Paul Rubin) has already done it. If you would like to join the list send mail to prz(a)sage.cgd.ucar.EDU (Philip Zimmermann). ========================================================================== Date: Wed, 28 Apr 93 19:32:55 PDT From: szebra!america.Telebit.COM!phr (Paul Rubin) Message-Id: <9304290232.AA10138(a)america.TELEBIT.COM> To: spectrx!edgar Subject: PGP: USA-Legal PGP Project >I confirmed with Jim Bidzos, President of RSA, who was >present at the meeting, that a USA Legal version of PGP could be >constructed by just replacing certain sections of code with free code >from RSAREF. Not quite true. RSAREF's license requires that the RSAREF routines be called only in certain ways unless special permission is obtained. Calling the RSAREF routines in the generally permitted manner won't work with PGP because PGP's file format is different than what RSAREF expects. PGP needs to call RSAREF in a non-standard way which is easy technically, but needs special permission from Bidzos. Attempts to get such permission have thus far been inconclusive. ====================================================================== I am msging Phil Z. to ask to be placed on "the list". I'm also trying to get more details from Paul Rubin, offering my assistance, and forwarding to him the other offers of assistance I received. It remains to be seen whether RSA's witholding of permission to use non-standard interfaces to RSAREF is reasonable or designed to be obstructive. When we find out, I think we should choose sides (if we -need- to choose sides) accordingly. It looks like the PGPers have made a good faith effort to at least meet RSA halfway. A "PGP-like" "consumer" crypto product which does not exchange keys and messages with PGP will -not- be acceptable. Any such product produced here will almost certainly be export restricted. I am -not- willing to give up my present ability to exchange keys and encrypted data with PGP users outside the USA. (I'm currently exchanging encrypted e-mail with persons in Poland(!!), Germany, and Taiwan). PGP is currently an -international- standard, and, because of ITAR, it's likely to be the -only- international standard for a long time to come. Note that current PGP is legal outside the USA -only- for non-commercial purposes (Phil Zimmerman's "copyleft"). If a USA version is approved by RSA, it will be legal only for non-commercial use inside the USA (RSA's patents & copyrights on RSAREF). If PGP becomes popular (even more so than at present, it's already the leader) worldwide for individual non-commercial use, businesses are going to want a PGP-compatible product they can use for exchanging encrypted data with their (non-business) -customers-. For example, encryption is a good idea if you're ordering merchandise with your credit-card number. Jim Bidzos has told me that Phil Z. or anyone else can get a license from RSA for $20,000 plus minimum $10,000/yr. royalties. If we say we don't want to spend more than 50% of our revenues on licensing, then if Phil can get $60,000 of firm orders for a -commercial- USA version of PGP, he's in (a very profitable) business. $60,000 might be 600 copies at $100 or six site licenses at $10,000. Also, if a -foreign- software producer wants to license a commercial version of PGP useable only overseas, he only needs to deal with Phil (& maybe the other PGP co-authors). But the effect of this would just be to increase the market for a USA commercial version (for businesses who wanted to exchange encrypted data with other businesses, or their own subsidiaries, overseas). I guess anyone who wants to can get onto Phil's list. I'd prefer if you all didn't bombard Paul Rubin with E-mail. I'll post more details of this project here as I get them (unless I'm asked not to). -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Silicon Valley, Ca

1 0