- cypherpunks-legacy - lists.cpunks.org

more ftp usage stats
by Eric Hughes 02 May '93

02 May '93

Edged out by sfraves by less than a megabyte! Eric ----------------------------------------------------------------------------- ---- Percent of ---- Archive Section Files Sent Bytes Sent Files Sent Bytes Sent ------------------------- ---------- ----------- ---------- ---------- pub/sfraves 956 149433794 13.51 28.93 pub/cypherpunks 987 148460361 13.95 28.74

1 0

Patent fallacies
by Hal 02 May '93

02 May '93

Another patent misconception, from what I understand, is that an unenforced patent becomes invalid. It is said that PKP is "forced" to go after PGP because if they don't their patent will lose its force. Several days ago Tom Morrow on the Extropians list said that this doctrine applies to trademarks but not to patents. Patents have a fixed 17 year lifetime and failure to enforce against one user does not preclude the patent owner from enforcing against another. The folklore about the loss of intellectual property rights that we are all familiar with (aspirin, zippers, etc.) are all cases of trademark losses. Tom is a law student, not a lawyer; also, I am a few days behind on my Extropians reading so I don't know whether any follow-ups or corrections were posted since his message. But this principle seems to be in accordance with what was posted here about selective enforcement of patents. If this is in fact how patents behave, it is one less justification for PKP's heavy-handed enforcement efforts against PGP. It means that PKP could choose not to enforce against PGP (or any other freeware program) without losing any rights to enforce against others. It would be interesting to hear an authoritative opinion on this from a lawyer. Hal

2 1

[Gavin Doughtie: Electronic escrow?]
by gnu 02 May '93

02 May '93

------- Forwarded Message Date: Wed, 28 Apr 1993 17:56:13 -0700 From: Gavin Doughtie <gavin(a)well.sf.ca.us> Message-Id: <199304290056.AA26690(a)well.sf.ca.us> To: gnu(a)toad.com Subject: Electronic escrow? How could two paranoid entities make use of digital cash and encryption to sell a chunk of data (letUs say something really valuable like a list of famous women linked to Elvis Presley in 1992) without 1) revealing their identities to each other or 2) involving a third party to act as an RescrowS agent. The paradox IUm thinking about is one where the purchaser of the information doesnUt want the sellerUs digital cash to be worth anything until the data being sold can be provably decrypted, and the seller doesnUt want the info being sold to be decryptable until the cash turns out to be genuine. You're a well-known cryptography person; I'm a struggling writer. If you're not inclined to respond, perhaps you can direct this message to someone who can. Thanks very much! Gavin. ------- End of Forwarded Message

2 1

A legal way to use RSA!
by William Oldacre 02 May '93

02 May '93

To: cypherpunks(a)toad.com A Legal Way To Use RSA ---------------------- There is a LEGAL way to establish the free use of PGP and the RSA algorithm by anyone who wishes to preserve their constitutional right to privacy. No licensing or fees are involved. The RSA algorithm is not copyrighted software, it's a patented technique (presumably in the form of a mathematical algorithm). Under patent law, it is legal to manufacture anything that someone has patented for your own use. If the item is an improved can opener, for example, then you can make one for yourself directly from the patent office drawings if you like. You cannot offer them for sale. So anyone is free to create a computer program which utilizes the RSA algorithm so long as it's just for them. All mathematical equations, no matter how large and complex, consist of smaller terms or sub calculations. In the instant case of the RSA algorithm, these smaller terms consist of prime numbers, Euler's quotient function, and operations like calculating the greatest common divisor and modular arithmetic. It's all about as patentable as long division. No one could be prevented from using such ordinary mathematics. PGP performs other tasks besides RSA related calculations. It supports IDEA and XXENCODE which are in the public domain. So it's only necessary to rewrite the RSA section to avoid conflict with the patent. This could be accomplished by arranging the section into a few mathematical modules or "building blocks." These could then be rearranged by the user into several different configurations for encryption ------ with only one supporting the actual RSA algorithm. After all, large prime numbers can legitimately be used as keys for almost any encryption technique and the arithmetic operations may be called as subroutines for a variety purposes. By stacking the un patentable "building blocks" into the particular sequence which implements the RSA algorithm, the users would, in essence, be employing their own tools (the computer and it's software) to create a copy of the RSA algorithm for their individual use. Programming skills would not be required since the inexpert user could simply employ a setup program and select from a menu of different encryption modes. Alternatively, a DEBUG script could be circulated separately to appropriately reshuffle the object code. Legal action to prevent such a program from being distributed could be very difficult. What reasonable argument could be set forth against someone using the mathematical functions? Arguing that someone -might- use the program to create RSA would make no more sense than arguing that a drill press -might- be used to make a patented can opener. Besides, if it's legal for someone to make their own can opener, how can it be illegal to sell them the tools and materials to do it with? Providing instructions on how to do it can hardly be attacked because the U.S. Patent Office, itself, publishes the plans (technically, they appear to violate the law whenever they send copies outside U.S. borders). By now, you get the point. There's a well anchored legal loophole in the patent law big enough to sail a ship through. It may render patents of formulae used in computer software worthless (as they ought to be). I sympathize with Public Key Partners. The venture must have looked awfully good on paper, but their position is fundamentally untenable. Sooner or later the subject of their exclusive rights over RSA will reach the courtroom. There is legal precedent for allowing private corporations to market products developed with public funds. However, a case might very well be made that MIT erred in granting an exclusive license. It would be to the greater public good (the underlying principal) to release RSA into the public domain so a range of competing businesses could provide it to the public. Because the right to privacy is involved, rather than valves for a rocket engine, a federal court could take licensing entirely out of Massachusetts' and MIT's hands if any federal funds could be traced to RSA's development. Once in court, it will make the newspapers. A private company profiteering from something the taxpayers paid for ----- denying privacy to the average American with heavy handed tactics. The simple fact is, I don't like it and I have a feeling most people won't like the sound of it. The press, a major user of electronic mail and a jealous guardian of sources, is not likely to take a sympathetic stance. There is a large organized body of opposed computer users poised to launch letter writing campaigns and many congressional "waste slayers" are apt to show real interest in the matter. Foundations which fund lawsuits on freedom issues abound. As courtroom and legislative arguments are raised against the license or patent, what foolish company is going to risk paying the license fee? The RSA license quivers on a bowl of Jello. I know financial misadventure when I see it. I'm glad none of my money is invested in Public Key Partners. Bon Voyage!

3 2

comments solicited
by wuthel!brand＠drums.reasoning.com 02 May '93

02 May '93

Why the Clipper Clip is Bad (v1) by Russell Brand wuthel!bj-4(a)reasoning.com Copyright (C) 1993 All Rights Reserved Permission is given to freely redistribute this document without modification. The analysis presented has not been endorsed by any third party. It incorporates only UNCLASSIFIED information made by 31 April 1993. On or about 15 April 1993, The US Government has announced a encryption chip set called `Clipper' whose primary stated application is to encrypt VOICE telephone communication in such a way that law officers with a lawful warrant would be able to tap and decode the communication while no other unauthorized person would be able to do so. Law enforcement officials would present their warrant to two `escrow' agencies in order to get a halfs of a special key that they would use with a special device to decrypt the message. The algorithm is to remain classified. The number of objections to this, technical, legal and moral are numerous. First, a secret design is violation of the open design principle and hides from public view future hazards. Further there may be trap doors in the system that allow decryption WITHOUT the warrant or escrow key. Second, all of the agencies that have any experience with managing secrets like the Key Escrow process have declined to become involved or have been disqualified. Considering the value of the escrow data to corporate spies, one must fear corruption including blackmail of a commercial nature. Third, the cryptographic protocol as described is weak in a number of ways such that the escrow keys are seemingly unneeded for decryption by the federal government. This combined with a recent house of representative votes to allow the FBI to among other things conduct phone taps without a warrant when international terrorism is suspected as well as long well documented history of BLANK warrants being signed and issued is rather scary. Fourth, it seems to be a mis-use of government funds to subsidize the development of this chip to the advantage of certain companies over others without so much a public comment period. In addition to the development costs, there are many other large costs including the key escrow agencies themselves. Fifth, it will damage US competitiveness for companies to need to build both the insecure CLIPPER chip for government regulated markets and real protection circuitry for people that care. Sixth, the clipper proposal will not help against organized crime; they are bright enough to buy real encryption devices and certain details of CLIPPER will make it easier for them to accomplish this. Of course wire tapping itself has been shown *NOT* to be cost effective in detecting/preventing/prosecuting crimes. There is no way in the system to mark a `privileged conversation' (for example doctor-patient, lawyer-client' and hence these can and will be captured. Please write to your elected officials, media, etc. to oppose this.

1 0

Re: Tactics.
by Sy Verpunc 02 May '93

02 May '93

From: Shaen Bernhardt <uni(a)acs.bu.edu> To me its plain that the intent is to regulate crypto. Before then I plan (hope) that PGP finds its way into MANY hands. That's the only real weapon I see. Consider it a safety net to catch us if Tim's REALPOLITIK fails. I hope it doesn't, Tim, I hope not but I'm going to hope for the best and prepare for the worst. I intend to use strong crypto when I like. And to think I got flame mail less than two months ago when I said on alt.security.pgp that I was pissed off because someone put my key on a public server... I bet there's a few other people wishing now they hadn't put their keys in an 'arrest me' list... G

2 1

Apology and clarification
by Hal 02 May '93

02 May '93

I want to clear up any misconceptions raised by my message about possible changes in Cypherpunks policies and practices. The various possibilities that I raised, such as forbidding discussion of patent-infringing projects at Cypherpunks meetings, or endorsing future PKP crackdowns on infringers, were completely my own conceptions. They were not meant to represent actual suggestions raised by Tim, Eric, or anyone else. Rather, they were my own extrapolations and extensions of what I viewed as positions being advocated on the list. But I see now that I went too far in drawing these extensions, especially given that the actual statements being made here bore little resemblance to the suggestions I made. The "straw man" positions which resulted were so extreme as to discredit anyone who would favor them. I hope no one will assume from my message that any list member advocates those views. I may have responded with excessive emotion to recent proposals here, coming as they do on the heels of the threat raised by Clipper. I do feel a sense of commitment to the PGP effort despite my current relatively inactive state there. My reaction was perhaps overly defensive. I'll try to keep a clearer head in the future and react only to actual threats rather than imagined ones. Hal

1 0

TALK, ACTION, CHANGE Re: Cryptography
by wcs＠anchor.ho.att.com 02 May '93

02 May '93

Anthony Gatlin writes: > > In other words, let's start using resources other than talk. > > Talk is cheap but actions are the catalysts of change. Mike Godwin replies: > Talk may also be the catalyst for change. See, e.g., the Federalist > Papers and the First Amendment. Both of you are, of course, right :-) One of the valuable things about cypherpunks is that there *has* been a fair amount of action, though every once in a while we need to step back and ask "What are we DOING here?". As one of the manifestoes around says, "Cypherpunks write code." PGP has had a remarkable success in getting strong crypto out to thousands of people, increasing the interest in the technical community and reaching out to other communities, and giving us something that, if push comes to shove, we can use to communicate with no chance of government eavesdropping. That's good. When it first came out, I got a copy for just that reason, because strong crypto may later be banned. I've also got RIPEM, which is legally kosher, though it doesn't have the key distribution / certification infrastructure that's been built with PGP. (Yet!) PGP has been a really useful research tool for that. However, for many of us, using PGP for non-research applications, like sending messages to our friends, IS in violation of RSA's patents. Ripping off your allies is a bad policy; better to turn competitors into friends. I don't happen to like algorithm patents, and I especially dislike the overbroad claims made by the collection of patents held by PKP, but R,S,&A, and Diffie and Hellman, HAVE given us some really powerful techniques that we wouldn't have had if they hadn't developed or published. They've been relatively flexible about free licenses, the RSAREF code lets us do real work within a reasonably broad framework, and while they've written some heavy cease-and-desist threats to some of us, they *haven't actually sued any of us, and as far as I can tell they're basically on our side of the people-vs-government-control game. We need to work together with them, though obviously we need to keep trying to convince them to let us do more, either for free or for money; I hope they'll turn around. PGP has certainly been a catalyst for getting them to address our part of the market.... Whenever possible, at least for the next 5-7 years until the patents expire, I'm planning to put up with the limits of their licenses for production code, though research is a different story. Besides, there's a certain amount of hack value in programming with one hand tied behind your back :-) ; we can do just about everything we need using the RSAREF interface, though some applications would be simpler and cleaner without its limitations. One especially nice thing about RSAREF is the ability to use our work internationally. Sure, they're covering their behinds by forbidding export of the RSAREF code, but they haven't told use we can't export code written to use their interfaces, or forbidden us to use RSAREF to communicate across the political borders. Using illegal code like PGP to do so creates too much opportunity for the SS/NSA/etc to bust us, even if RSA hasn't pressed charges. Bill Stewart # Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 Fax-4876 # AT&T Bell Labs, Room 4M-312, Crawfords Corner Rd, Holmdel, NJ 07733-3030

1 0

questions...
by jdblair＠nextsrv.cas.muohio.edu 02 May '93

02 May '93

Hello, all. I'm new to this mailing list, but I've been following it for about 1/2 a week now, and I think I've found my niche. However, I've got a few questions that I was wondering if someone could help me with. 1) Is there a suggested, general purpose book on cryptography that would introduce me to the basics, and expand into more of the theory? I'm decent at math, but its definately not me strong point. 2) I've downloaded to source code for Mac PGP from soda.berkeley.edu. Is there an executable version available? I haven't learned C yet, and I don't have easy access to a C compiler, although I'm pretty sure I can take care of it if I have to. Also, on another note. I've noticed the discussion about passing out information at Raves. The idea sounds like a good one, but is IMHO a definite long shot. Most of the ravers that I know a definate math-phobes, and paradoxically practically technophobes. If not technophobes, they would rather not deal with it except for their weekly rush. Still, I like the idea of passing stuff out there. For at least every 50 people who go "huh?" there will be someone who goes "yeah!" and explains it to his friends. I would pass out info here in the Cincinatti area when I go, and at other times I could give the leaflets to a friend who is more of a raver, and just tell him to scatter them about. Someone will read it, and catch on, and that will be worth it. Now, this may sound like a stupid q, but does gzip decompress the ZIP format that you say the info you have is in? In my experience, ZIP has been a DOS compressor, and I am more of a Mac/Unix person. Again, if necessary, I can take care of it. later, john blair. jdblair(a)nextsrv.cas.muohio.edu data is fluid. will do multimedia for food- contact me.

1 0

Re: OUTDIAL SERVICE
by uni＠acs.bu.edu 02 May '93

02 May '93

I don't know if this is consistant with what everyone here is talking about in regards to "outdialing serivce," but some time ago I heard about a 900 number that a person could call, that would redirect their call so as to avoid being traced, etc. Oddly enough, I think they advertised that all the calls are logged and kept in some vault in another state. I may be confusing something here though. (As if this is the case, they've probably gone out of buisness.) ---- ghoast(a)gnu.ai.mit.edu ---- Yeah, I've heard of the system too. They claim they wont let their info out without a court order. I feel that there are a good deal of legal problems with this. It wont take much to get a court order and the ONLY reason worth the 2 bucks or whatever they want to add to what would otherwise be a local call (for caller ID evasion anyhow) would be to avoid legal action of one type or another. I suspect that the calls that go through this system are monitored occasionally too.

1 0