- cypherpunks-legacy - lists.cpunks.org

my last post
by 00MYRICHARDS＠leo.bsuvc.bsu.edu 01 May '93

01 May '93

Sorry if I'm just wasting bandwidth here. I just asked if I'd gotten through because I couldn't find any reference to this list on the system and I figured the people at Mondo 2000 probably just made it up. I guess not. Cool. I got a message telling me how to subscribe, so I guess I'll talk to y'all later. -SMR

1 0

Re: OUTDIAL SERVICE
by ghoast＠gnu.ai.mit.edu 01 May '93

01 May '93

I don't know if this is consistant with what everyone here is talking about in regards to "outdialing serivce," but some time ago I heard about a 900 number that a person could call, that would redirect their call so as to avoid being traced, etc. Oddly enough, I think they advertised that all the calls are logged and kept in some vault in another state. I may be confusing something here though. (As if this is the case, they've probably gone out of buisness.) ---- ghoast(a)gnu.ai.mit.edu ----

1 0

Patent fallacies
by wuthel!noisy＠drums.reasoning.com 01 May '93

01 May '93

There seems to be some misunderstanding of how patent protection works. Page numbers in square brackets are references to _Patent_It_Yourself_ by David Pressman (Nolo Press) 2nd edition. Page numbers in angle brackets are to ``Intellectual Property'' by Miller & Davis (West) 2nd edition. CONTRIBUTOR INFRINGEMENT ``If your claims don't read on the infringnid device, but the infringing device is a specially made compenent tha't nly useful in a machine covered by your patent, the ingringer may be liable under the doctrine of `Contributroy infringment' '' [page 15-9] ``If a person actively encourages another to make, user or sell the inventino without permission, the psers so inducing is liable for INDIRECT infringment. CONTRIBUTORY infringment can be commmitted by know selling or supplying a non-stape item for which the only or predominant use is in connecitno with a patented invention.'' <130> ``Contributory infringement can occur only in connection with a SALE . . . Thus, a contributory infringer can be liable for infringment even though what he has sold is completey i the public domain and has no patent protection itself.'' <131> HOME INFRINGEMENT ``While 'home infrignement' may be difficult to detect, nevertheless it is a form in infringment which is legally actionable and can subject the infringer to paying damages and/or an injunction prohibiting futher infringement '' [page 15-12] ''A patenet ahs the EXCLUSIVE right to MAKE, USE or SELL the invention. 35 SUCA Par 154 <128> .... The owner of a patent ... has the right to exclude all others from using ... it. SELECTIVE ENFORCEMENT IS OK ``. . . a patent owner is not prejudiced by the fact that antoher infringer has prodcuded the item without notice of the paten even though a later second infrigner could legitimately claim that he copies an unmarked product.'' <129> /w

1 0

Crytography
by x62727g2＠usma8.USMA.EDU 01 May '93

01 May '93

I thought this list was supposed to have a lot of technical stuff--something on the order of disseminating new ideas on the cutting edge of crypto-technology. Most everything I see these days seems purely political. If there are problems with RSA v. PGP or the Wiretap Chip (and there definitely are!!!) then we should concentrate on designing our own. We can do things like redesign and code the engine in PGP which is normally handled by the RSA proprietary code and we can work to come up with voice encryption alternatives to the Wiretap chip. In other words, let's start using resources other than talk. Talk is cheap but actions are the catalysts of change. I am interested in working with people (perhaps you) on projects involving crypto, computers, and telecommunications. If any of you are serious enough to do more than talk, perhaps we can organize a team to vigorously pursue these projects. Anthony J. Gatlin |-------------------------------------| Cadet Private, Co. G-2 |PGP Public Key available on request. | United States Military Academy |-------------------------------------|

2 1

hello
by 00MYRICHARDS＠leo.bsuvc.bsu.edu 01 May '93

01 May '93

Have I managed to reach you? (If so, please reply.)

1 0

clipper poll
by phr＠america.Telebit.COM 01 May '93

01 May '93

Date: Sat, 1 May 93 08:28:04 PDT From: wuthel!brand(a)drums.reasoning.com (Russell Brand) To: brand(a)drums.reasoning.com Subject: CLIPPER POLL please propigate this to like minded people I am one of the many concerned computer scientists opposing the `Clipper Chip Initiative' that would waste the better part of eight billion dollars, interfere with individual privacy, promote harassment of individuals, threaten US competiveness and in fact simplify many types of criminal activity. It is important to take this opportunity to show the level of public opposition to this extension of domestic spying and abuse of government funds. Given the congressional vote to allow even more telephone taps WITHOUT warrents earlier this month, this is even a more pressing issue than it would otherwise be. Of course you should show your opposition in other ways as well, but this is a FREE and EZ first step. If you aren't sufficiently familiar with the issues, please feel free to send me email on the topic /Russell Communications Week magazine has a weekly telephone response poll. This week's question is: Do you agree with the Clinton administration's Public Encryption Management directive for communications equipment? Yes: 800-242-CWKY No: 800-242-CWKN Excerpted from `Boston Globe' of April 11, 1993, page 16. New England Votes in Congress Roll Call Report Syndicate WASHINGTON - This is how New England members of Congress were recorded on major roll-call votes last week. ... TO EXPAND FBI PHONE ACCESS: By a vote of 367-6, the House sent the Senate a bill expanding the FBI's power to obtain, without court warrants, telephone records and conversations in investigations of international terrorism and espionage. The bill grants the FBI access in such investigations to information on unlisted numbers that phone companies cannot now divulge. It also enables FBI counterintelligence agents to obtain a broader range of telephone conversations involving suspected terrorists and spies. A yes vote was to pass the bill. ..

1 0

clipper and public key
by Eric Hughes 01 May '93

01 May '93

Tim mentions that the Clipper chip requires public key in order to be useful. This is not quite right. The clipper chip is only a symmetric-keyed block cipher with a peculiar (and condemnable) key setup feature. the chip _per se_ does not involved public key. The problem is that you have to get the same key on both end of the link without transmitting it. There is a "public key" way of doing this: Diffie-Hellman key exchange. That would require licensing from RSADSI. This is not, however, the only way to do this. If you have a symmetric cipher and a secret system key not known to the participants, i.e. embedded in hardware, then you can also transmit a session key simply by encrypting it. Of course if you know the system key then you can read the traffic, LEEF's aside. Such a system master key could fairly easily be discovered, unless it's burned into the chip by the manufacturer and the secret ends there. (Yeah, right) Hence in order for a reasonably (?) secure implementation of a telephone which uses the clipper chip, D-H seems to be necessary. In fact, the AT&T 3600 phone does use D-H for key exchange. Some have asked how come AT&T doesn't get sued by RSADSI. Easy: they're a licensee. In summary: Does clipper require public key? In itself, no. In implementation, likely. Eruc

1 0

Re: Tough Choices: PGP vs. RSA Data Security
by Sy Verpunc 01 May '93

01 May '93

A better course of action might be to remove the RSA engine from PGP and distribute the source code, and a binary for free, but require users to pay $30-50 to RSA to get the source code and binary for the RSA engine. Thats what people have *always wanted* to do. RSA won't let them. That's why any talk of a newer friendlier Bizdos is bullshit. G

5 4

Re: validity of the RSA patent
by markh＠wimsey.bc.ca 01 May '93

01 May '93

> > Consider use of another public key encryption scheme, say LUC encryption. > > Which, of course, is patent-pending. It appears that we can no more > make progress in cryptography in the face of algorithm patents than > we could advance mathematics under the burden of theorem licensing. > We can't afford to wait until 2001. On the other hand, perhaps the patent holder of LUC would be willing to licence LUC for use in a PGP-like tool (or PGP 3.0) on the same basis IDEA is now licenced to PGP users. (i.e. non-commerical use is OK. Even certain commercial use is OK.) This might solve a lot of our problems. Has anybody asked? I can't be the first person to have considered asking. Mark -- Mark Henderson markh(a)wimsey.bc.ca RIPEM key available by key server/finger/E-mail MD5OfPublicKey: F1F5F0C3984CBEAF3889ADAFA2437433

1 0

PGP on soda.berkely.edu
by Hal 01 May '93

01 May '93

-----BEGIN PGP SIGNED MESSAGE----- I want to thank Tim for taking the time to help clarify what he had in mind in proposing that we reconsider our support for PGP in the face of PKP's assertion of patent rights: > I completely agree and nothing I have ever said suggests we place all our > faith in his company or any other institution. What I have said--several > times, now--is that a frontal attack on the RSA patents, via highly public > postings of PGP and a "Fuck you!" approach to talking with patent owners, > is not the best strategy at this time. Speaking in generalizations can only go so far. It's more useful to consider specific actions which might be in keeping with this philosophical approach. I don't have many problems with our being civil to RSADSI. We don't need to spit in Bidzos' face whenever we meet him, refuse to shake his hand, whatever. Tact is OK. And the proposal to make a U.S.-legal version of PGP can't hurt anything, either. Moves in this direction have been going on for some time. Several months ago a patch was inserted to make certain data structures be compatible with RSA's PKCS standards, and therefore with RSAREF. This would allow RSAREF to be used if permission were gained to call it at an entry point not on the allowed list. However, this version of PGP would still be incompatible with pre-2.2 versions. To make a fully compatible version of PGP you not only have to call RSAREF at an undocumented entry point, you also have to modify the code slightly. All this has been going on for a few months. Eric Hughes deserves a lot of credit for encouraging progress in this direction, but I think Phil fundamentally agrees as well. One advantage of a U.S.-legal version of PGP is that its very existence would mean that no one HAD to use it. Sending out a PGP signed message would no longer be incriminating, even if you used the older (and presumably faster) version of PGP. There would be no way to tell from external observation which PGP users were using the legal one and which were using the illegal one. They would be functionally equivalent, but the legal one would be slower. (I find this rather amusing, actually, as it just goes to show the illogic of PKP's position.) What are some other issues that might arise in a move away from PGP, and an adoption of a less confrontational attitude towards RSADSI? One is the existance of PGP on the Cypherpunks server. Presumably this could be replaced by the legal version once that becomes available, but in the mean time it might have to disappear. I would oppose removing it unless a legal replacement were ready. Another suggestion that I have heard rumored is that Bidzos might be invited to join the list. I would strongly oppose this. I am also not comfortable with having him be a participant at Cypherpunks meetings but since I don't attend them I don't really have the right to complain. Tim has suggested, if I understand him, that we in some sense work to improve MailSafe and other RSA products. I don't really like the idea of doing unpaid consulting work for a commercial outfit. If I am going to work for free, on my own time, I'd like to see the software made freely available. So any work with RSA should be on freeware products, in my opinion. Improve RSAREF, not MailSafe. Another issue is whether people would be discouraged from discussing infringing projects on the Cypherpunks list or at the meetings. Suppose somebody wants to talk about a socket-based DC net protocol which uses Diffie-Hellman key exchange to initialize a shared PRNG for random bit generation. Oops, DH is a PKP patent. Again, I feel that this kind of project is entirely appropriate for the list and the group. Does this fall into Tim's confrontational category: "distributing infringing code whenever possible"? I'm not sure. (I have to confess, given the 15 hour delay in my message posting the other day (while a short message I dashed off 12 hours later appeared in a few minutes), that I thought perhaps a filter had been installed to prevent PGP-signed messages from appearing. Of course, my message did eventually appear, the delay being just a technical glitch. I assume that no one would support banning PGP-signed messages from appearing on the list.) A really sticky issue is our public attitude towards Bidzos cracking down on unauthorized crypto. What if some lone wolf out there does decide to go to the mat on PGP or some other infringing software? Whose side do we take? (Refusing to take a position is a de facto support of PKP, IMO.) I guess we'd have to hope that this never happens. Gee, it sure seems strange to HOPE that no one ever stands up to PKP. I have to say on this point that I can't accept the idea of Cypherpunks moving into a Sternlight position of support for PKP's crackdowns. I'd be interested in hearing other specific suggestions for changes which might result from Tim's suggestion. This might help focus the discussion better. === To the extent that Tim is proposing that we encourage efforts to make a U.S. legal version of PGP, and even replace the current version of PGP on the Cypherpunks FTP site with the legal version when that becomes available, I have no problem with it. To the extent that he suggests that we be polite and courteous in our public talk about RSADSI, I can accept that as well. But to the extent that anyone is proposing to go beyond this into some of the other areas I listed above (and I have no idea exactly what anyone has in mind specifically), I think the many problems I and others have listed in earlier messages provide strong arguments against such measures. Hal 74076.1041(a)compuserve.com -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK+KBE6gTA69YIUw3AQE77QQAnbYSx8cqvvraaJGeUXDKJT0mQVv/HbAj r5IehVCB5/fMeZiaY9ERdBOwllgvJiTRzN3tsHJAkd8QTz9Puv5UgVXLbjPWdQvS 5XPYFkH+A4Kaos+Rlwo1ufLQ1S3eFyV35L6e9CptgYqni/QQoZFhU7Wjqlv5QQmH KcE2xEMLMas= =JL8R -----END PGP SIGNATURE-----

1 0