- cypherpunks-legacy - lists.cpunks.org

Re: Tough Choices: PGP vs. RSA Data Security
by dmandl＠lehman.com 29 Apr '93

29 Apr '93

A new PGP with an RSA-approved engine and a reasonable license fee sounds fine to me. --Dave.

1 0

CSPAN NOT covering the hearings tommorrow
by crunch＠netcom.com 29 Apr '93

29 Apr '93

Called CSPAN, and they are NOT covering the hearings tommorrow. Hah! our tax dollars at work!! So, for those very luckey people going to attend, we plead with you to please write up a comprehensive report and send it to the group (or at least to me!!). JD

2 1

RE: HELP! Some nut is threatening to sue!
by DrZaphod 29 Apr '93

29 Apr '93

In Message Wed, 28 Apr 93 21:31:10 MDT, Stanton McCandlish <hydra.unm.edu!anton(a)netcomsv.netcom.com> writes: >Due to my posts to sci.crypt and elsewhere that I was distributing PGP, >I recieved the following >From: jim(a)RSA.COM (Jim Bidzos) >To: anton(a)hydra.unm.edu >Subject: pgp > >I don't think you're aware of our position on pgp. Unfortunately, you >may leave us no choice but to take legal action, which we will unless >you cease promotion adn distribution of pgp. The next message will >state our position. For a guy who claims to want to help us Cypherpunks in the way of personal encryption, scare tactics seem a little out of place. I'm sure we'd all like to use legal encryption methods [maybe]... but we ARE Cypherpunks.. giving us the responsibility to use what's best and defend our rights for privacy. Using a package that hasn't been updated in 5 years [MailSafe], we have diminished to politically correct yippies. I;m not sure quite what to do.. but I saw Jim Bidzos on a magazine once.. and he looks like a fed. By playing the game we are becoming part of it. TTFN. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - DrZaphod #Don't Come Any Closer Or I'll Encrypt! - - [AC/DC] / [DnA][HP] #Xcitement thru Technology and Creativity - - [drzaphod(a)ncselxsi.uucp]# [MindPolice Censored This Bit] - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

2 1

Re: Tough Choices: PGP vs. RSA Data Security
by George A. Gleason 29 Apr '93

29 Apr '93

At risk of getting the goats of some friends of mine who read the list, I'm tending to agree with Tim's ideas here. Brief conversation with Jim Bidzos at the cypunx mtg indicated that he is very much up for something along the lines of a personal encryption product that would meet our needs. From a business perspective it's easy to see why RSA haven't gone for this yet; a copmany needs to concentrate at first on the most likely profitable lines of operation, and once that's solid, go for the wider market. Right now we have an incredible array of crypto talent which can be brought into a cooperative arrangement in developing additional RSA products. The result may turn out to be as good as the best potentials of PGP, and at the same time, support for RSA's position vis-a-vis any possible govt attempt to go after the patents. I don't see this as a matter of withdrawing support from the people and efforts which brought forth PGP. They're going to have their hands full doing *something* about Clipper right now, and that will deserve a lot of support. PGP has fulfilled its promise in many ways. It pre-empted the chance of an early govt ban on private crypto. It stimulated wide interest in crypto. It also provided a great market demonstration for the potential of an affordable strong personal encryption program. By this time, Jim Bidzos has a great case to make to his stockholders, for the business potential of personal cryptography. And PGP also brought together a wide community of cryptologists and programmers and end-users and so on. Consider a band who release a record on an underground label, which then makes it onto college radio in a big way, and the band gets a chance to get major distribution from that. They'd be dumb not to, as long as they can keep their artistic autonomy; and a smart record company executive knows that it's better not to try to tamper with a Good Thing. So here we are at the next step; public keys for the masses have the chance to come aboveground in a big way, and achieve even wider distribution and use. Now if those carrots aren't tasty enough; consider the stick: there is a long history of the govt doing in its adversaries by divide-&-conquer, along the lines of getting all kinds of infighting going among people who would be logical allies. Read the history of COINTELPRO for many examples. A major rift between PGP and RSA folks will only serve the interests of those who would rather both systems be banned. On the other hand, increased cooperation builds strength against possible governmental action in the future. -gg

2 1

Re: Tough Choices: PGP vs. RSA Data Security
by Sy Verpunc 29 Apr '93

29 Apr '93

: At risk of getting the goats of some friends of mine who read the list, I'm : tending to agree with Tim's ideas here. Brief conversation with Jim Bidzos : at the cypunx mtg indicated that he is very much up for something along the : lines of a personal encryption product that would meet our needs. From a All he has to do is let us pay a licence fee for pgp. What's the advantage to him in asking for a different piece of code that uses RSAREF and DES instead of Phil's code and IDEA? I can't see it, except that using DES blows away the security of the program... No, I think this suggestion should be put down now, or we'll splinter and give them exactly the divide-and-conquer opening they're looking for. G

3 2

Re: Tough Choices: PGP vs. RSA Data Security
by nmh＠thumper.bellcore.com 29 Apr '93

29 Apr '93

Let me add one vote of support to your proposal ... and another reason you may not have considered. I use PGP for personal communications. I'm not a big enough target for anyone to sue. On the other hand I do *not* use PGP for anything related to my employment. My company (Bellcore) is large enough to get sued, and everyone loves to hate the telephone industry. As a result, I would happily pay a resonable license fee. Neil Haller nmh(a)thumper.bellcore.com

2 1

PGP is NOT availble from NITV anymore!
by Stanton McCandlish 29 Apr '93

29 Apr '93

Due to threats of legal action from RSA, I have had to remove PGP from my system. Some time when I get the mess sorted out, non-patent-infringing PGP/RSA/[your-fave-crypto-here] utilities, such as mail scripts, will still be available, and I will post a message with the detail. I repeat, PGP *IS NOT* available from NitV-BBS any longer. Do not call for it you will be wasting your money and time. Sorry, but the law is the law. - S. McC. -- Testes saxi solidi! ********************** Podex opacus gravedinosus est! Stanton McCandlish, SysOp: Noise in the Void Data Center BBS IndraNet: 369:1/1 FidoNet: 1:301/2 Internet: anton(a)hydra.unm.edu Snail: 8020 Central SE #405, Albuquerque, New Mexico 87108 USA Data phone: +1-505-246-8515 (24hr, 1200-14400 v32bis, N-8-1) Vox phone: +1-505-247-3402 (bps rate varies, depends on if you woke me up...:)

1 0

Limbaugh & Liddy
by Xiao Zhou 29 Apr '93

29 Apr '93

>> In <9304231457.AA22562(a)gmuvax2.gmu.edu>, 7025aj(a)gmuvax2.gmu.edu writes: >> |> >> |> send him [Limbaug] some convincing words, please? >> |> >> |> G. Gordon Liddy would be another good target, but I don't know his address > >cp(a)jido.b30.ingr.com (Serrzna Penvt Cerffba) [!Is that real rot13!?] replies: >> My guess would be that Liddy and Limbaugh would both be very >> happy about the Tapper chip proposal... 1) Any publicity is good for us. These guys need controversy, and we've got it. 2) There's the 'international competitiveness' issue. 3) These guys hate Clinton to Schiminton. 4) Even if they pick the other side, we look good. 5) Larry King would of course be better, but is he returning your calls?

1 0

Tough Choices: PGP vs. RSA Data Security
by Hal 29 Apr '93

29 Apr '93

-----BEGIN PGP SIGNED MESSAGE----- Tim May writes: > I suggest that we as a community seriously reconsider our basic support for > PGP. Not because of any flaws in the program, but because of issues related > to Clipper and the potential limits on crypto. I see several problems with this proposal. 1. It's not clear what it means to "reconsider our basic support for PGP." What exactly is Tim proposing? That people stop using PGP? That they phase out their use of it as legal products become available? I'd like to see some clarification. 2. More generally, what about the issue of our advocating and supporting other possibly infringing actions? Which ones do we stop? Just those that upset Jim Bidzos? He claims to have patents that cover many more activities than RSA, including patents which cover the very idea of public key encryption, and patents on Diffie-Hellman key exchange and virtually any conceivable variation. Should we respect all of these now? 3. David Chaum apparently has U.S. patents on many key features of digital cash. It looks like we would have to stop working on that, too, by this reasoning. 4. What reasonable alternatives to PGP exist? Is RSAREF really usable on a PC? I tried an early version and it was terribly, terribly slow. PGP is just barely fast enough. A "legal" version of PGP which uses RSAREF will presumably be considerably slower. 5. I am not as convinced as Tim that RSADSI is truly, positively, certainly on our side. Why is it that RSAREF has such a weak conventional encryption algorithm (DES, with 56-bit keys)? RIPEM has been out for many months, and people have been asking for IDEA or triple DES all that time. Bidzos has supposedly said he'll give permission for improvements. Yet as far as I know RIPEM still only has this small key size, a key size which persistent rumors say can be broken by government computers. When Bidzos permits RSAREF to run a conventional encryption algorithm with a secure key size I will give more credence to the view that he wants people to have strong encryption. 6. How is it that one company has collected virtually all of the patents on cryptographic technology in this country? Jim Bidzos controls patents on public-key encryption in general, RSA, Diffie-Hellman key exchange, ElGamal signatures and encryption, and several others. I can't help noticing that it would be an extraordinarily convenient arrangement for the government if such a company existed and were secretly working against public use of cryptography while publically pretending to be doing all they can to bring this technology to a reluctant market. I still have not seen any specific public action by Bidzos which would invalidate this possibility. Yes, he has engaged in this widely publicized tiff with NIST over the Digital Signature Standard, and he's made some statements against Clipper. But where are the lawsuits? Is AT&T receiving the same threatening letters that Stanton McCandlish received when he said he was distributing PGP from his BBS? 7. Extrapolating from the widespread acceptance of PGP, which is free, to conclude that there is a market for a commercial encryption product which costs money is pointless. Granted, some of us may spend a lot of time talking about PGP and thinking about these issues, but most PGP users just downloaded it from a BBS or the net. There are a lot of things they'd spend $100 on before they would buy an encryption program. One of the things that attracted me to Cypherpunks is that they take steps to make these tools available without worrying about upsetting the power structure. David Chaum may object to our implementing digital cash. Jim Bidzos may object to our using RSA, or Diffie-Hellman, or almost anything else having to do with cryptography. If we're going to start looking over our shoulder and not doing anything which powerful people object to then we might as well pack up and go home. Almost everything we have talked about over the last six months infringes somebody's patents in this country. I really don't see what role a group like ours has if we have to tiptoe through the minefield of intellectual property protection which permeates the field of cryptography. Are we to become a bunch of unpaid consultants for RSADSI, writing code which they will then make profits on? Phil Zimmermann has done more to put strong cryptography into the hands of people all over the world in two years than Bidzos has managed in ten. He has faced lawsuits by Bidzos and has undergone considerable personal sacrifice in getting this software out. People talk about this "feud" as though the two are equally guilty, and ask (like Rodney King) "can't we all just get along?" But this is a cop-out. To me there is clear asymmetry in their dispute in terms of who asserts their power and who is trying to empower individuals. Look at what Tim is suggesting. We abandon PGP, not because it is a bad program; not because its author has behaved unethically; not because it has failed in its goals; but because Jim Bidzos is throwing his weight around and we don't want Jim to be unhappy. If Jim were to accept that PGP was no more threatening to his patents than RSAREF then the problem would be solved. I presume that Tim has decided that this won't happen, so now he suggests Plan B, that we abandon PGP. I have to suggest that the real obstacle to the wide deployment of strong cryptography remains Jim Bidzos. He has the power, by a single stroke of a pen, to do more to encourage the spread of cryptography in this country than any other single person (including Bill Clinton). All he has to do is to issue a policy statement that since PGP is freeware it falls under the PKP policy allowing use of the patents for noncommercial use. Presto - PGP is legal, and one of the main obstacles to its spread is eliminated. I agree with Tim that we need to look closely to see who our real enemies are. Perhaps Bidzos is a charming person. I've never met him. Certainly the bay area Cypherpunks seem to be falling under his influence. From my perspective I find this cozying up to the PKP/RSADSI power structure to be rather alarming. I don't think it is a good direction for the group. Hal Finney 74076.1041(a)compuserve.com hal(a)alumni.caltech.edu -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK9/UvKgTA69YIUw3AQGCrgQAi2980bgg4eHAoIbRUtEtT05V7+50UH16 erkzERI8ot+uk0soXPsM53YlVVAvSYVmLY5Ine862RWG0TUldq1O99CbnCet6Da9 /NWVUQCAoKrUuwj7Cetyf84wE4Fof6tbugOtXhke26WXZXhEIIsSdgKBzaDdc/LD y0zU/abZ9Es= =IKKf -----END PGP SIGNATURE-----

1 0

Re: Raving on...
by geoffw＠nexsys.net 29 Apr '93

29 Apr '93

I tend to agree with this guy, tread very carefully, we want to inform NOT proslitize. Ravers will get turned off real quick if you come on as something they MUST do. Offer information, answer questions and most of all be considerate of the fact that many people DONT know about the net or e-mail and that there may be some initial distrust from young ravers who don't know who you are because of your age, (and older guy wantin me to type some stuff into a computer? Humf, smells like DEA to me!) So go easy on folks at these things. You might want to find someone who is heavy into the Scene to go with you the first couple of times, to smooth the acceptance factor. Currently I'm way to busy with other aspects of the Scene to do this, you might want to contact some people on: sfraves(a)soda.berkeley.edu who regularly deploy VRAVE (an IRC like program for the international rave community) at raves in the Bay Area. To subscribe send a message to sfraves-request(a)soda.berkeley.edu, I've cross posted some of your mail so they are well aware of what you want to do. sfraves has been around for about a year, they are an integral and trusted part of the House Family, you might want to co-ordinate with them before you start a major campaign. I know they are working on getting the average raver signed onto e-mail. Hope this helps. ----- Begin Included Message -----

2 1