- cypherpunks-legacy - lists.cpunks.org

Re: The New GAK-Clipper Thing will Fail
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:07 PM 10/3/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >The point, of course, is NOT to encourage these companies to support Clipper >IV. Rather, goal is to suggest to them a "poison pill" which would make >their cooperation meaningless in the end, while at the same time giving them >a 2-year free 56-bit export. Think of it as a monkey-wrench they can throw >into the works. A really _fine_ post! I'm also impressed by the way they announced it just _after_ Congress ended its session, while they're busy losing the export level in court. On the other hand, boycotts aren't particularly useful, when RSA (who is or is not joining the Bad Guys) owns half the public key patents and Cylink (who definitely is) owns the other half. If you're selling public key, you've got to pay the Bad Guys, until the DH patents expire in 97 (later for RSA.) Or you've got to buy from somebody who's paying the Bad Guys. And the Bad Guys Unindicted Co-Conspirators' announcements haven't even _mentioned_ permitting export of public key technology (since 56-bit RSA doesn't quite make it.) But they _could_ export Kerberos, with only minor hacks needed to implement Key Ripoff. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com America's Open Presidential Debate - Beyond Dole and Clinton! <A href="http://gate.net/~bdcollar/bbe/debate.htm">Tuesday, Oct. 8th 8:00 PM EDT</a>

1 0

Re: WINDOWS NT ????
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:47 PM 10/3/96 +1030, you wrote: >hi, > is Windows NT secured system ? Windows NT 3.51 is a real operating system. It is not as secure as I would like, but it is much better than Windows 3.1, which was totally insecure. It has some good security techniques, but I don't know how secure the networking is, and networking is the big technical insecurity on most machines today. (Well, bad administration is the biggest insecurity on almost all machines for almost all time. And physical security is also big.) Windows 4.x moves the graphics/windowing system into Ring 0, where the "secure" parts of the kernel are. Bad. This means graphics bugs can make the kernel insecure or crash. I don't trust it, especially because Windows 3.1 crashes all the time for me, and stupid bugs make Windows 3.1 behave badly for me. So if they put the window system in the kernel, I don't trust it. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com America's Open Presidential Debate - Beyond Dole and Clinton! <A href="http://gate.net/~bdcollar/bbe/debate.htm">Tuesday, Oct. 8th 8:00 PM EDT</a>

1 0

Re: Fighting Clipper III
by jim bell 17 Dec '03

17 Dec '03

At 08:37 PM 10/3/96 -0700, Declan McCullagh wrote: >IBM truly does deserve to be criticized, soundly. When I get a chance I'll >write up the report of what happened at yesterday's IBM "let's recruit >industry to join our alliance" confab session that took place in the >afternoon at their DC lobby-office. It was supposedly closed to the >press. :) > >-Declan If those "Big Brother Inside" stickers are re-printed, in fine print should be included a web-page at which more information could be obtained. See, I anticipate actually visiting local hardware/software sellers and placing those labels. Including an address would allow people to get far more information, and get involved. Jim Bell jimbell(a)pacifier.com

1 0

RSA's Official Permission
by The Deviant 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- RSA Optimistic on User Benefits of Administration's Recent Key Recovery Initiative Announcement Further policy change required for US vendors to be competitive worldwide REDWOOD CITY, Calif.---Oct. 2nd, 1996--RSA Data Security, Inc., a wholly-owned subsidiary of Security Dynamics Technologies, Inc. (NASDAQ: SDTI), issued the following comments on the administration's recent announcement of a Key Recovery Initiative: The administration's proposed Key Recovery Initiative is a positive step towards meeting the needs of individuals and organizations that buy and use products which utilize encryption. However, the proposal leaves significant competitive issues unresolved for suppliers who compete overseas. Modern encryption and authentication technologies are crucial to the growth of electronic commerce and the health of the future global electronic economy. The continued leadership of American computer and software firms in the world market depends on their ability to provide competitive solutions for consumers and business around the world. These consumers and businesses depend increasingly on encryption and authentication technologies -- such as those developed at RSA -- to provide solutions that protect the privacy of consumer purchases, personal medical information, sensitive corporate data, and electronic commerce and funds transfers as they travel over the global Internet. US government agencies, however, have long insisted that they must have potential access to all encrypted information for law enforcement purposes, and have advanced several proposals towards those ends. To date, these proposals have met with little support from the user and vendor communities due to concerns about privacy and competitiveness. This new proposal from the administration, however, is a move in the right direction for users. One positive step is that the administration has indicated, for the first time in over six years of discussion, that it will lift all key size restrictions on the export of products which utilize cryptography, provided that manufacturers provide a viable means of key recovery for legitimate government access. In addition, under the administrations proposal, industry, not government, will develop and propose the actual key recovery mechanisms. This will to result in more effective solutions to managing and recovering keys. Finally, the proposal addresses the concerns of users that any third party designated to hold user keys might improperly disclose those keys, thereby compromising a user's right to privacy. The administration has agreed that under certain circumstances, organizations would be allowed to "self-escrow" their own encryption keys. RSA is confident that industry can develop and gain approval for several excellent key recovery mechanisms that would be acceptable to government concerns. In fact, RSA has been a pioneer in this field with our RSA Emergency Access technology in its award-winning RSA SecurPC product. In the case of SecurPC, companies using the product can use Emergency Access keys with RSA's unique secret-splitting technology to gain access to critical information in the event of an emergency. The recently announced Key Recovery Alliance, of which RSA is a part, is chartered to provide a flexible, workable solution for users working within the government's proposed key recovery framework. Members of the group are working on technology which will allow users to maintain the privacy of their keys while allowing legitimate business or law enforcement authorities to recover keys when appropriate. It will also address challenges that arise when a user must comply with the differing encryption policies in countries around the world. The technology could allow products to provide the flexibility a user needs to take full advantage of the maximum privacy allowed in their locality, while maintaining interoperability and information exchange with other users regardless of location. It is not clear, however, to what extent the administration's proposal provides relief to US software and hardware companies who must compete with foreign suppliers. These foreign suppliers, not subject to US law, can provide strong, non-key-recovery encryption in their products. Today, most major computer and software solutions firms derive significant revenues from outside the United States. The government's proposal, while satisfying the US government's needs, does little to enhance the competitiveness of American products overseas. Robust encryption products are already available from many overseas suppliers, and U.S. market share in encryption-enabled products is under siege. Under this proposal, it appears that U.S. companies will still be prohibited from selling non-key-recovery encryption solutions in overseas markets, creating a significant barrier to their competitiveness. RSA looks forward to additional announcements by the administration that specifically address this issue and provide competitive relief for the US computer software and hardware industries. RSA Data Security, Inc. RSA Data Security, Inc., a wholly-owned subsidiary of Security Dynamics Technologies, Inc. (NASDAQ: SDTI), is the world's brand name for cryptography, with more than 75 million copies of RSA encryption and authentication technologies installed and in use worldwide. RSA technologies are part of existing and proposed standards for the Internet and World Wide Web, ITU, ISO, ANSI, IEEE, and business, financial and electronic commerce networks around the globe. The company develops and markets platform-independent developer's kits and end-user products and provides comprehensive cryptographic consulting services. Founded in 1982 by the inventors of the RSA Public Key Cryptosystem, the company is headquartered in Redwood City, Calif. -0- Note to Editors: BSAFE and TIPEM are trademarks of RSA Data Security, Inc. All other product and brand names are trademarks or registered trademarks of their respective companies. | [1]Al Gore's Statement | [2]Jim's Testimony | [3]IBM's Alliance | CONTACT: Corman/Croel Marketing & Communications (for RSA) Patrick Corman, 415/326-9648 [4]corman(a)cerfnet.com ---------- End Forwarded message ---------- This is definatly bad... If you want to look it up yourselves, its at http://www.rsa.com/PRESSBOX/releases/keyrecov.htm --Deviant They seem to have learned the habit of cowering before authority even when not actually threatened. How very nice for authority. I decided not to learn this particular lesson. -- Richard Stallman

1 0

NYT Nix GAK
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, October 4, 1996, p. A32. A Flawed Encryption Policy [Editorial] The new White House proposal to keep high-powered encryption software out of the hands of foreign terrorists and criminals is needlessly restrictive and probably unworkable. Though the new plan is better than previous Administration proposals, it risks doing more harm than good. The Administration is rightly worried that foreign terrorists or criminals will get hold of encryption software that will make it impossible for the Government to eavesdrop on their telephone and computer messages. The technology is legal in this country, but the Administration wants to keep the powerful new software out of foreign hands. However, the Administration downplays the fact that encryption is also a good way for honest citizens to prevent crime. At a time when banks and other private companies send vast amounts of confidential information over the electronic highway, it would seem sensible to make high-quality encryption widely available so that the private sector can protect itself from criminal or malicious eavesdropping. For that reason, the Government ought to promote wide-scale dissemination of encryption, both here and abroad. Trying to block dissemination is probably useless and almost certainly harmful to American exports. Powerful encryption systems made by foreign companies are already available in Europe and Asia, and American exporters will need to sell state-of-the-art software to keep competitive. The Clinton Administration previously proposed that the computer industry adopt a single type of encryption, known as key-escrow, which would scramble messages with mathematical passwords. Under the plan, private companies and individuals would turn over these passwords to the Government, which, with court authorization, could use them to unscramble the phone and computer traffic. The purpose of key-escrow, then, would be to preserve the Government's existing ability to tap phone calls. But that Clinton plan was firmly rejected by industry and privacy-rights advocates who feared that a government that held passwords would abuse First Amendment prohibitions against listening in on private communications. The latest White House plan addresses many of these concerns. It would impose restrictions only on the software that exporters sell abroad. Privacy advocates have less to fear from the latest plan because it would allow individuals to deposit their passwords with private organizations, rather than the Government. Yet the Administration has not explained why foreigners would buy American software that would allow the F.B.I. to eavesdrop when they could buy equally powerful software from non-American manufacturers that omits any such trap door. Critics assume that foreign governments -- few of which pay attention to American constitutional protections against invasion of privacy -- would demand access to passwords, making such software unattractive for anyone to use. There is room to improve the plan. A panel of the National Research Council recently concluded that there is no good reason to restrict exports of currently available encryption because foreigners already have access to equally powerful software. There is time to work out restrictions, in cooperation with the industry and privacy advocates, for the next generation of encryption software. In the meantime the Administration might push forward on the panel's other sensible recommendations -- such as developing better encryption expertise within the F.B.I. and helping the private sector develop the encryption software it needs to stop illegal eavesdropping. [End] The National Research Council report is available at: http://pwp.usa.pipeline.com/~jya/nrcindex.htm

3 3

Re: Key recovery/RSA/Bidzos/WTF?!?
by Rich Burroughs 17 Dec '03

17 Dec '03

At 08:38 PM 10/3/96 -0700, Declan wrote: >PC World (at www.pcworld.com) has a radio interview with Bidzos, I'm >told, probably in the same story for which they interviewed me. RSA's "position statement" is at: http://www.rsa.com/PRESSBOX/releases/keyrecov.htm ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

RE: DESCrack keyspace partitioning
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

"geeman(a)best.com" <geeman(a)best.com> wrote: >(P)RNG's just aren't that likely to produce a key of 010101010..... nor 001100110011... etc etc and I have been thinking about how one might formalize and exploit this randomness property to increase the probability of finding the key sooner. ... >Any thoughts here? Suppose we have a function f() that randomly chooses an integer between 1 and 100 such that each integer in the range is equally likely to be selected on each call. If we call f() 6 times, each time noting whether the result is even or odd, which of the following sequences is more likely? Even Even Even Even Even Even Even Odd Odd Even Even Odd If you picked the second sequence as more likely, you are like most people who responded to similar questions in a classic study of cognitive biases [1]. The two sequences actually have an identical probability of occuring, and, in fact, all sequences of six outcome are EQUALLY probable. This example illustrates the representativeness bias, in which we mistakenly suspect the global characteristics of a process to be represented locally in a specific sequence[2]. Ciao, James 1. Kahnman, D., and Tversky, A. Subjective probability: A judgement or representativeness. Cognit. Psych. 3 (1972) 430-454 2. Stacy, Webb and MacMillian, Jean, Cognitive Bias in Software Development. Communications of the ACM June 1995, 57-63

1 0

RE: DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

Sorry, but you are ASSUMING that which I dispute. The point I am making is that keys in the real world are not uniformly distributed. Some results forthcoming. Suppose we have a function f() that randomly chooses an integer between 1 and 100 such that each integer in the range is equally likely to be selected on each call. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If we call f() 6 times, each time noting whether the result is even or odd, which of the following sequences is more likely?

1 0

RE: DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

Re: DESCrack keyspace partitioning geeman(a)best.com wrote: > > What about the heuristics of partitioning the keyspace? > > Seems to me that a _subset_ of all possible keys is much more likely > to appear than a random selection from an equidistributed population 0..2^56. > > (P)RNG's just aren't that likely to produce a key of 010101010..... > nor 001100110011... Why? They seem just as likely as any other sequence. I left out a piece: again heuristically speaking, most DES keys are derived from pasword hash, or similar technique. In such a case the statistics of the generated keys are (it looks like) _highly_ skewed. etc etc and I have been thinking about how one might formalize > and exploit this randomness property to increase the probability of finding the key sooner. Again, which randomness property? The property that essentially _no_ predictability is found in a hash-derived key. Gary -- "Of course the US Constitution isn't perfect; but it's a lot better than what we have now." -- Unknown. pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0

[IMPORTANT] GAK
by dustman＠athensnet.com 17 Dec '03

17 Dec '03

Timmy May is a convicted child molester.

1 1