- cypherpunks-legacy - lists.cpunks.org

Re: Clipper III on the table
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:44 PM 10/1/96 -0400, Perry wrote: >We really have to work on cracking DES at least once -- it would >substantially reduce the wind in the Administration's sails. 56 bits + GAK does generally mean DES/GAK, though RC4/56/GAK is also possible. One "56-bit" protocol that might be allowable under the new rules is "something strong with all but 56 key bits revealed", e.g. RC4/128 with 72 bits salt revealed (like the RC4/128 with 88 bits salt revealed that Netscape uses, or 3-DES with 112 bits salt revealed), which would be substantially stronger against cracking than raw 56-bit DES. A big advantage is that it makes pre-computation of lists less useful, since two cyphertexts with the same 56-bit key might be different in the top N-56 bits of key, and the key schedules are less reusable. The 3DES version, for instance, also gains because some of the big DES hooks that let you scrounge a few bits don't work. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com America's Open Presidential Debate - Beyond Dole and Clinton! <A href="http://gate.net/~bdcollar/bbe/media.htm">Tuesday, Oct. 8th 8:00 PM EDT</a>

1 0

ITAR satellite provision
by azur＠netcom.com 17 Dec '03

17 Dec '03

Does anyone on the list have the exact ITAR reg. text relating to the exemption for space-launched crypto? -- Steve

1 0

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

American Banker: Monday, September 30, 1996 Microsoft Ups the PC Banking Ante with Money 97 By JENNIFER KINGSON BLOOM Launching a long-awaited assault on Intuit Inc. and its popular Quicken system, Microsoft Corp. today releases a new version of its Money personal financial management software, with new ways for banks to connect to it. Microsoft executives say Money 97 is easier to use than its predecessor and more widely available to banks. Banks can offer Money 97 services in various ways: through processors like Checkfree Corp., Intuit Services Corp., and Visa Interactive; or directly through Microsoft's "open financial connectivity" standard for on-line commerce. Microsoft also announced that 37 banks are offering Money 97 -- roughly the same number that today offer Quicken services -- and that at least 23 more will offer Money 97 by yearend. "We're here today with a lot of what Quicken is announcing they'll have a year from now," said Richard Bray, Money 97 product unit manager at Microsoft. "What this really means is more banks will be available through Money sooner than through Quicken." But Intuit officials said they did not feel threatened. "What they mostly did was add a few features we already had," said Matthew Glickman, Quicken group product manager. Bankers planning to offer Money 97 said Microsoft's open technology standard was a major benefit. "We will be able to provide our customers with the same service that they're used to, which is on-line, real-time balances," said Michael Papantoniou, a vice president in electronic commerce at Chase Manhattan Bank. "Microsoft Money and Quicken now have to go through Intuit Services Corp. - that's the big difference," he said. "ISC only has start-of-day balances." Bankers also praised Money 97 for giving prominence to bank brand names. Customers will see their banks' logo, Internet address, and whatever other information the bank chooses to provide. Henry Mounger, senior vice president of consumer product development at Deposit Guaranty National Bank in Jackson, Miss., said his own "road test" of Money 97 convinced him the bank should offer it. Deposit Guaranty had not previously offered Money or Quicken. "The overriding impression I had was its ease of use," Mr. Mounger said of Money 97. "I had never used Quicken or any other personal financial management software before, and I was banging out reports right and left." Mr. Mounger said the ability to offer Money 97 through Visa Interactive was also an attractive feature. "We're trying to maximize that vendor relationship," he said. "We obviously recognize the fact that Quicken is a very visible product in the marketplace, but we're not prepared at this point to go through all those operational issues to get up and connect." This month, Intuit announced the sale of its processing division to Checkfree. It also announced an alternative to Microsoft's technology specification that it dubbed OpenExchange. Mr. Bray of Microsoft said Intuit's standard is a late entry in the race. "They didn't announce anything new with OpenExchange -- what they were trying to do was slow down the market because they're a year behind," Mr. Bray said. "There's no reason for banks to wait another year, and the big banks aren't waiting," he said. "Why should they wait for an undocumented, unpublished format when there's one available today that they can work with?" Mr. Glickman at Intuit said his company's open standard does the same things as Microsoft's, "but in a much better way," offering a choice of processors plus "a broader range of connectivity." Mr. Papantoniou at Chase said he also viewed OpenExchange as a broader standard, but hoped the two specifications would converge. "That would benefit all banks," he said. Chase, like many of the larger banks, offers both Quicken and Money options for home banking. Some bankers who offer both products said they were pleased with the improvements to Money but are not taking sides in the Microsoft-Intuit rivalry. "The more they talk about each other, the more focus there will be on personal financial software, and the better for me," said S. Michael Woodward, a vice president in strategic marketing at Crestar Bank in Richmond, Va. "We don't come out and promote Quicken over Money or BankNow" -- Intuit's transaction-oriented offering with America Online. "I think both of them have done a very good job." Despite some bankers' neutrality, Money 97 is guaranteed to step up the competition for customer loyalty. "This is going to be a really interesting season for the personal finance software market," predicted Phoebe Simpson, an electronic commerce analyst at Jupiter Communications in New York. "The fact that you can download the Quicken data into Money 97 is going to be very interesting, and will ease the entrance of anyone who is looking to switch." Mr. Bray said Microsoft wanted to make switching from Quicken to Money "as easy as possible." Quicken users are being offered a $10 discount on the $34.95 retail price of Money 97, as well as the ability to instantly transfer all their existing Quicken files into Money 97. Microsoft also plans to offer all comers free 90-day trials of Money 97. Another new feature of Money 97, critical to banks and consumers, is Internet connectivity. Users will be able to connect not only to their banks but to a Web site Microsoft maintains that offers current stock quotations. Mr. Glickman of Intuit said Microsoft's previous efforts to make Money widely available had failed to dent Quicken's market share, and he predicted the same would hold for Money 97. "We've added over a million customers in the last year," Mr. Glickman said. Citing numbers compiled by PC Data of Reston, Va., Mr. Glickman said Quicken has 73% of personal financial software users, Money 23%; 4% use other types. "Microsoft has increased its market share, but it has come at the expense of the smaller players like (Meca Software's) Managing Your Money," Mr. Glickman said. Ms. Simpson of Jupiter Communications said the release of Money 97 reflected Microsoft's belief that high-function software could double as a mass market product. "Intuit sees the market splitting into transactors and trackers, and Microsoft does not buy into that, so they have worked with their product to get sort of a blend of the two," she said. "I think it's going to be a tight race." American Banker: Monday, September 30, 1996 Verifone Woos Banks with Personal ATM By JEFFREY KUTLER Verifone Inc. is claiming a breakthrough toward one of electronic banking's holy grails: an automated teller machine in the home -- or, for that matter, in the pocket. The Redwood City, Calif., company is introducing Personal ATM, a palm-size device with a smart card slot. Among other interactive capabilities, it allows value to be loaded onto the card via telephone. Accompanying Personal ATM, to be unveiled today at the American Bankers Association's bank card conference in Orlando, is Verismart, a system Verifone says will make smart cards more appealing to the banking, retailing, telecommunications, transportation, and utility industries. While Verifone is not the first to see the remote banking potential of plastic cards with built-in computer chips - for example, the Dutch company Philips makes screen telephones with smart card readers - Personal ATM may be more ready for the mass market. As purely a card reader -- lacking processing power, computer intelligence, or memory, but connectable through a phone jack -- Personal ATM is so cheap that banks ought to consider almost giving it away, said C. Lloyd Mahaffey, Verifone's vice president of global marketing. He would not discuss prices but said they are a stark contrast to the $100 or $200 that screen phone manufacturers are hoping will attract widespread acceptance, or the bare-bones $500 network computers that Oracle Corp. and others contend are the key to mainstream Internet use. "The consumer might pay $2 or $3 a month, not the $90 or $100 it takes to buy some devices that we see at technology trade shows," Mr. Mahaffey said in an interview last week. He predicted "volume deployments" of Personal ATM by mid-1997. He said the battery-powered device might be mailed out in a sturdy, compact box -- under the brand name of a bank or other provider -- along with two smart cards. The economics are such that if a defective machine arrives, and the customer calls to complain, the service representative will say, "Throw it away. We'll send a new one," said Mr. Mahaffey, architect of the Verifone consumer strategy typified by Personal ATM. In current parlance, Personal ATM is the ultimate "thin client." That means it is "intellectually challenged," Mr. Mahaffey said, relying on the smart card and on-line connections for what it needs to know. But Mr. Mahaffey said that is the key to the cost advantage through which Verifone hopes to dominate consumer automation as much as it does the point of sale terminal market, where its share is near 70%. The Verismart system is designed to embed the smart card capability in devices other than Personal ATM -- computer keyboards, telephones, television set-top boxes. Verifone has already forged alliances with manufacturers in such fields, including Keytronic, GTE, and Scientific Atlanta, as well as Mondex International and smart card maker Gemplus. At least 10 companies have signed to support Verismart, including American Express, MasterCard, Visa, and Wells Fargo Bank. Verifone says it is addressing some bankers' reluctance to commit to Mondex, Visa Cash, or a competing scheme: Verismart is "device independent," meaning a bank is not forever locked in to any smart card decision. News Release (VeriFone): Monday, September 30, 1996 VeriFone to Develop Smart Card Applications and Services VeriFone, Inc. (NYSE:VFI), the leading global provider of secure payment solutions, today announced plans to develop the VeriSmart System -- the first end-to-end system for creating smart card applications and services. VeriSmart pilot programs are planned with leading companies throughout the world, including American Express, GTE, MasterCard, Mondex International, Ltd., NIPSCO Industries, Inc., Sparbanken Bank (BABS), Sears Payment Systems (SPS), and Wells Fargo. The VeriSmart System will provide the applications, integration services and marketing support required to enable these companies to offer expanded smart card products and other services to their customers. The VeriSmart System was announced concurrently today at the ABA Bank Card Conference with a separate announcement from VeriFone and other leading companies for plans to develop personal devices and information appliances that will bring low-cost smart card capability directly to consumers. VeriSmart, a flexible, open, smart card system, is the first solution that will enable multiple consumer appliances, such as a personal/home ATM device, smart phone, personal computer or set-top-box, to access a variety of smart card applications, and seamlessly integrate with back end payment and transaction systems worldwide. VeriSmart, which will reside on various companies' host systems, is being designed to allow a customer to access and interact with their accounts to retrieve electronic cash, monitor services, pay bills, receive healthcare information, get updates on frequent flyer awards and other personal services. "VeriFone's Consumer Systems Division is developing the first realistic solution that is expected to stimulate the emerging smart card market, bringing consumers and providers together through robust, interactive products and services for everyday banking, health insurance, and utility transactions," said C. Lloyd Mahaffey, vice president of global marketing for VeriFone. "The wide range of industries that are looking to implement VeriSmart products and services indicates the enormous potential for smart card services we can expect in the future." The flexible design of the VeriSmart server and applications software, installed on the provider's host computer, will readily support additional applications and upgrades as they are developed. VeriSmart applications can allow these providers to offer new and unique products to broaden their customer base through value added smart card services. "The real value of smart card technology will not be realized until consumers have a compelling reason to change the way they conduct business today," said Thomas Kilcoyne, general manager, VeriFone's Consumer Systems Division. "The security, convenience and access to personal information they'll have through their telephone, home ATM, PC or television can dramatically enhance their relationships with providers who offer these services." Eight Major Companies Prepare Solutions VeriFone's Consumer Systems Division will begin working with leading providers to develop and deploy enhanced consumer smart card-based products and services. "We are enthusiastic about exploring business solutions that incorporate the VeriSmart System," said David L. Boyles, senior vice president of New Business Ventures for American Express' Stored Value Group. "These types of products have tremendous applicability to some of the products we will be launching in the future. VeriSmart's open system architecture is exactly the kind of technology that American Express is committed to applying to its global infrastructure, so that we may ensure maximum customer satisfaction and worldwide usability." Sparbanken Bank (BABS), is Sweden's largest savings bank. "The VeriSmart System will allow us to offer our customers a wide range of stored value card applications. We look forward to working with VeriFone on this exciting new program," said Jan Olof Brunila, vice president, Development, for Sparbanken. "GTE is the largest publicly held telecommunications company in the world with revenues of 20 billion dollars in 1995. It is also the largest U.S. based local telephone company with wire line and wireless operations covering about one third of these countries population. "GTE is interested in further exploring this exciting new technology," said Jim Palma, senior manager, New Product Markets. "MasterCard is eager to test this product and offer an early pilot to our members when it is ready," said Steve Mott, senior vice president, Electronic Commerce/New Ventures for MasterCard International. "We believe VeriSmart targets important emerging needs in the electronic commerce market." Mondex International Ltd., the leading chip-card based electronic cash payment system being introduced by institutions around the world, offers consumers a secure and convenient alternative to cash. "This announcement marks another important step forward for Mondex as a global electronic cash system. We are working with VeriFone and others to deliver e-commerce applications that will bring real benefits of convenience and security to consumers worldwide", said Mike Young, head of New Product Development, Mondex International Ltd. "We look forward to VeriSmart providing yet another secure path for offering Mondex transactions over the Internet." NIPSCO Industries, Inc., an energy-based holding company located in northern Indiana, intends to initially offer the VeriSmart system to the broad base of customers of its electric and natural gas utilities. "Through our strong customer relationships, we can help the VeriFone alliance build a two-way gateway to the home," said Barbara D. Haas, group vice president of Marketing and Communications. "We plan to concentrate our efforts on developing ways to use this two-way technology to read meters, automatically report electrical outages and supply energy usage information to the customer." SPS Payment Systems, Inc., is a provider of technology-based outsourcing services. Principal businesses include: point of sale credit card transaction processing; administration of consumer private label credit card programs; and customized operating services such as help desk support and customer service. "SPS Payment Systems has worked with VeriFone and utilized their hardware to meet the retail point-of-sale needs of many of the clients for whom we process credit and debit transactions. Their new VeriSmart System will represent an opportunity for us to provide electronic payment processing through a variety of consumer appliances such as personal/home ATM devices, smart phones or PCs," said Patrick A. Albright, director of Industry Marketing, for SPS Payment Systems. Wells Fargo, a leading force behind the development of Mondex in the United States, supports VeriFone's new technology. "The VeriSmart System is ground-breaking technology that will significantly reduce the cost and complexity of offering multiple applications to our Mondex customers," said Janet Hartung-Crane, senior vice president of Wells Fargo's Electronic Payments Division. Wells Fargo & Co., the 9th largest bank holding company in the United States, has assets of $108.6 billion following completion of its merger with First Interstate. News Release (CyberCash): Monday, September 30, 1996 CyberCash Launches CyberCoin Service Individuals can finally make small purchases on the Internet securely and instantaneously with CyberCash's revolutionary new electronic coin service. CyberCash, Inc. (Nasdaq: CYCH), today announced CyberCoin(TM), an innovative payment service that enables cash transactions, typically from $0.25 to $10.00, and can be used with funds drawn from a consumer's existing bank account. "CyberCoin fulfills a growing need for consumers to purchase lower-priced and 'impulse' items on the Internet -- especially digital goods and services that can be instantaneously downloaded to your computer, such as software, articles, research, games and music," said Bill Melton, CEO of CyberCash. "Internet merchants must offer consumers the ability to make spontaneous, small denomination payments on the Internet to take electronic commerce to the next level." CyberCoin Provides Merchants with New Opportunities "Shopping on the Internet for low-priced items will be as easy as pulling a coin out of your pocket at the store, newsstand, or video arcade," said Ray Speichert, CEO of Headgames, a Web merchant who will offer the online game Worbble, using the CyberCoin service. "With CyberCoin, players from around the world can compete against other players on the Internet on a pay-per-play basis." Until now, merchants have been unable to effectively sell low-priced, value-added products and services over the Web. CyberCoin removes this barrier, and opens up a new world of digital commerce opportunities. A broad range of soft goods and services can now be sold and delivered electronically, allowing merchants to drive incremental sales of items such as newsletters, graphic art, real-time stock quotes and virtual games. "As the premier provider of high quality financial information, Quote.COM's mission is to fulfill the sophisticated needs of serious investors," said Quote.COM President Chris Cooper. "CyberCoin will add a powerful pay-per view option for on demand purchase of financial information, giving our subscribers even greater flexibility to manage their portfolios." CyberCoin Opens Up the Internet for the Consumer Free, easy-to-use and secure, CyberCoin provides consumers with a revolutionary new way to shop online. CyberCoin can be used with any existing bank account or major credit card -- all that is needed is an Internet Wallet, which is free to consumers and can be downloaded from the CyberCash Web site at (http://www.cybercash.com) "There is undoubtedly a niche for coin payment on the Internet and CyberCash is ahead of the pack in developing a user-friendly option for small cash purchases online," said Parker Foley, Vice President and Director of Electronic Commerce, First Union National Bank. "We are pleased to be among the first to pilot this new service in 1996 and hope to offer its convenience to our Internet customers by early next year." Easy to download and install, the Internet Wallet is a password protected software program that enables encrypted transactions to move between the consumer, the merchant, and their banks. Just like an everyday wallet, the Internet Wallet offers several types of payment options and can be used with any major credit card in addition to the new CyberCoin payment service. Online Shopping Made Easy With CyberCoin CyberCoin provides the consumer with the ease and simplicity that has been missing from the Internet shopping experience. When an individual on the Web finds an item that he or she would like to purchase, the consumer simply clicks on the Coin icon next to the goods. It's that simple. The entire process takes only seconds. A complete transaction log of all purchases is kept in the Wallet. The consumer can easily, and at no cost, move money in and out of the Wallet to use the CyberCoin service. The user chooses the amount of money he or she wishes to move (in multiples of $20, up to $80), and selects whether to use funds from a bank account or credit card. Security is ensured since the money never leaves the bank-if the consumer's PC crashes, no funds are lost. Funds in the CyberCash system are FDIC-insured, giving an added measure of security. CyberCash Partners with Banks to Deliver CyberCoin Service CyberCash will work with banks to integrate the CyberCoin technology and services into the banks' Internet offerings for both their merchants and consumers. Participating banks will offer the CyberCoin service to online merchants and provide them with critical back-end processing capabilities and access to existing financial networks. Merchants will pay the banks a per-transaction fee, similar to a credit card transaction, to use the CyberCoin service. CyberCash receives a fee for each transaction from the banks. Pricing and Availability CyberCash's CyberCoin service is available now for banks, merchants and consumers. First Union, First USA Paymentech, First Data Corporation and its affiliated banks, and Michigan National Bank have already committed to offer or pilot the CyberCoin service to merchants and/or to consumers before the end of the year. Merchant server software is available immediately from CyberCash on the Windows NT, Solaris and BSDI platforms, with other platform versions available by the year-end. Consumer Internet Wallets can be downloaded for free from the CyberCash Web site at www.cybercash.com. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Can we kill single DES?
by jim bell 17 Dec '03

17 Dec '03

At 04:27 PM 10/1/96 -6, Peter Trei wrote: >Unlike many cypherpunks, I actually write code (:-). I took Phil >Karn's DES386 as a starting point, and modified it to run effiiciently >on the Pentium. The code I've written will run 14 round DES (all >that is required for a key test app) at 254,000 crypts/sec on a >90 MHz Pentium. > >Allow about 10% overhead for key scheduling (there are some tricks to >speed this up), and we're still at about 250,000 keys/sec on a 100MHz >Pentium (I'm using a nominal 100 MHz Pentium as my 'unit' of >cpu power). [snip] >On this type of processor, it would still take 9133 years to exhaust >a 56 bit key space. On the other hand, on 20,000 processors of this >power it would take less than 6 months. If the target is encrypted >in a chaining mode with an unknown 8 byte IV, the time more than >doubles. [snip] >Questions for general discussion: > >1. Is this a good idea? What will happen if DES becomes perceived > as insecure? Reluctantly, I'd have to say that I don't think this is a good idea. If anything, what this would inadvertently demonstrate is how difficult (at least, with non-dedicated hardware) it is to crack DES. The resulting number will be misleading if it doesn't represent the real danger to encryption users. I contend that a misleading estimate is actually worse than none at all, because it is a number which can be misused. They can say, "Hey, these guys had to apply $10-20 million dollars worth of computer equipment for a full year just to get the contents of a SINGLE MESSAGE!" The real danger is, indeed, a dedicated system, because it would presumably be the way a "real opponent" would do it. First, my assumptions: I assume that it would be generally straighforward to build a cracking chip that tries 10 million keys per second, with a great deal of internal parallelism and pipelining. This is a factor of 40 higher than the number you quoted above for a 100 MHz Pentium. Further, I assume that at least 10 of these chips could be installed on a single card in a PC, monitored by a program running on that PC. Thus, it would take 9133 years/400, or 23 years, for a single one of these modules to try all keys. With "only" 100 of these units, a crack would take about 3 months max, 1.5 months on the average. Now, THAT sounds like a real threat! It would be a far more effective demonstration of the weakness of DES. Compared to this, the alternative, say an average of a crack in a year with 4500 machines, is practically meaningless. An even more ominous configuration would involve perhaps 50 chips per full-length board, seven boards installed in a stripped-down PC, which would produce a crack in 4 months average with one system alone. So how would all this be done? First, write a serious proposal for the project and circulate it among companies with fab capacity. How about finding a custom, semi-custom, or other semiconductor manufacturer who would be willing to do the fab in exchange for the publicity, or a deep discount. It might be particularly "relevant" if that company had an interest in seeing DES discredited, possibly because it was going to be building an encryption chip with greater security. (NTT? and their new encryption chip?) Likewise, find a politically-sympathetic designer with access to IC layout software, etc. The way I see it, there has to be a huge amount of unused 0.5-0.7 micron IC capacity around the world. Remember, we're only talking about a few hundred wafers. And for example, as I recall, I've seen a number of ads over the years for a company called "Orbit Semiconductor," which builds small-volume IC's by putting a number of different designs on a single wafer. The number of die per wafer is, more or less, based on the volume needed for that particular chip. They do a new fab run fairly regularly, to accomodate designs with fast turnaround. Presumably, they occasionally would like to do a run quickly without waiting for the wafer to "fill up" with new designs. Anyway, the way I see it, you're probably going to burn up over a million dollars worth of ELECTRICITY alone on a single crack with Pentiums. Why not get whoever is doing these cracks to donate 1/10th of this value to finance the portion of this project which cannot be "finagled"? Maybe Microsoft would be willing to help? After all, it is THEY who are going to be limited to DES-strength exports if things continue as they've been going. How about Intel? Jim Bell jimbell(a)pacifier.com

2 1

Re: Weaknesses in Smart Cards? (Re: FLA_wed)
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 2:21 AM 9/26/96, Timothy C. May wrote: ... >Strip-back of the outer packaging is possible, of course. I'd need to know >a lot more about the packaging used by VISA and other smartcard makers to >know how economical this would be. (Breaking any single card is not >necessarily a financial windfall, if the card has a limit, for example. >This puts a limit on how much $$$ can be spent on cracking a chip.) As best I can figure, extracting the secret from a Mondex card gives you not merely the money from the card, but the "digital plates" with which to mint arbitrarily much more money. I only say this because the only protocol the I can think of that fits what we do know of Mondex has this problem. This fault does not plague Chaum cash. I don't know how to code the card application so that a transient errors won't just occasionally cause the secret to be exported. Then again that may be possible to code it for "fail safe". If it were my money backing the Mondex cards, I would want to know how it worked.

2 1

Re: White House crypto proposal -- too little, too late
by jim bell 17 Dec '03

17 Dec '03

At 02:57 PM 10/1/96 -0700, Declan McCullagh wrote: > > >---------- Forwarded message ---------- >Date: Tue, 1 Oct 1996 14:56:21 -0700 (PDT) >From: Declan McCullagh <declan(a)well.com> >To: fight-censorship(a)vorlon.mit.edu >Subject: White House crypto proposal -- too little, too late [snip] >What's even more disturbing is what the administration might do >next. After the roundtable broke up, I chatted with Michael Vadis, one >of the assistant deputy attorneys general who oversees national >security issues. He said an international consensus is forming that >terrorists can use crypto; therefore crypto must be controlled. The >U.S. is certainly pushing this line at the OECD talks. > >"But it just takes one country to decide to export strong crypto," I said. >"You're missing something," said Vadis. >"What?" I asked. "Unless you're talking about import restrictions." >"Exactly," he said. >-Declan An import restriction would be even less effective than the current export restrictions. With an import restriction, a person need merely receive a given piece of software in the mail from an "unknown" benefactor, software that (surprise!) would have been illegal to import. (the software doesn't even have to be mailed from outside the US, merely trucked in by a wetback and anonymously mailed by tossing it into the ubiquitous USnail PO Box.) Redistribution of this software would have to be legal, if for no other reason than nobody could prove it was imported illegally. Nobody outside the US would have any standing to sue for copyright violation, because they couldn't import it and sell it without restrictions. Jim Bell jimbell(a)pacifier.com

5 4

Re: active practice in America [RANT]
by Dale Thorn 17 Dec '03

17 Dec '03

Marc J. Wohler wrote: > At 11:19 PM 9/30/96 -0700, you wrote: > >I'm glad you asked. I wouldn't pretend to have *the* answer, but rather > >than screw around with basic Constitutional enumerations, I think the > >"authorities" should have had the guts to challenge those cases (at > >least the most obvious ones at first, to get the ball rolling), by > >investigating and declaring mistrials based on some kind of jury > >manipulation which showed bad faith on the part of the locals. > Theory sounds great, but what if, as often was the case, the > "authorities" were the major part of the problem. I presume heirarchical authority. That's what we had in the U.S., even in the 1960's. The specific authorities running bogus juries were generally county-level. One could argue that the states, and by extension the feds, looked the other way as long as they could, and indeed they did. Once they could no longer look the other way, those higher-level authorities should have proceeded against the local governments as I specified, rather than undermining the Constitutional enumerations. If there should happen to be a good argument that the feds and states couldn't proceed against the locals because these higher-level authorities were somehow compromised (other than general scumbagness), I'd like to know how.

1 0

Re: Clipper III on the table
by jim bell 17 Dec '03

17 Dec '03

At 06:31 PM 10/1/96 -0700, Lucky Green wrote: > > > >On Tue, 1 Oct 1996, Robert Hettinga wrote: >[as to why HP and others support GAK in exchange for DES export] > >> I agree with Lucky's earlier hypothesis that HP's doing this to curry >favor >> for government contracts in lieu of an actual marketing strategy, and I >> leave TIS's motives up to the list as an exercise. ;-). > >This not a hypothesis. A policy person from HP told me that > >1. HP as well as TIS and other companies sell single DES products that >they would like to be able to export. >2. He was directed by HP's marketing department to find a way to make >that happen. >3. He therefore supports a GAK for export "compromise". HP, then, might be a good company to approach as a potential donor on a DES-cracker. While they want to be able to portray their products as reasonably secure, at the same time they want to be able to de-fuse any export limits. Showing that, say, $25,000 of hardware could crack DES in a year (and thus, presumably, $25 million could crack DES in 1/3 of a day, a budget available to the NSA et al.) would demonstrate that there's no strong reason to keep it restricted in any way. Jim Bell jimbell(a)pacifier.com

1 0

Re: Can we kill single DES?
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Peter Trei writes: > Since it looks like the US government will be allowing the export of > 56 bit espionage-enabled software, it's time to kill single DES. Yes. It's an obsolete cipher with a woefully small key. Only a catastrophic failure will cause the ABA to undergo religious enlightenment. > As some of you will recall, a while back I wondered aloud about the > feasibility of brute-forcing DES on general purpose machines, ala the > RC4-40 crack last year. I'm a firm believer in "work smart, not hard." It might be interesting to run a wiring diagram of DES through a superoptimizer and see how many algebraic identities fall out. An analytical crack that could be published on the Net would be far more impressive than harnassing gigacycles on every available machine, which might very well awe the gullible into thinking DES was difficult to break. > On this type of processor, it would still take 9133 years to exhaust > a 56 bit key space. On the other hand, on 20,000 processors of this > power it would take less than 6 months. If the target is encrypted > in a chaining mode with an unknown 8 byte IV, the time more than > doubles. I can see the headlines now. "Cypherpunks show DES can withstand up to 9,000 Pentium-years of torture and keep on ticking." Remember the Law of Unintended Consequences. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: Clipper III on the table
by Omegaman 17 Dec '03

17 Dec '03

> Allow me to say here that I do not belive that Netscape will be amongst > those fooled so easily. But IBM, HP, TIS, and others have already been > fooled. The USG does not need to get every software company to agree with > their proposal. Divide and conquer. Seems that the USG has done a > marvelous job of D&C so far. > If anything, it would not be in their best _marketing_ interests to support GAK. Rejecting GAK in favor of promoting strong crypto will make them look like "good guys". This is also true of Micro$oft. And contrary to an earlier opinion, I think Bill & Co. have been soured by their experiences with DoJ. While their are far larger motivations involve, I certainly don't think Micro$oft will skip at the chance to thumb their noses at the government if it's to their advantage. Both of these companies may be willing to support a DES-crack effort me -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

1 0