- cypherpunks-legacy - lists.cpunks.org

Liberating Clipper Stuff from Mykotronx Dumpsters
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:24 AM 8/3/96, Bill Stewart wrote: >At 09:20 AM 8/1/96 -0800, jim bell <jimbell(a)pacifier.com> reminded us: >>Also: Clipper was fabbed by VLSI Technology. A few pointed inquiries might >>work wonders here. > >It was made by Mykotronx, using tamperproof programmable gate >array chips from VLSI, though I don't remember whether they were >entirely programmed at Mykotronx+NSA, or whether they were >mostly mask-programmed at VLSI first. By the way, newcomers to the list (I'm not referring to Bill, of course) may not know some of the background on this Mykotronx story. An interesting use of remailers, too. One of the early list subscribers went "Dumpster-diving" outside the Torrance, CA headquarters of Mykotronx, a previously little-known defense subcontractor. Amongst the stuff in the Dumpster, unshredded, he found: - payroll information - copies of contracts with VLSI Technology, the NSA, AT&T, etc., showing the work to have started back in the early 90s - yield information on the chips, and some limited test information - copies of various memoranda between AT&T, the NSA, the FBI, Mykotronx, Sandia, and VLSI Technology - a bunch of other goodies He scanned or typed this stuff he found into a text file and sent it to one of the earliest members of the Cypherpunks list, asking for it to be passed on to someone who could do something with it. A few hours later, via anonymous remailer posting, it went out to the several hundred subscribers to the Cypherpunks list at that time. (It's somewhere in the archives, such as they are. This would be around late April, 1993, possibly May-June.) I later heard that Mykotronx was mightily embarrassed to have this kind of stuff found in Dumpsters out where anyone could find it, and that "the authorities" ordered a tightening up of security. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Jim Bell, stay out of Georgia....
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:54 AM 8/2/96 -0400, Duncan Frissell <frissell(a)panix.com> wrote: >>> JONESBORO, Ga. -- An 18-year-old self-styled anarchist who allegedly >>> distributed a free, homemade pamphlet with anti-government rhetoric >>> has been charged with advocating the overthrow of the U.S. government. ..... >Brian -- why do the cops do busts like this where they know they will be >thrown out? 1) Because they can 2) Because they can get away with it 3) Because most of the public approves of this kind of <noun deleted> 4) Because they can put out press releases encouraging 2) and 3) and folks will believe them. 5) Because if the case gets dropped it _might_ make Page 43 of the newspaper and will be covered in a way that makes it clear that they're the good guys. 6) Because the state/city/town will cover their legal costs and penalties if they somehow lose a lawsuit 7) Because the state/city/town _won't_ cover the costs of a real defense of the "self-styled anarchist", who'll have to put up with a lot of crap as well as the 47:59:59 hours they can keep him in jail for no good reason plus any more until he can make bail for the bogusly heavy charges they'll lay on him. 8) Because once you're a "self-styled" anything, you don't get no respect. 9) I've never met any cops who were bullies - have you? 10)It's covered by the Anarchists and Commies Exception to the First Amendment. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Defuse Authority!

1 0

Re: A Libertine Question (fwd)
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At 08:42 PM 8/2/96 -0500, you wrote: > >Forwarded message: > >> Date: Fri, 2 Aug 1996 16:50:01 -0500 (CDT) >> From: snow <snow(a)smoke.suba.com> >> Subject: Re: A Libertine Question >> >> As long as you are enforcing it on everyone, I don't think you'd have a >> problem, but to force some one from cooking food for homeless people, and >> allow a family barbeque, is IMO wrong. > >Not at all. Businesses have no rights, individuals do. Businesses have a <snip> >Blueberries they bought at the local HEB). Individuals have a right to >privacy, that includes cooking themselves food without harrassment. Business >on the other hand are selling products of potentialy questionable quality. A I disagree with your sentiments about Business and rights, however, in this instance, even that wasn't the issue. Food Not Bombs is NOT a business, it's a not-for-profit organization that gives out (not sells) food. They are the same as, I think Tim May pointed out, a Boy Scout picnic, except for the homless, not the boy scouts. //cerridwyn//

2 1

Re: Tolerance (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, Because none of these issues have ever been tested in a court of law any comments I or any other person makes (even if a lawyer) is simply personal opinion. To find out what is 'really' going on we will have to simply wait for that first case. Forwarded message: > Date: Fri, 2 Aug 1996 22:28:37 -0700 (PDT) > From: Sandy Sandfort <sandfort(a)crl.com> > Subject: Re: Tolerance (fwd) > > A. Where does Jim get the terms of the contract he implies from > the simple word "public"? As far as I can see, he simply made > it up from whole cloth. Interesting, but totally without any > legal basis. Public - of or pertaining to the people; not private or secret; open to general use; accessible to all; serving the people. Community or its members; a section of community. Making known to the public; proclamation; printing in a book, etc. for sale or distribution. To make widely known; to advertise. The state of being generaly known; notoriety; advertisement. I first learned about the cpunks list in Mondo 2000 several years ago not long after I got PGP 1.0 off Adelante BBS in Co. Wasn't Eric's girlfriend involved in Mondo 2000? (Hi Jude, I think we will have a RoboFest this year in Austin, as always you are invited) Which would indicate a certain level of premeditation regarding letting people know of the list. I think that qualifies as public, I also think a court would accept that argument. The bottem line is that the list operator crossed that line whether they were aware of it or not. If they feel uncomfortable with this then they should consider very strongly dropping the list or enacting some form of registration more preferential than majordomo's subscribe system. This registration should clearly define what is and is not allowed on this list. > B. I'm unaware that the Cypherpunks list has ever been advertised > as "public" by the list owner. It has appeared in many publications which are intended for general or 'public' distribution in every one of those publications it was made clear that anyone was welcome and the subscription address was provided. The list operators ignorance of the consequences of their actions in no way alleviates them of the consequences of those actions. > C. Combining A & B, I know of know instance where the owners of > the Cypherpunks list ever made any indication that they were > adhearing to the Byzantine interpretation of contract law as > suggested by Jim. (It sure doesn't comport to what I learned > in my Contracts classes.) It isn't my interpretation. Perhaps you should have paid better attention in class. These issues have never been tested in a court of law in the US in regards to computer networks and their special nature. > > > A restaurant or bookstore is a public place in that it is open > > > to the public. > > > > I know of no state in the union where a bookstore, restaurant, > > mall, etc. is considered public. > > Actually, it's the law in ALL states in the union since the Public > Accomidations Act was enacted some time in the '60s (with the > possible exception of Texas, I guess). Not in Texas. We recently passed a law (Jan. 8) which permits citizens legaly registered to carry concealed weapons. Because the way the law was worded it was made clear in many newspapers and such that the ONLY way that business could prohibit patrons from entering their premises with those weapons was because they were PRIVATE property and therefore excluded from the constraints of the law. [When I worked at UT the rationale that was used to throw the dumpster divers off campus was that even though it was a publicly funded school by taxes it was private property (didn't make sense to me then or now). I can also state unequivacly that if the UTPD catch you on campus after 10pm or before 6AM w/o proof of either being a current student or staff consider it a graceful and considerate officer if they only escort you off campus.] Even now there is a big discussion here over whether this is realy a strong enough distinction. It is only a matter of time before a case comes up here to test even this limitation of private ownership (which I happen to support, a person with a gun on my private property is definately subject to my desires and wants, they represent a clear and present danger. If they don't then why do they need to register the weapons and why are they classed 'deadly weapons'?). The really sad part is that it will probably be another one of those shoot outs at Wendy's in Waco or some such nonesense as some loony toon goes postal. I wonder if that was what Jeffeson meant about watering the tree of liberty with blood? If my business property is really public simply because I am open to the public then I feel the police have a responsibility to provide an officer on my premises for whatever hours I am open for business to protect me, my property, and my patrons just like they do at the courthouse, tax accessors office, etc. They also have a responsibility to help assist in the operation and funding of my business (something I oppose strongly) since they have now found my business to be public; as a matter of fact they can help pay my damn taxes. For the record Florida and every other state with 'Right To Carry' laws looks at it this way. It is the only way under the current statutes to allow businesses to control access by gun toting folks. Now there is one caveat that most of you will have caught. That is the definitions of public above. In short, we have a circular argument as the law is worded now. Logicaly the courts have two recourses. They can first declare that no agency has the right to regulate gun ownership and possession (what I want to see) or else regardless of the 2nd, nobody has the right to carry a weapon on their person in public, since police are not awarded special consideration from constitutional law this would mean they could not carry a weapon on their side in public. So the courts eventualy must either refuse to review the case or else they must make some major change in the current law which goes against the government either way. Either everyone gets to wear weapons or nobody including the police get to carry them. Either way with the last two the police are in a situation where they are less likely to employ force for enforcement since they are no longer the strong side in the 'discussion'. > > Legaly a public place is someplace which is operated using > > public monies. > > Like the Cypherpunks list? Citation, please. The Cpunks list isn't a place. It is a steam of characters. Does the list reside on my computer? It does at least to some degree since I obviously have access to discuss these issues with you. It also resides on your computer as well as the thousand or so subscribers. It resides at least in part on the screen of my crt, the RAM in my computer, the network cable, the ISDN line, my providers router, my brain, the EM emission of the computer, etc. ad nauseum. So there is no single 'place' where the list resides, any more than a single place that an idea resides. This whole issue is the reason that I contend that eventualy it will be seen clearly that postings on usenet, public accessible mailing lists, irc channels, etc. are actualy automaticaly public domain in regards to their content. At some point I feel that it will turn out that unless you encrypt your data or place copyright symbols on it with special, and likely convoluted, riders allowing various distributions and storing via computer networks the author of computer text such as this will grant all rights and privileges to the work to the public automaticaly. This belief is the reason that I am interested in crypto, outside the simple curiosity I have about nature. I don't believe the cpunks list has ever been involved in a legal case. As a matter of fact this issue has never been tested in a court of law. Perhaps we should look at forcing a case. The best strategy would be for Eric to throw somebody off the list sureptitously (sp? I put the dictionaries back and I ain't walking over there again...sorry) and then for that person to bring a civil suit alleging infringement of civil liberties (ie equal access under the law). Eric would claim the list is private while the expunged user would claim it was public. We would of course have to resolve the cost issue first. I have two lawyers on retainer for my businesses but I don't believe either would touch a non-commerical case like this would be and I don't have anywhere near the personal capital to finance it myself. As a added bonus we could pick a handicapped person and they could sue under the various laws relating to those issues as well. This would get the whole issue of handicapped access to computer technology to be explored. Currently the handicapped (eg blind) find GUI interfaces nearly unusable. It would be pretty weird (to me) to see court rule that every os and software manufacturer must provide a CLI interface to their products because of the new equal access laws regarding handicapped individuals. > The problem with Jim is not that he doesn't know anything, but > rather that he knows so many things that aren't true. (But I > would not favor enforcing the state granted monopoly on the > practice of law if Jim wants to hang out his shingle. If he can > get someone to pay him for legal advice, more power to him, but > /caveat emptor/.) That is a two edged sword. Where did you get your law degree? My lawyers both got theirs at UT Austin Law School. Both are federal lawyers and both have argued before the Supreme and are currently allowed to argue before the Supremes. The bottem line is that this whole issue is so full of circular arguments and contrary views it may take quite a few years to work out something that makes any kind of sense at all, if ever. Course by then we will have a whole new generatio of technology to argue over. Take care all, and watch your sixes. Jim Choate

3 2

TrustBucks
by TrustBuckFella 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An alternative model of electronic money. Every model of electronic money I know of except one retains some degree of centralization. There is always a central "mint", usually a bank. If you can't find a bank that acts the way you want, you're SOL. And the only thing that enforces non-abuse (inflation, etc) by the bank is the equivalence of electronic money to some form of "real" money. The sole exception is Digicash. Unfortunately, Digicash has no restraint on infinite spending-into-debt. I want to present an alternative model I call "TrustBucks". TrustBucks is decentralized but zero-sum and needs no assistance from "real" currency. Its central idea is a "web of trust": Local, trusted contacts are linked in a web that at some remove can extend everywhere. I'm not going to try to develop the cryptographic protocols for TrustBucks. I haven't got the requisite paranoia and pickiness (compliments both) for that. TrustBucks also has nothing in the way of anonymity and restraint on double-spending right now. If you can see how it could be anonymous or restrain double-spending and still work, please feel free to add. The basic rules of TrustBucks: - ----------------------------------------------------------------- Each individual using TrustBucks has their own individual variety of currency, notated here as TrustBucks( <name> ). Each individual is considered to have an infinite supply of their own TrustBucks. Each individual accepts payment only in their own variety of TrustBucks. There are only two fundamental operations with TrustBucks: A and B swap TrustBucks, of any two varieties. A pays B in TrustBucks( B ) for something external to the system. - ----------------------------------------------------------------- Examples: Say Alice wants to pay Bob in TrustBucks, and Bob agreed to accept payment in this form. Alice has several options for paying him. * Alice already has some TrustBucks( Bob ). Alice pays Bob. * The amount is small enough that Bob trusts Alice directly. Alice and Bob swap TrustBucks( Alice ) for TrustBucks( Bob ) Alice pays Bob. I know this looks like an extra piece of complexity, but it's really not. By insisting that only TrustBucks( Bob ) are payment to Bob, we insure that Bob can't manipulate what currency he will accept to his advantage, which would otherwise be a problem. For instance, Bob cannot refuse to make good on his debts while accepting other people's money. * Alice doesn't have enough TrustBucks( Bob ), but does have TrustBucks( Carol ), and Bob trusts Carol directly for that amount. Alice and Bob swap TrustBucks( Carol ) for TrustBucks( Bob ) Alice pays Bob. * Alice doesn't have enough TrustBucks( Bob ), but does have TrustBucks( Carol ), and Carol has some TrustBucks( Bob ). Alice and Carol swap TrustBucks( Carol ) for TrustBucks( Bob ) Alice pays Bob. * Alice doesn't have enough TrustBucks( Bob ), and Carol has some TrustBucks( Bob ), and Carol trusts Alice directly. Alice and Carol swap TrustBucks( Alice ) for TrustBucks( Carol ) Alice and Carol swap TrustBucks( Carol ) for TrustBucks( Bob ) Alice pays Bob. Using some combination of the above methods, Alice can pay Bob as long as there are accessible parties in the system who, in total sum, trust Alice for the amount of the payment, and there are accessible parties in the system whom, in total sum, Bob is willing to trust for the amount of his credit. Which gives the scheme its name: TrustBucks. - ----------------------------------------------------------------------- Disadvantages: Lots of overhead. Third-party traders must be perpetually available. Not anonymous. Not clear how double-spending can be avoided. Not a true disadvantage: It could "stall"; that is, there could be catch-22 situations where if only some people trusted to begin with, the system could continue, but not enough people trust each other to get it started. I say this is not a true disadvantage because the same thing happens in other currency-schemes, to an equal or larger degree. If it's merely more visible with TrustBucks, that should not be called a disadvantage. In practice, I think the threshhold of trust neccessary to start the system would be considerably with TrustBucks than with other systems. Advantages: Decentralizable. It is not neccessarily decentraliz_ed_, but can become so as needed. Nobody controls the "mint". Few conceptual parts. When counting the parts in other schemes, don't forget to count the parts neccessary to fix or ameliorate problems that don't occur in TrustBucks, like deciding who "prints money", keeping them from abusing the role, stopping others (IE counterfeiters) from assuming the role, and so forth. I don't claim that the above neccessarily adds up to a positive rating, but it's worth hashing out, especially if it inspires more secure protocols along the same decentralized lines. - ----------------------------------------------------------------------- I'm not the first person to notice that decentralized ideas tend to take off more abruptly and firmly. For instance, PGP vs. Kerberos, or the internet vs. AOL, Prodigy, Compuserve. Especially Usenet and the WWW. That's why I thought a long time about bringing this idea out. Once it's out, it and its successors are beyond my control or anyone else's. -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBMgLz8pi7GCxryNrZAQEfAAQApDzHN9PSpARe/MUZgDDk8F+eFLlKNAHZ 5H6KaX3SlWxL9itM8aFMoudpnBU2gAO7Kn9YHV+dFS1l/tE+NJDhSpTRL1EMKVw9 rGrL8lypX9bLsuw0+thMl1djJjQhc3To6qaLhJvZVji7TRXlKYuVMFW5D6Sm988a Zg8nRsCQrIo= =EOKl -----END PGP SIGNATURE-----

2 1

Re: A Libertine Question (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 03 Aug 1996 00:18:38 -0700 > From: Cerridwyn Llewyellyn <ceridwyn(a)wolfenet.com> > Subject: Re: A Libertine Question (fwd) > > I disagree with your sentiments about Business and rights, however, in this > instance, even that wasn't the issue. Food Not Bombs is NOT a business, it's > a not-for-profit organization that gives out (not sells) food. They are the > same as, I think Tim May pointed out, a Boy Scout picnic, except for the > homless, not the boy scouts. Then we have a clear case of abuse of power and if the folks at FNB don't pursue this then they deserve the ignominy they receive. What is the current status? Have counter suites been filed? What was the ACLU and NAACP (I am assuming that everyone at FNB is not anglo-saxon and named 'Fletcher') responce to requests for aid? Have they begun a petition or whatever the city charter allows demanding the ouster of those in charge? What is the Libertarian Party there doing? Has anyone contacted the Justice Dept. and begun the proceeding for a civil rights suit? If these folks seriously went out there not prepared to fight then the issues must not be very important to them, perhaps a simple publicity stunt to get their 15 minutes and not realy to help the homeless/foodless? Has anyone made reference to the judges comments in the CDA trial regarding speech and chaos? While the city acted illegaly, nobody has stated if the city categoricaly prohibits such activities which was the point I was originaly trying to express. Was this a isolated incident originating with the poor decision of a single individual in the HD or was it organized? Have similar responces occured before? Every year on Halloween a bunch of folks here in Texas go down to the State Capital at about 10pm and sit around and smoke pot for about an hour. The city police have no jurisdiction on the capital grounds and the DPS officers pretty much stand around and make shure things don't get out of hand. I have never known of anyone being arrested but then again the place is crawling with video and lawyers ready to pounce. I would contend that one of the reasons that no actions are taken is that the event is organized and the folks come prepared to go to jail and fight if need be. Jim Choate

2 1

Re: "And who shall guard the guardians?"
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:11 PM 8/2/96 -0400, David Lesher wrote: >> The English-Only bill just passed in the House bans the use of >> non-English languages by government officials. Does Tim's sudden >> avoidance of the Latin mean that _he_'s the Fed?? > >What about Navajo? Foreign diplomacy was one of the exceptions. Algol wasn't, since it's designed to describe algorithms to humans, even though it's additionally useful for diplomatic relations with our Mechanical Companions. (Actually, they are allowed to use it for teaching purposes, or if really necessary for National Security, and the Bureau of the Census can use it to help count people.) Section (I), however, is disappointing - means we can't sue them for putting "E Pluribus Unum" on the coinage.... ============================ `(2) OFFICIAL BUSINESS- The term `official business' means governmental actions, documents, or policies which are enforceable with the full weight and authority of the Federal Government, and includes publications, income tax forms, and informational materials, but does not include-- `(A) teaching of languages; `(B) requirements under the Individuals with Disabilities Education Act; `(C) actions, documents, or policies necessary for-- `(i) national security issues; or `(ii) international relations, trade, or commerce; `(D) actions or documents that protect the public health and safety; `(E) actions or documents that facilitate the activities of the Bureau of the Census in compiling any census of population; `(F) actions, documents, or policies that are not enforceable in the United States; (G) actions that protect the rights of victims of crimes or criminal defendants; `(H) actions in which the United States has initiated a civil lawsuit; or `(I) using terms of art or phrases from languages other than English. =================================================== "These aren't the droids you're looking for." # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Defuse Authority!

2 1

Re: A Libertine Question (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 3 Aug 1996 02:38:09 -0400 (EDT) > From: Alan Horowitz <alanh(a)infi.net> > Subject: Re: A Libertine Question (fwd) > > > I am not even shure I accept the legal premise of corporations. > - Jim Choate > > This is NOT a drill. Right, petty harrasment would better describe it. > This is an actual pop quiz, in which Jim Choate > is directed to tell us about the legal premise of incorporation. Jim, do > you know anything about what you are talking about. Looking it up is not > allowed. Why should I be prohibited from looking it up? You had to in order to grasp the concept originaly? Doesn't really matter since I already have done it with LSD Labs. The concept behind incorporation is to create a commercial entity whereby the persons & possessions of the principles can be protected from most legal actions against the corporation. The fictional rights given the corporation is intended to create a framework whereby the existing legal structure can be applied fairly to the business that the corporation carries out. In the case of a single proprietorship such as CyberTects it is possible for me to loose everything I own if the right conditions arise (eg I got sued and lose) in order to pay the judgement. It is much harder for me to loose monies and physical property being involved in a incorporated venture. The reason that I oppose this is the same reason that I oppose the laws that prevent suing the government without their permission. It creates an atmosphere of isolation that gives petty non-elected government prols the feeling of invincibility and isolation. It's just their job, never mind they are fucking peoples lives over. It is the reason that big companies screw up time and time again and still manage to survive and do it to us again. So what do I win other than a hard time? > P.S. could you humor me on one tiny little thing? Can we agree that > that the word shall be spelled "sure", not "shure", on this list? I > don't want to trample on your artistic vision or anything like that, but > could we just agree on this one tiny little thing So fucking sue me for learning to read/write phoneticaly. Geesh what a petty attitude. Do you feel better now? Is your sense of superiority restored? If the only criticism you have is my spelling then shut the fuck up. If it makes you feel any better I am very hyper-active and dyslexic as well. But that is ok, there are people that love me anyway. Jim Choate

1 0

Re: Why Fingerprints and Key-ID's
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:42 PM 8/2/96 -0700, Paul Wittry <ppw3(a)everett.com> wrote: >I understand PGP Open-Signed messages and why they are used. I've >read all the FAQ's. I can't seem to figure out why some of us put our >Fingerprints and/or Key-ID's at the end of messages. Even with the PGP Web Of Trust, one of the difficult problems in cryptography is how to do key distribution - if you want to talk to Bob, how do you know you've really got _Bob's_ key instead of a key some imposter Eve _said_ was Bob's key? Similarly, if you receive a message saying "Bank X will pay you $Y, signed Bank X Small-Transactions-Teller", how do you know it really came from them and wasn't signed by some fake key that Carol genned up? One way is to get some well-known person to sign your key, or a chain of people which get you to a sig for the key you want. Another way is to give out your key, often. That way someone who gets email from "you", signed by "your" key, can compare the key with previous keys you've stuck on your email and business cards, and scream if there's a mismatch. For this, remember to use the full key fingerprint, not just the short KeyID which can be duplicated arbitrarily. This is especially useful for pseudonymous people like Black Unicorn. Another reason is just to remind people you've got a PGP key and make it easier to look up 0x12345678 correctly than "Joe Anonymous" or "smith". # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Defuse Authority!

1 0

Re: strength of 128-bit encryption?
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:38 AM 8/2/96 -0400, KDBriggs1(a)aol.com wrote: ><< Current export standards allow export of 512-bit RSA for encrypting > (including key exchange), 1024 bit for signing. >> >1024-bit for signing? Do you have a reference for this? I was under the >impression that digital signatures were not covered by export restrictions. I've heard this also, but remember that the export standards are "whatever specific products we decide you can export" rather than a formal law you can design to and be sure they'll obey. The ITAR doesn't cover pure authentication software, only software capable of preserving privacy through encryption. Some public-key signature algorithms only do signature, some only do privacy, RSA does both. Thus, especially for software like Netscape which _does_ have encryption capabilities, they can get away with limiting the strength of the RSA signature portion because it's part of the encryption package, and because RSA signing is just encrypting with your private key instead of your public key. Someone _could_ use an RSA signature program to encrypt short data (like keys) if they wanted to work at it, and while bugs in software are of course entirely unheard of that would make this easier, there's still the risk that those Crafty Furriners might disassemble the crypto code from Netscape and reassemble it with the limits removed. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Defuse Authority!

1 0