- cypherpunks-legacy - lists.cpunks.org

Re: RC2 Source Code - Legal Warning from RSADSI
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 7:06 PM 02/01/96, baldwin wrote: >WARNING NOTICE > > It has recently come to the attention of RSA Data >Security, Inc. that certain of its confidential and >proprietary source code has been misappropriated and >disclosed. Despite such unauthorized use and disclosure, >RSA Data Security reserves all intellectual property rights >in such source code under applicable law, including without >limitation trade secret and copyright protection. In Well, now we know it really was RC2. Is there a law-knowing type out there who can tell us what's going on legally? As I understand things, RSA is just bullshitting here. When something has 'trade secret' status, the only people with legal obligations toward it are those with contractual obligations to RSA--you can only enforce 'trade secrets' through contractual obligations, non-disclosure and confidentiality agreements, etc. Once something has been disclosed, as I understand it, people without contractual obligations in regards to it are free to do whatever they want to it--trade secret status of RC2 has nothing to do with me, who has no contractual obligations to RSA regarding RC2. (Unless the license agreement for RSAref could be stretched to apply somehow, but I don't think so). Now, copyright might be another matter. But you can't copyright an algorithm, only specific text in fixed form (ie, the source code). So this would mean you couldn't use the particular code posted to sci.crypt, but wouldn't stop anyone from using the algorithm, if they wrote their own code (to be safe, without having seen the RSA-copyrighted code, only having the algorithm described to them by someone else). You can _patent_ an algorithm, but as I understand it, something can't be patented and a trade secret--you have to disclose it in full to the patent office to get a patent, at which point it's no longer a trade secret. And the legalese from RSA doesn't even mention patents anyway (because they dont' have one, of course), only copyright and 'trade secret'. I'm not a lawyer of course. Information from someone more sure of their knowledge then I am would be appreciated. But, as I understand it, they're basically making stuff up, and there is nothing stopping any of us, who haven't signed any non-disclosure agreements with RSA, from using the RC2 algorithm.

3 2

Visa and MC announce Thursday
by PJ Ponder 17 Dec '03

17 Dec '03

sorry about screwing up the day of the week, today is really *Thursday*, not Friday. . . . first post of the day, & so forth. My earlier message: From: ponder(a)mail.irm.state.fl.us (pj ponder) To: cypherpunks(a)toad.com Subject: Visa & MC Std Sender: owner-cypherpunks(a)toad.com just heard this on NPR Friday ^^^^^^ am on the east coast of NA. http://www.nytimes.com/library/cyber/week/0201internet-safety.html February 1, 1996 Group to Unveil Industry Standard for Electronic Payments <the rest clipped> p.s. went right out and bought the NY Times and the WSJ, but they didn't have any more info than what is on the nytimes.com server. [return to signal mode]

1 0

I hate over-hyped claims
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Perception in some quarters to the contrary, I am very averse to over-hyped claims, and I would therefore like to publicly acknowledge a factual error in my previous announcement. I wrote: > The only known Internet-based solution that does not require such > hardware is the First Virtual Internet Payment system, details of which > are available at http://www.fv.com. This is not quite true, and I should have known better, but I forgot about the one other example I'd heard of. I should have said: > The only known Internet-based solutions that do not require such > hardware are the First Virtual Internet Payment system, details of which > are available at http://www.fv.com, and the GC Tech system, described at > http://www.gctec.com/. I apologize to the good folks at GC Tech for this unfortunate mistake. They are our competitors, but that does not mean we intended to make any false or misleading claims about them. I stand by all my other claims. -- Nathaniel -------- Nathaniel Borenstein <nsb(a)fv.com> Chief Scientist, First Virtual Holdings FAQ & PGP key: nsb+faq(a)nsb.fv.com

1 0

The Boys From Brazil - thoughts on cloning Nazi servers
by Simon Spero 17 Dec '03

17 Dec '03

I've tried to stay out of this thread, as it is mostly off topic, but I do have one suggestion to people setting up clones of the zundel site. There's a fine line between defending someones freedom of speech, and actively promoting that speech. The reason these mirrors have been set up is to counter the restriction on access to the original site that has been put in place by Deutche Telecom; however, in addition to defeating this restriction, this approach also makes the material more widely available than it was previously, which could be seen as crossing the line between defence of free speech, and active promotion. One approach that would stop this line being crossed would be to configure the clone servers to only allow access to sites in Germany affected by the original restriction. This compromise defends freedom of speech, but does not give the site any wider promulgation than it would have had had no government restrictions been emplaced. Simon

1 0

Re: Crypto-smart-card startup Inside Technologies
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:41 PM 1/31/96 -0800, Peter Monta wrote: >jim bell <jimbell(a)pacifier.com> writes: > >> > [ Inside Technologies ] >> > ..."In public-key cryptography, 512-bit keys are typical and >> > already vulnerable. So we are looking at 640-bit-long keys >> > supported by a scalable design." >> >> This kind of thing disgusts me. We already know 512-bit keys are weak. As >> I recall, I was told that 512 bit keys could be cracked in 20,000 >> MIPS-years. If the ballpark formula holds that adding 10 bits doubles the >> security, that merely means that 640 bits is 2**(128/10) or 8000 times >> strong. While obviously better than 512, it is not ENOUGH better to make me >> confident that this is a long-term secure length. 768 or 1024 bits should >> be considered the minimum. A deliberate design of 640 bits makes it look >> like it's intended to be crackable in 5-10 years, much as DES was suspected >> of a similar design decision in limiting its keylength to 56 bits. > >But the "scalable design" presumably means the hardware can deal >with a variety of modulus lengths. As you say, they would be >short-sighted to make a fixed choice. I hope you're right about this. But there's something to keep in mind. Let's suppose that in 10 years 640 bits are "easily" cracked. Anybody with the storage (money) to keep all these messages will have the power to sort through everything you said in 1996, '10 years later.' Who has the money to even store these messages, as well as the inclination? You guessed it, the government. I realize that it is arguable that this would be possible, no matter what keylength is chosen. True, someday 1024-bit keys might be easily cracked, but that will probably be 30-50 years from now, not 10. In other words, "stretching" the technology today on the "encrypt" side makes storing these messages far less attractive, meaning that the government will have less motivation to do it, and will not be able to make the effort pay off for a few more decades. I would like to see laws: 1. Prohibiting the government from storing encrypted messages it can't currently decrypt for over, say, a couple of years. 1a. Prohibiting any USE by the government of such messages obtained and stored by other entities, including individuals and private corporations, without the express permission of the sender AND receiver of the message. 2. Prohibiting the government from even ATTEMPTING to decrypt a domestically-obtained encrypted message, without a warrant which is simultaneously given to the source of the message: In other words, alerting him to the government's interest. This is just a start. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMREY2/qHVDBboB2dAQGZdgP+MjIK02fU6iysN77g1aWb1gx9bzDrZoh4 ePWmd9RRD3gnzYOSIng5dRCxEpT+0Cqe4cFQEqbD6GhHlfNOKwkTU/LAfhvOdKpo QJ9t93Af3aCaLtFmtXyj1Ce20GNqkp7qqP5DLKjYSEH/bR64aTA0pfZ70aes/8C1 w1AYLdvglXA= =p+3A -----END PGP SIGNATURE-----

2 1

DSN
by Laszlo Vecsey 17 Dec '03

17 Dec '03

Anyone heard of DSN? I think thats the right order of the initials... ... its supposedly the only crypto-hardware solution for protecting an entire network on the Internet. You put one of these $5,000 units at one end of a lan, and another one somewhere else on the Internet, and the company gaurantees secure, encrypted transmissions. The TCP/IP headers and data are mangled, encrypted, etc. It uses 512bit keys and I was just wondering how the authentication is done. Does anyone have any specs on these units? Supposedly it does not require a 3rd party entity to verify that the two units are both valid, when determining the initial public/key pairs. Perhaps there is hardcoded data in the units that is used to verify this? The company supposedly has some proprierty method ... how can we be sure this expensive unit can do its job if information on the encryption has not been released. Is there any freeware software solution that has been put through more of a torture test, and proven to work? It seems to be the best approach would be to put such a program on a server that is acting as the gateway/firewall on each network. (define(RSA m e n)(list->string(u(r(s(string->list m))e n))))(define(u a)(if(> a 0)(cons(integer->char(modulo a 256))(u(quotient a 256)))'()))(define(s a)(if (null? a)0(+(char->integer(car a))(* 256(s(cdr a))))))(define(r a x n)(cond((= 0 x)1)((even? x)(modulo(expt(r a(/ x 2)n)2)n))(#t(modulo(* a(r a(1- x)n))n)))) "SGI and Linux both run Motif and X11. They both compile c++ cleanly (using gnu g++). They're the same!"

1 0

The Boys From Brazil - thoughts on cloning Nazi servers (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 1 Feb 1996 10:49:19 -0800 (PST) > From: Simon Spero <ses(a)tipper.oit.unc.edu> > Subject: The Boys From Brazil - thoughts on cloning Nazi servers > > There's a fine line between defending someones freedom of speech, and > actively promoting that speech. The reason these mirrors have been set up > is to counter the restriction on access to the original site that has > been put in place by Deutche Telecom; however, in addition to defeating > this restriction, this approach also makes the material more widely > available than it was previously, which could be seen as crossing the > line between defence of free speech, and active promotion. > I would counter and say that there is no distinction between free speech and promoting said speech. How does one say one party has the right to make a statement and a second party does not have the right to agree? The whole point of freedom of speech is to prevent limitations on distribution of information (aka speech, writting, source code, executables, video, audio tapes, etc.). Even use of these materials (ie running a virus) would not violate either the spirit or the letter of the law unless it harmed another person or somehow took advantage of their property (physical or intellectual) without their prior consent. Jim Choate CyberTects ravage(a)ssz.com

3 2

Beta Testers Wanted
by Kent Briggs 17 Dec '03

17 Dec '03

I'm looking for volunteers interested in testing the latest beta version of Puffer 2.0. Puffer is my shareware data file & e-mail encryption utility for Windows and has been significantly improved since version 1.0. It is now a full-fledged public key encryption program utilizing Diffie-Hellman technology. The exportable shareware version will support 512-bit public keys and 40-bit PC1 (RC4 clone) encryption. The U.S./Canada registered version will also support 1024-bit public keys and 160-bit Blowfish encryption. All versions support digital signatures, multi-pass data wiping (files, slack, & unused space), LZ77 compression, a built-in editor, and Windows clipboard encryption. I am currently negotiating a patent license for the D-H algorithm with Cylink and an export license with the State Dept. Testers must be residents of the U.S. or Canada. I am looking for cryptography novices through experts using a wide range of PC hardware running Win 3.1, Win 95, or OS/2. I also have detailed text files describing the security protocols and file formats used. I would like experts to take a look at these to make sure I didn't do something stupid. Those that can help will get a free copy of the final registered version. The software will be a 417 K zip file available via http. I will e-mail the protocol and file format specifications to anyone interested. Please respond by private e-mail. Thanks. Kent Briggs 72124.3234(a)compuserve.com

1 0

unscribe
by Jon L. Pope 17 Dec '03

17 Dec '03

unscribe cypherpunks(a)toad.com TAMU-TAMU-TAMU-TAMU-TAMU-TAMU-TAMU-TAMU-TAMU Jon L. Pope, CISA, CIA Supervisory Internal Auditor Texas A&M University Mail Stop #1280 e-mail: pope(a)auditnet.tamu.edu College Station, Tx, 77843-1280 Phone: (409)845-1323 Fax: (409)845-6437) TAMU-TAMU-TAMU-TAMU-TAMU-TAMU-TAMU-TAMU-TAMU

1 0

Re: RC2 Source Code - Legal Warning from RSADSI
by Mr. Boffo 17 Dec '03

17 Dec '03

> WARNING NOTICE > > It has recently come to the attention of RSA Data > Security, Inc. that certain of its confidential and > proprietary source code has been misappropriated and > disclosed. Despite such unauthorized use and disclosure, > RSA Data Security reserves all intellectual property rights > in such source code under applicable law, including without > limitation trade secret and copyright protection. In Ya know... This is getting old! It seems like RSA Data Security can't control their own site. It only seems like yesterday (actually about 2 years ago) that another one of their "RC" algorithms was published to the Usenet thru anonymous remailers. Can't they secure their own site against break-ins? If they want to be the prima-donna site for encryption with all of the "copy-written" crypto, you would think that they could protect their own resources better. Lazarus Long

1 0