- cypherpunks-legacy - lists.cpunks.org

Digital Signature Standard industry push
by Stanton McCandlish 17 Dec '03

17 Dec '03

|||||||||| |||||||||| Information Express || || a voorhees report || || || ||||||| 718-369-0906 voice || || 636-8931 MCI Mail || || |||||||||| |||||||||| 411 First St., Brooklyn, NY 11215 ==============================================================+ (c) 1994 Mark Voorhees --Feel free to re-post this article freely-- GORE URGED TO PUSH DIGITAL SIGNATURE STANDARD FORWARD Electronic security firms call for resolution of cryptographic patents March 21, 1994--Eight leading data security firms have written Vice President Albert Gore requesting that he prod the adoption of the proposed Digital Signature Standard. A patent dispute between the government and Public Key Partners is holding up the standard, which would provide a way of verifying documents used in electronic commerce. The companies--AT&T, among them--are frustrated that they are missing business opportunity through government inaction. The original standard was proposed in August 1991. PKP owns most of the critical U.S. cryptographic patents. It negotiated an agreement with the National Institute of Standards and Technology that would give PKP the right to earn royalties on products using the government's digital signature standard. That agreement, which was published in the Federal Register last June, raised a ruckus in industry among vendors who did not want to pay PKP. Gore bent to that opposition on February 4, when his office announced that the standard would be royalty free. While that pronouncement greatly pleased industry, it has created a thicket of sticky, interwoven problems that defy quick resolution. The federal government must either assume the royalty payments, which would likely total millions of dollars; try to invalidate PKP's patents in court; or come up with a new standard. The first option is politically explosive and the second and third are time consuming. "Many of us have invested tremendous time, effort and money in developing systems and products" built to the proposed standard, the letter said. A new standard would also encounter royalty demands from PKP and delay commercial development by four to five years. "Further delay would only delay product development, frustrate the user base, fragment the market and delay the benefits to be realized through electronic commerce," the letter said. Gore's office did not respond for comment by press time. The companies signing the letter were: Information Security Corp.; Litronic Industries; AT&T Secure Communications Systems; Digital Signature; Mykotronx, Inc.; Datakey, Inc,; SecureWare, Inc.; and Cordant, Inc. The letter was dated March 14. (For more information, please refer to the March 25 issue of Information Law Alert, which will be in the mail shortly.) | Mark Voorhees | voorhees reports | | 411 first street | 636-8931 MCI Mail | brooklyn, ny 11215-2507 | | 1-718-369-0906 (voice) | markvoor(a)phantom.com | 1-718-369-3250 (fax) -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

House hearings on Internet security TUESDAY 22 March, Wash. DC
by Stanton McCandlish 17 Dec '03

17 Dec '03

[cribbed from a pair of press releases] House Subcommittee on Science Hearing on Internet Security Chaired by Rep. Rick Boucher (D-VA) March 22, 1994 9:30 a.m. - 2318 Rayburn House Office Building The Subcommittee's interest in the issue arises in part because the Internet is a prime method of communication between researchers in academia and industry. It is also a major means of communication for federal researchers at agencies under the Subcommittee's jurisdiction. Recent break-ins on the Internet prompted the federal Computer Emergency Response Team to issue a special alert to Internet users on February 3, and suggest that the system may be more vulnerable than generally acknowledged to deliberate destruction or alteration of computer files. The hearing will evaluate the status of security on the Internet today and will examine measures currently available to enhance security, assess the effectiveness and degree of implementation of such measures, and identify obstacles to enhancing Internet security. Mail sstpress(a)hr.house.gov or fax 202-225-8280 for more info. For press access, call Rick Borchelt at 202-225-3359 Tentative Witness List Mr. L. Dain Gary, Manager Computer Emergency Response Team Operations (CERT) Carnegie Mellon University Pittsburgh, Pennsylvania (CERT is one of the coalition of response teams that form the Forum of Incident Response and Security Teams, or FIRST) Mr. Thomas T. Kubic Chief, Financial Crimes Section Federal Bureau of Investigation Washington, DC Dr. Vinton G. Cerf, President Internet Society Reston, Virginia (Senior VP of Data Architecture, MCI) Mr. Lynn McNulty Associate Director for Computer Security Computer Systems Laboratory National Institute of Standards and Technology Gaithersburg, Maryland (NIST is the secretariat for FIRST) Dr. Stephen D. Crocker, Vice President Trusted Information Systems Glenwood, Maryland (Chair, Privacy and Security Research Group, Internet Research Task Force) -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

Exciting News!
by Adam Lake 17 Dec '03

17 Dec '03

Fellow cypherpunks: Your Clipper worries are over. Cracker Jacks will soon offer a Clipper decoder ring in a few select boxes of Craker Jacks;-) lake(a)uenics.evansville.edu ---------------------------------------------------------------------------- Space for rent ----------------------------------------------------------------------------

1 0

Where to find RSAREF (source library used by RIPEM)
by Christopher Allen 17 Dec '03

17 Dec '03

Some people asked after my last message how to get the latest version of RSAREF 1.2 -- it can be found on RSA's anonymous ftp server. What is significant about the new RSAREF is that it is used as the basis for RIPEM and RIPEM/SIG, and that you can incorporate its toolbox in your own applications very inexpensively. According to their license agreement, freeware (i.e. non-moneymaking) software can use the RSAREF toolkit provided that you make the source code to your utility available. Though this is not official yet, I've been told by RSA that they will also grant a royalty-free license to shareware authors up to $10,000 worth of gross annual sales if the shareware source code is available and the author(s) do not charge more than $50 a copy. If you are a commercial developer, I know from personal experience that they can be quite reasonable about licensing -- they want this base level of technology adopted as widely as possible -- just make RSA a reasonable offer and I think they'll take it. Remember, even though you can use RSAREF to create exportable non-encryption based digital signature software, the source code to RSAREF is not exportable itself as it can do encryption thus it is only available to US and Canadian citizens. Information on what RSAREF is all about and what are the license terms are located at: ftp://rsa.com/rsaref/info.reply ftp://rsa.com/rsaref/license.txt To get access to a time dependent directory (it changes every few minutes) you will need to read the document: ftp://rsa.com/rsaref/README If you agree to it's terms, take the directory mentioned there and substitute it for the the checksum in the directory "U.S.-only 7c04e6". The uuencoded tar archive of RSAREF is at (remember to change the time dependent directory!): ftp://rsa.com/rsaref/dist/U.S.-only-7c04e6/rsaref.tar.Z The ZIP archive of RSAREF is at (remember to change the time dependent directory!): ftp://rsa.com/rsaref/dist/U.S.-only-7c04e6/rsaref.zip You can also get the RSAREF via email by reading the RSAREF license agreement and sending the following message to <rsaref-administrator(a)rsa.com>. If your electronic mail address is located in Canada, please send RSA your full name and mailing address; they'll need it to complete a Department of State export declaration. I acknowledge that I have read the RSAREF Program License Agreement and understand and agree to be bound by its terms and conditions, including without limitation its restrictions on foreign reshipment of the Program and information related to the Program. The electronic mail address to which I am requesting that the program be transmitted is located in the United States of America or Canada and I am a United States citizen, a Canadian citizen, or a permanent resident of the United States. The RSAREF Program License Agreement is the complete and exclusive agreement between RSA Laboratories and me relating to the Program, and supersedes any proposal or prior agreement, oral or written, and any other communications between RSA Laboratories and me relating to the Program. ------------------------------------------------------------------------ ..Christopher Allen Consensus Development Corporation.. ..<consensus(a)netcom.com> 4104-24th Street #419.. .. San Francisco, CA 94114-3615.. .. o415/647-6383 f415/647-6384.. ..Mosaic/World-Wide-Web Front Door: .. ..ftp://netcom7.netcom.com/pub/consensus/www/ConsensusFrontDoor.html ..

1 0

ADMIN: CFP will create an administrative outage
by hughes＠ah.com 17 Dec '03

17 Dec '03

I leave for CFP this morning. The majordomo filter should take care of most of the complainers. The others should be told that active administration will resume next week after I get back. Eric

1 0

Re: (fwd) FBI Wiretaps. Old news....
by Dave Banisar 17 Dec '03

17 Dec '03

> Date: Sun, 20 Mar 1994 12:06:05 -0500 > From: Black Unicorn <unicorn> > Message-Id: <199403201706.AA03413(a)access3.digex.net> > To: cypherpunks(a)toad.com, paul(a)hawksbill.sprintmrn.com > Subject: Re: (fwd) FBI Wiretaps. Old news.... > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > > ``We could be out of the wiretap business in a very short > > time,'' Freeh said. He said 91 court-approved wiretaps were > > abandoned last year because telephone companies could not solve > > technical problems. > > > I forgot to add, EFF's recent FOIA act asking for equipment > interference with court ordered wiretaps showed NO problems. > > Where the 91 figure comes from is a mystery. > > Actually that was a series of CPSR FOIA requests dating back to 1992. EFF (except for some done by Bd. Member John Gilmore) does not do FOIA. There are fudging seriously on the 91 figure. They admit that none of them have to do with digital telephony. At least 10 were from NY in the mid-80s when everyone wanted a cell phone and there wernt enough ports for the FBI to wiretaps them all at the same time. That situation has been remedied. Another 30 of them were when they could not slap a pen register on a cell phone (actually nothing to do with taps at all really). and so on. After Freeh mentioned the 9 figure, Leahy really took him apart on the figures. -d

1 0

Promise her anything...
by Hal 17 Dec '03

17 Dec '03

A few days ago I said I'd look up the legal requirements on promissory notes. This was to see whether digital cash or similar instruments could implement digital promissory notes. I found a book of legal forms for a variety of situations, and one set of forms dealt with promissory notes. Here are some of the comments about the sample notes below. "Negotiability. "All of our notes are negotiable - that is, they can be sold. To understand what this means, think of what happens when you write a check. Your check means that you owe the face amount of the check to the person you have made it out to (the payee) and that your bank will pay this debt when the check is presented to it. The original payee of your check can either collect the amount directly or, as is common, endorse the check to someone else. This new owner can then collect the amount from your bank or endorse the check to someone else. In other words, the check can pass freely from person to person (that is, be negotiated) until it is presented to your bank for payment. "Promissory notes can similarly be negotiated, assuming they contain the following provisions and magic words: "names of the lender and borrower, and borrower's address "a statement that the debt is payable 'to the order of' the lender (promisee) "a specified principal sum to be paid and the specific rate of interest, if any "the address where the payments are to be made "the city where and date when the note is signed and "the signature of the debtor (promisee) "All the notes set out in this book contain this basic information. Although we told you in Chapter 1 that you could alter our contracts to your satisfaction, taking out any of these clauses will probably render the note non-negotiable (though still valid). "In fact, it is unlikely that negotiability will be important to very many readers, as most will never transfer their note. However, should one of the parties die, become mentally ill, or otherwise not be able to pay or collect the debt, the fact that the note is negotiable increases the chance that it will be paid. Why? Because institutions in the business of purchasing uncollected notes and collecting onthem may be willing to buy it. If you alter a note but want to have it remain negotiable, make sure it still contains the elements listed above." The promissory note in the book also has a clause regarding attorney fees. I will eliminate it here which implies that each party simply pays his own attorney fees. It simplifies the note. Here is the note. The form is not important, but the information present is: For value received, I individually promise to pay to the order of ____________ $___________ on _____________ at _______________________. Date: _________________________ Location (City or County): _________________________ Name of Borrower: _________________________ Address of Borrower: _________________________ _________________________ Signature of Borrower: _________________________ In considering how this could be presented in electronic form, the basic information could be provided in a digitally signed message. The thrust of the legal discussion about the note is to make sure it can be enforced in court if the borrower doesn't pay. Digital signatures have not, as far as I know, been tested yet in court, so lenders would not currently have the protections with a digital promissory note that they would have with a written one. These notes also do not seem to lend themselves to anonymous transactions very well. The original note must contain the name of both borrower and lender. And I believe that if the note is sold, it must be endorsed over to the buyer like a check. So not only does the note record the names of its owners, it also shows a trail of previous owners. In general, this does not seem to be an approach which would protect privacy. I imagine it is possible for a person to create a "bearer" promissory note, where he will pay back some loan to whomever presents the note. In normal circumstances, though, no lender would want to lend in exchange for such a note, since the regular promissory note gives him more protection. It's not clear, too, how enforceable such a note would be, especially if presented by someone not the original lender, say if the original lender contested the note (claiming it was stolen or such). The one loose end I did pick up from this reading was the general topic of negotiable instruments. These are financial papers which can be sold. Per- haps among the great variety of such instruments there would be some more suitable to digital implementation using the anonymous-transfer technology. Hal

4 3

Parker on Clipper
by moulton＠netcom.com 17 Dec '03

17 Dec '03

In the 21-Mar-94 issue of Computerworld p.4 the following statment is attributed to Donn Parker of SRI, "We have to make strong, nonescrow encryption a crime". I do not remember Parker making a statement like this previously, is this a new position for Parker or is my memory going bad? Fred

4 4

DT'94 and Clipper: effect on manufactures (FWD)
by Black Unicorn 17 Dec '03

17 Dec '03

I thought I would forward this as it seemed to relate. Also 'cause I'm the author. :) -> Newsgroups: comp.org.eff.talk,alt.privacy.clipper,talk.politics.crypto Subject: Re: Janet Reno on Clipper Summary: Expires: References: <strnlghtCMxE5n.5qw(a)netcom.com> <2mi265$4a6(a)access3.digex.net> <strnlghtCMzA43.E93(a)netcom.com> <6woWZxj024n(a)sktb.demon.co.uk> Sender: Followup-To: Distribution: inet Organization: Express Access Online Communications, Greenbelt, MD USA Keywords: Cc: In article <6woWZxj024n(a)sktb.demon.co.uk>, Paul L. Allen <pla(a)sktb.demon.co.uk> wrote: >In article <strnlghtCMzA43.E93(a)netcom.com> > strnlght(a)netcom.com (David Sternlight) writes: > >> Then Brad's fear is unfounded since those equipment manufacturers who aren't >> common carriers can sell crypto without a back door. > >If this is the case then such equipment will no doubt end up with a sticker >saying that it is illegal to use it on a line supplied by a common carrier >and that doing so may result in a fine or imprisonment. No. The bill in its draft from provides that common carriers who do not provide the encryption device are exempt. The meaning on its face is that common carriers are gaining some immunity to sanctions if they did not provide the customer with the encryption he or she is using and instead provide a means for the government to compell the common carrier to produce in the clear that which they caused to be encrypted. This is a simplification, look at the bill for the full details. The practical effect the bills has is to impose on common carriers that manufacture encryption devices, a duty to provide to the government those conversations which are made with said devices over their lines. For example: If AT&T manufactures some encryption device, and I use it over AT&T lines, one reading of the bill would suggest that AT&T is now RESPONSIBLE for decrypting this if the government should request it. The definition is not limited to common carriers either. PCS manufactures are also covered. This definition argueably includes: Motorola Apple (If they provide cellular support for Newton) Cannon and perhaps anyone who manufactures cellular phones. If this is the case, all these companies are bound by the terms of DT'94 and subject to its fines and sancations as well. The net result is to discourage and make very DANGEROUS the manufacutre of encryption devices if you fall into this category. HEREIN LIES THE IMPORTANT POINT: THE CONNECTION TO THE CLIPPER PROPOSAL AND THE ASSERTION WHICH MR. STERNLIGHT WILL JUMP UPON WITH VIGOR. The real target of this legislation is the large telecomunications MANUFACTURES like AT&T. It is now very dangerous to manufacture encryption devices and still remain a common carrier. Most of the large companies that would like to jump into the market for encryption devices are also probably going to fall into the common carrier definition or the PCS manufacture definition. If you subscribe to Mr. Sternlight's views, you would argue that this is really voluntary and that no one is forcing the companies not to manufacture these products, indeed they are free to manufacture them and pay the crippling $10,000/day non-compliance sanction and endure service injunctions. After you remove the large companies from contention, all that is left is the small companies that don't fall into common carrier definitions and are not PCS manufactures. So the government introduces an exception. If you manufacture an encryption device with Clipper, the government (Mytronics) has manufactured the chips, and provided the keys. Since they provided the keys, the 3rd party manufacturer is exempt from the DT'94 regulations for decryption duty. The only companies left manufacturing non-clipper devices are the small fries that cannot hope to compete in a government subsidized and flooded market. If this does not fit the definition of regulation, I simply refuse to argue the point with my opponents any longer as they are clearly resorting to arguement by symantics. Even now the subtle cleverness with which the parts come together and form a powerful whole scares me. The fact that this legislation does not appear to be regulation on its face deserves a great deal of credit. Too nicely integrated to be accidental in my view. Very cunning Janet et al, very cunning. > >At least that's how this sort of thing is handled in the UK - connecting >a modem which doesn't carry BABT approval to a BT line is a *criminal* >offence. That's just a modem - imagine what they would do with an unapproved >crypto device. I'm waiting for encryption devices to be included in the definition of personal communications system and covered outright by DT'94 >Your stance on Clipper has long since lost all semblance of credibility. Why >not admit it and stop cluttering up the group? > >--Paul > Mr. Sternlight serves an important function on the net. I rarely agree with him, or his style of arguement, but he has never resorted to personal attack in his discussions with me and for this he deserves at least some respect. I cannot speak for others he might have offended. -uni- (Dark)

1 0

Re: CLIPPER CHIP ON LIMBAUGH
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: Sandy Sandfort <sandfort(a)crl.com> : Time for us to target Rush's show with anti-Clipper calls? His contact : information is: >From what I understand of the loud-mouthed ass's psychology, you'll get more out of him if you target him with *pro* clipper calls :-) G

2 1