- cypherpunks-legacy - lists.cpunks.org

Re: FW: Now we have it all
by Hendra Halim 17 Dec '03

17 Dec '03

>X-Sender: tcmay(a)mail.got.net >Date: Wed, 6 Nov 1996 10:04:52 -0800 >To: CYPHERPUNKS(a)toad.com >From: "Timothy C. May" <tcmay(a)got.net> >Subject: Re: FW: Now we have it all >Sender: owner-cypherpunks(a)toad.com > >At 10:47 AM +0100 11/6/96, Butler, Scott wrote: >>> >>Abaddon wrote: >> >>>>susbscribe >> >>Surely we have seen it all now. >>I find it hard to believe that a word like >>suscribe....subsribe....subcribes.. >>SUBSCRIBE..is so difficult to spell correctly. >> >>:-) > >This is actually steganography. Various spellings of "subscribe" are being >used to communicate a bit or two per message. > >Actually, the practice becomes a code, as in: > >"Suscrive if by sea, sudcribe if by land." > > >--Klaus! von Future Prime > > >Please unsubscribe me from your list > > >Hendra

1 0

RE: Disseminating public-key crypto source code
by John Lehmann 17 Dec '03

17 Dec '03

> >I've written a few Perl routines for public-key cryptography. I'd >like to freely disseminate the source code (starting with ElGamal) to >as many people as I can, > >It's my understanding that there are two orthogonal restrictions: > > 1) ITAResque: I can't give code to non-U.S. citizens. > 2) PKPesque: Using public-key crypto is an infringement, > although disseminating/possessing the source > code is not. > >While I'm sure these are oversimplifications, it would seem that I can >release my source code over the Internet provided I install a simple >verification mechanism (cf. MIT's PGP distribution) to ensure that >only people claiming to be U.S. citizens have access privileges. > >Am I correct? If so, why aren't more people doing this? > People do do this, but if you are using RSA or other methods patented in the US, you might want to look at them. Is the concept of PK cryptography patented? And of course you are familiar with Bernstein v DoS... [http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/HTML/bernstein_961218 _pressrel.html] >The plaintiff in the case, Daniel J. Bernstein, Research Assistant Professor at >the University of Illinois at Chicago, developed an "encryption >algorithm" (a recipe or set of instructions) that he wanted to publish in printed >journals as well as on the Internet. Bernstein sued the >government, claiming that the government's requirements that he register as an >arms dealer and seek government permission before publication >was a violation of his First Amendment right of free speech. This is required by >the Arms Export Control Act and its implementing regulations, >the International Traffic in Arms Regulations. > >In the first phase of this litigation, the government argued that since Bernstein's >ideas were expressed, in part, in computer language (source >code), they were not protected by the First Amendment. On April 15, 1996, >Judge Patel rejected that argument and held for the first time that >computer source code is protected speech for purposes of the First >Amendment. ...here Perl has the advantage of being a scripting language, and so by default comes as source, though if you had written the routines in a scripting langauge like Python, you might find it easier to convince a judge that it was in fact human readable... -- John "BTW IANAL" Lehmann

1 0

Crypto Regulation Reform
by rcain＠netcom.com 17 Dec '03

17 Dec '03

Mr. President, I am watching with great interest the activity with regard to cyrpto regulation and have an observation I would like to share. The following was excerpted from the Harris statement: > > The President has determined that vital U.S. national security and > law enforcement interests compel maintaining appropriate control > of encryption. Still, there is much that can be done to reform > existing controls to ensure that they are efficiently implemented > and to maintain U.S. leadership in the world market for encryption > technology. Accordingly, the President has asked the Secretary of > State to take immediate action to implement a number of procedural > reforms. The reforms are: > While I totally understand the concern here and am in sympathy with the reasoning, assuming benign adherence to the procedures, I think you are in effect jousting windmills with this attempt to control or regulate crypto. It is simply too easy to build and distribute inexpensive devices that are *truly secure*, without back doors to make it other than delusional to think that the people that we would not want to have this technology won't. A device can be made right now at lower cost than a computer modem, much lower, that could be inserted between any phone and the wall that would make it impossible, no matter what laws are in place, to tap either passively or acitively, communication that passes between two of these devices. I know how to do it, could do it and probably will just for the fun of it at least. If I can there are many others that can also. In fact I personally know several. These devices can be credit card size and even fit in a wallet. They can easily be smuggled in and will be. A black market will flourish and nothing will have been accomplished except the expenditure of a lot of futile money and creation of more crime in an inflated, lucrative market. We simply must accept that point-to-point secure communication is a part of our electronic environment and swallow the bitter pill that no matter what the valid arguments are for regulation, it is effectively not possible, so that national security and law enforcement are going to be denied, in the near future, a tool in their arsenel and will have to come up with new ways of gathering this intelligence. Please abandon this effort before we throw good money after bad and create a worse situation than we will have without it. I would like whoever processes this email to forward a copy to the following contact. > The contact point for further information on these reforms is Rose > Biancaniello, Office of Defense Trade Controls, Bureau of > Political-Military Affairs, Department of State, (703) 875-6644. Sincerely, Bob Cain -- Bob Cain rcain(a)netcom.com 408-354-8021

5 13

Information
by kb4vwa＠juno.com 17 Dec '03

17 Dec '03

I'm a new Cyberpunk! I apologized if this is not the place to post this message request. I have some interesting projects and questions for the Cyberpunk world. I would like to know if there is any Cyberpunks in S. Florida (Miami) who could converse with me about Crypto? I am very interested in making new Cyberpunk friends, meeting places, etc.., or please send me E-mail. I would like to know where to place my Public Key? Note, I only have E-mail access at this time, and not the Net access, but could have a friend place the key for me. Last, I would like to know once and for all, is PGP compromised, is there a back door, and have we been fooled by NSA to believe it's secure? Ed - kb4vwa(a)juno.com

4 3

Re: your mail
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>David Koontz writes: >> All this bullshit doesnot state that a court order is required, rather >> 'legal authorization', which means the NSA for foreign intellingence >> purposes without a court order. >The Foreign Intelligence Surveillance Act (FISA) requires a court order >The Foreign Intelligence Surveillance Act (FISA) requires a court order >for such taps. >--Mike >From a secret court that has never (NEVER), turned down a request.

1 0

Re: Information
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>> On Tue, 5 Nov 1996, Edward R. Figueroa wrote: >> > I'm a new Cyberpunk! Probably wearing a set of Ono-Sendai eyeballs.... >> > Last, I would like to know once and for all, is PGP compromised, is >> > there a back door, and have we been fooled by NSA to believe it's secure? You can read and compile the source code yourself. You can learn crypto to help you understand the strength of the algorithms. I'd recommend Bruce Schneier's "Applied Cryptography". You can look for bugs and subtle design flaws along with other people. There are un-subtle design flaws, like the DOSoid user interface :-), and there are philosophical arguments about whether an identity-based Web of Trust is the right trust model, and practical problems about how to support revocation correctly, but basically it's Pretty Good Privacy. On the other hand, there are other threats to think about. Is there a virus, software bug, or trojan horse that captures the keystrokes you type into your computer? If your passphrase is stolen, you lose. PGP can't tell; it's just software. What's on that yellow sticky note? Is the NSA listening for electronic signals from that dark van parked out in front of your house? They're pretty good these days. Your computer doesn't know, so PGP can't help you with it. Are you using PGP to keep business records (like that second set of books) which can be subpoenaed by a court? When the IRS seizes your computer and sees all those files with ------BEGIN PGP----- on them, can they force you to reveal the keys or at least the contents? PGP can't solve those problems for you. But it can keep amateurs like your local police department from reading the files you really care about until they haul you in front of a court where you can bring a lawyer. There are applications that PGP doesn't do, like keeping the blocks on your disk drive automagically encrypted - it just does things to files when you tell it to. But you can at least encrypt the critical stuff, and you can encrypt your email messages and other sensitive files you transmit across a network. Won't do any good for IRC... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

7 9

Re: RSA challenge: is it legal to try?
by jim bell 17 Dec '03

17 Dec '03

At 05:33 PM 1/16/97 -0800, Bill Stewart wrote: >At 08:13 PM 1/14/97 -0800, jim bell wrote: >>US. Alone, that would have denied non-US patents to RSA. However, such an >>explanation grandly ignores the fact that computer software (let alone >>mathematics in general) was not considered patentable ANYWHERE (?) before >>public-key systems made their appearance in 1976. >... >>I'm still waiting for an "innocent" explanation for the US patent office >>beginning to issue software patents. I don't think there is one. > >The first software patent was Dennis Ritchie's patent on setUID. So what year was that? >Computer security is one area that, if you're going to allow patents >on software at all (which I think are a bad idea, but that's politics) No, it's not JUST politics. It's also (im)practicality. Even if, arguably, software OUGHT TO be patentable, going from a time in which software wasn't patentable to software patentability is essentially impossible. First, it requires (or, at least, ought to require, if they were to do it right...which they didn't) a searchable compilation of all previously existing software ideas and constructs to ensure that obvious or previously-existing ideas were not given patents. Since prior to about 1976 there was no motivation on anyone's part to collect such a database (secrecy being the most useful protection) then it was practically guaranteed that the Patent Office would be unable (or unwilling???) to refuse to grant patents on old ideas. Further, unlike a lot of big-ticket engineering, programming can be done by individuals with a relatively low-cost computer. Many if not most of the software constructs that were later called "patentable" were probably actually invented by people who had no interest in patenting them...and the few greedy ones who did were given the rewards. That's not fair, particularly when they may have been invented during a time in which software patents were known to be impossible to get. Also, since unlike other areas of engineering current programmers didn't have to pay for previous software constructs ("do-loops were free") there should have been distinct limits on the royalties that anybody could ask for in software-patent cases. Another problem is that much of the costs of most software companies are personnel and advertising. Any realistic royalty system (even assuming all other problems were solved) would have to determine what portion of a program's functionality was attributable to a patented concept, which I assert is essentially impossible. Do you charge for execution time? (the guy who patents the "wait loop" would make a fortune!) Length of code? Number of times called? Royalties must, presumably, be limited to a reasonable and practical level, and also (obviously) they may also have to be divided among a number of potential claimants, in the same way that (for instance) a car manufacturer may have to pay royalties on potentially hundreds or even thousands of patents to sell a single car. If no mechanism currently exists to arrive at a fair division of such royalties (about 20 years after the patents for the various encryption systems were filed) , I think it may be presumed that nobody seriously believes that this is possible. In short, I think it's absolutely foolish to believe that any sort of workable system could ever have been arranged to patent software, even if all of the issues above had been addressed fairly. And the reason I asked for an "innocent" explanation is to give people the benefit of the doubt so that they could show that the system was working. It isn't, and you know it. It's not surprising that no REAL LAWYERS (tm) around here were willing to tackle this issue. They know it's all a fraud. >>It also ignores the strong likelihood that the reason for the Patent-Office >>policy change (done, apparently, without benefit of a corresponding law >>change) was because with public-key/RSA there was finally an example of >>software the government wished to deny to the average citizen, >>and the only mechanism (short of secrecy, which was broken) to do so >>was to patent it. > >D,H,R,S, and A didn't _have_ to apply for patents.... >With hardware security products, the NSA has the power to seize and >classify systems which are applying for patents, for no particularly >good reason, and they used to do it often. Actually, I don't think they REALLY "have the power." What I mean by this is simple: Since American patents are supposedly grantable for applications filed up to one year prior, there is no guarantee that they will even see a patent application to grant until long after the cat is out of the bag. For instance, there was >an analog scrambler for CB radios that got its patent applications >seized in about 1980. And most software patent applications for >crypto have involved machinations to avoid getting trapped by this, >like publishing in foreign journals before submitting applications. Why should they have to publish in FOREIGN journals? Like I said before, since up to one year can elapse after disclosure (and, apparently, even longer in the case of the DHM patent, submission to ANY journal, not merely domestic ones, should do to prevent NSA's tricks. (and today, publishing on the Internet should achieve exactly the same results.) Richard Schoeppel commented this way: "Roger Schlafly has made a reasonable case that the DHM patent is invalid because the invention was "published" more than a year before the patent was filed. (He dug up a copy of a preprint they were circulating with a stamped received-date of ?May 1976?.)" What are we to conclude? These sleazebags can't even follow their own rules! Look, I asked for an INNOCENT explanation of software patents. INNOCENT explanations don't include the obvious kind of scams pulled like this. Jim Bell jimbell(a)pacifier.com

2 1

Re: Military & dependants
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Nobody asks: > Can American Military members or their family take copies of PGP > or other encryption programs with them when being stationed at > overseas bases? Aren't the overseas installations considered to > be American soil while occupied, thus permitting such transfers? I'm not sure what the ITAR rules say about export of armaments by the military; it would be nice if it were illegal :-) Also don't know if sending to American military bases overseas counts as export, especially if it involves going through non-US territory (if there is such a thing any more :-() Use of encryption technology by the military is probably subject to all sorts of rules; use for official purposes certainly is. You could probably get in major trouble for doing so without authorization, and I doubt PGP is officially approved; it's certainly not approved for classified information. Patent issues are also involved; the government is allowed to use RSA as part of the terms of the funding deals for their research, but this presumably doesn't apply to private use by government employees. On the other hand, IDEA wasn't developed with US funds, and its patent probably doesn't give the government any rights to use it. Ascom Tech probably could try to restrict it if they wanted.

1 0

Re: DOJ procedures relating to Clipper Chips and key escrow
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

> From: hughes(a)ah.com (Eric Hughes) >Is this a Clinton administration policy to make such feel-good, >govern-bad pronouncements? Double plus ++ungood. Needless to say, I had trouble parsing this.

1 0

Re: A Nice Summary of Motives for Clipper
by Hal 17 Dec '03

17 Dec '03

Several people on sci.crypt have pointed to the following paragraph in Matt Blaze's report of the NSA briefing on Clipper, posted here and in the newsgroups: > Clipper chips should be available (to product vendors) in June. You > can't just buy loose chips - they have to be installed in approved > products. Your application interface has to be approved by NIST for > you to get your hands on the chips. This could explain a lot. In particular, if they can enforce this, it could put an end to the dreams of multiple encryption. For months people have been saying, "Clipper? No problem. I'll just encrypt with PGP then pass it through Clipper and the Feds won't ever guess! Ha, ha, ha!" Maybe this won't be so easy. From Blaze's description it sounds like such devices wouldn't be approved. It could be the only Clipper phones will be ones that don't do anything to keep the Feds from picking up the conversation. People could still build non-Clipper encrypting phones (assuming that the constant rumors of threatening midnight visits from NSA agents are false), but the users of those phones could no longer blend in with the Clipper traffic. Hal

2 2