- cypherpunks-legacy - lists.cpunks.org

Re: Netscape and NSA
by daw＠quito.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199601191702.LAA12547(a)proust.suba.com>, Alex Strasheim <cp(a)proust.suba.com> wrote: > The Lotus approach is totally unacceptable. [...] > This is the first wave of guys hitting the beach. [...] > We don't have a lot of options in terms of strategy. Let's hack Lotus. Let's put out a binary patch which defeats Lotus's GAK. Let's look for weaknesses in their crypto implementation. Time for me to go looking for a Unix version of Lotus Notes 4. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQAbwyoZzwIn1bdtAQGliAF/bz+i9Uu6N1gK0g/2G7WfN3Wv7zQJVRFG csq1ROPrZE65kzRYa8uwo8xjVszSDbrf =0yvk -----END PGP SIGNATURE-----

1 0

What news along the Rialto?
by P.J. Ponder 17 Dec '03

17 Dec '03

Well, we're waiting. . . Those of us who didn't make it to the RSADSI conference are anxious to hear interesting tales of the Left Coast & crypto. One need not have the stylistic piquancy of John Young; one need only type up one's notes, optionally sign the missive, and mail or remail on to the list, posterity, and the Hoover Palace. I think maybe Bob H. went[?]; he e$pammed a press release from Florida's own Fischer Int'l. Sys. Corp. re: SmartDisk, which isn't really news, having been out for quite some time. When I first saw it, I smacked my forehead sharply with my open hand and said, "Exon the Contented Catamite! Why didn't I think of that?" I hope they sell a million of them. Any news from field agents appreciated. Any news from RSADSI re: prices and availablity of videos, etc., is also OK as far as I'm concerned. -- pj Defending the home, regret vanishes. - 19Jan96(a)I_Ching.tao p.s. noise.sys is neato! Thanks, Robt. Rothenburg Walking-Owl and funet.fi folks

1 0

Re: mailing list
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:35 PM 1/19/96, mbartels wrote: >You come recommended by the Happy Mutant Handbook. Was just wondering >what you suggestions/imput/stuff you guys have up your sleeve. Happy, >Happy!! >tanks. >Weaselicious Inc. "Tanks"? We have no tanks, only cryptography. Looks like the cypherpunks(a)toad.com address, instead of majordomo(a)toad.com address, has again been put out in some book. (In this case, something called the "Happy Mutant Handbook.") Get read for another onslaught. For "Weaselicious," you can subscribe to the Cypherpunks mailing list by sending a message to majordomo(a)toad.com with a body message of subscribe cypherpunks (Send this from the e-mail address which you wish subscribed to the list.) You will receive a welcome message with more information, including the all-important information on how to UNSUBSCRIBE. Don't lose this message, as yoy may need it. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: Cypherpunk Enquirer
by attila 17 Dec '03

17 Dec '03

OK, who's the 'wise guy' among us? is it the aging hippy in a hot top? is it Samuel Clemmons revenge? who cares? write on! as blanc might have said: Hee-hee-hee-haa-haa-haaaaaaa. The UpOurs CPunk News Update. ^ __________________________________________________________________________ go not unto usenet for advice, for the inhabitants thereof will say: yes, and no, and maybe, and I don't know, and fuck-off. _________________________________________________________________ attila__ To be a ruler of men, you need at least 12 inches.... ---------- Forwarded message ---------- Date: Fri, 19 Jan 1996 20:41:31 -0800 From: blanc <blancw(a)accessone.com> To: "cypherpunks(a)toad.com" <cypherpunks(a)toad.com> Subject: RE: Cypherpunk Enquirer Hee-hee-hee-haa-haa-haaaaaaa. The UpYours CPunk News Update. .. Blanc

1 0

Re: CryptoAPI and export question
by Bill Stewart 17 Dec '03

17 Dec '03

Tom Johnston <tomj(a)microsoft.com>: At 06:07 PM 1/17/96 EST, you wrote: >Two points: the CSP development kit is export-controlled; and signing a >CSP developed by a foreign vendor is treated as a export -- so the signature >is export-controlled. > >We would ship a CSP development kit to a foreign vendor, and sign a CSP >developed by the foreign vendor, but only with the appropriate export licenses. Thanks for your reply to Dr. Vulis's question. I'd recommend examining this policy somewhat critically, for a couple of reasons: 1) Development kits are useful, but if you've got an open, documented interface, it's possible to develop code to use it without the kit. (Ignoring, of course, the risk of smuggling. :-) 2) By "is treated as an export", do you mean by explicit government policy, or by Microsoft? Digital signatures and encrypted documents are perfectly legal to export, as is authentication code to make digital signatures. 3) Consider the case of a contractor who buys the development kit, and gives you code to sign. You have no way to differentiate between code that he developed himself, and code developed by some foreign company that hired him and gave him the code (which is legal to import into the US.) He probably can't legally re-export the code, or export the signed version of it, but he can export the signature itself, since that's not cryptographic code, and the foreign company can reattach it to their original document, which you have now signed.... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

2 1

Re: Encryption and the 2nd Amendment
by Michael Froomkin 17 Dec '03

17 Dec '03

IMHO the 2nd amendment argument is bunk. [I haven't seen the Wired article BTW, so this is just a general point.] The definition of crypto as arms was accomplished as an administrative convenience by an agency of the US govt. It is not a definition of constitutional significance. To oversimplify only a little bit, agencies don't get to define terms in the constitution -- and a good thing too, or they might try to define e.g. "speech" in some funny way. The issue is whether under any fair reading of the 2nd Am. you can read "arms" to include encryption. You might try to do this by "original intent" (except that I've never seen a shred of evidence for this). Or you might try to do it by arguing that the meaning of the term "arms" should change with the times and crypto fits the purposes (defending your home?) of the amendment. But this is a very tough argument to make, and I've never seen anyone try it. I suspect it is also bound to fail; indeed any interpretive system that would stretch the constitutional use of the word "arms" so wide as to fit crypto could equally well be used to exclude anything more advanced than muskets and early rifles... which probably explains why I know of no such arguments either. I must be posting some version of this every nine months or so. Each time I get hate mail. Let's make this an exception shall we? A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

re: CAPI signing
by James A. Donald 17 Dec '03

17 Dec '03

At 01:40 PM 1/18/96 -0600, Mike McNally wrote: > > A Microsoft person just responded via direct e-mail that they'll do > CAPI signing in the United States (the word "only" wasn't in there, > but that certainly was the implication). In order to get government approval of CAPI, Microsoft made concessions that we will doubtless find offensive. But once CAPI is in place and working, then those concessions can be taken back. CAPI is a good thing: It is sound design and it will open another front in the conflict. Once software is around that has crypto hooks in it, we can then deal with restrictions on CAPI modules using technical and political means. I expect that technical means will be effective and successful. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Espionage-enabled Lotus notes.
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:38 AM 1/18/96 -0500, hallam(a)w3.org wrote: >The problem with this system is that it is quite likely to suceed. Unlike >Clipper which made unfettered access to encrypted material possible the escrowed >key strength reduction means that the FBI can tap a significant number of >locations, just not all of them. 40-unknown-bit RC4 may take a week for an ICE workstation or a herd of net-coordinated workstations, but it would be much faster to crack on a specialized machine actually designed for RC4. I think Eric's estimate was $25-50K for a machine that could do it in 15 minutes, built out of programmable gate arrays. That's not $10,000/crack, or $584, but $0.25-.50. Would they crack all the keys they wanted for a quarter each? Sure; at that rate it's probably cheaper to crack them than read them (though in reality they'd feed most of them to keyword scanners.) >It will be very hard to argue effectively against this idea in Congress. >Much harder than the Clipper chip which was dead on arrival. You may be right. They keep making outrageous demands, and "compromising" on less outrageous ones. Something prominently not mentioned in the article was "escrow agents" for the 24 bits of wiretap-support key; apparently foreigners don't get even that much due process. Nor was there a clarification of whether all the software has the same wiretap key (probable) or each copy has a different wiretap key (the Clipper model.) If it's just one key, then nobody's mail is safe. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

Re: Respect for privacy != Re: exposure=deterence?
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:03 PM 01/19/96, Rich Graves wrote: >I'll certainly grant you that there is a conspiracy and a secret >government (broadly defined), but not everyone paid by the government is >in on it, and not everyone involved is in the government. Nah, many conspiracies. Lots of government folks doing their own secret, non-secret, and semi-secret stuff in cooperation with other government folks and non-government folks. Adam Smith either said, or is frequently misquoted as saying, that whenever two business people of the same profession meet, it's a conspiracy. That goes double for two government agents. [What's a double conspiracy? You'd know if you were in on it.] >Gratuitous use of pseudonymity can be counterproductive. Now nobody's >going to be able to use your "bar-coded garbage" essay without being >suspected of being you, which I doubt is what you want. > >Is anyone going to quote you in the future, as you quote Patrick Henry? Or as everyone quotes Publius? Who is Publius anyway? Alexander Hamilton or Tom Jefferson, or someone like that, I forget. Would they quote Publius if they never figured out who "really" wrote Publius' stuff? I dunno. Maybe eventually we'll know who We Jurgar Din "really" is. But probably not, becuase we won't even remember what he wrote, let alone be interested in who he "really" is. And I guess everyone doesn't quote Publius anyway. But every American Constitutional Law textbook probably does, and most American History textbooks. Maybe future American Bar Code textbooks will quote We Jurgar Din. Somehow I doubt it, though.

1 0

Re: Espionage-enabled Lotus notes.
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:16 PM 1/18/96 -0500, "Richard Martin" <rmartin(a)aw.sgi.com> wrote: >The Lotus `solution' seems to be the action of an American company >shipping a product which effectively says to foreign users, "We don't >care about you as a market." To play Sternlight's Advocate for the moment, I'll have to disagree with you here. 40-bit encryption really is a joke, for any business data worth protecting (and Lotus Notes is primarily a business product.) 64-bit RC4 encryption, while less than ideal, is still usable for most applications; it's certainly stronger than DES by a couple orders of magnitude, which is probably enough for now. Yes, the Yanquis can wiretap you, but it's better than having _everybody_ wiretap you. (And besides, you're probably going to use the 128-bit smuggled version anyway.) This at least provides a product you can use with _some_ credibility, assuming it interoperates with the US version, which I think the 40-bit version did. >That this is the so-called "export" >version is ironic. The keys are escrowed with the U.S. government, >and no one else. The French government should rightly cry foul, for >this is (a) encryption where they don't have the keys and (b) encryption >where another government *does*. The French can still ban it, or require you to register your keys, just as they can with the 40-bit version. Or ban products with menu items in English, if they think that's too encrypted for them. :-) C'est la guerre. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0