- cypherpunks-legacy - lists.cpunks.org

Re: "This post is G-Rated"
by frantz＠netcom.com 17 Dec '03

17 Dec '03

... Discussion of rating systems elided. Does anyone have suggestions for achieving the goals of the V-Chip with many non-govermental rating agencies? It seems to me that empowering parents would head off the TV/Internet censors. Any parent who was interested in acting as a censor for their children's TV/Internet would be happy to pay an extra $20 or so for the technical means to achieve that goal. The big problem is how are the labels attached to the programs. I agree with Tim that it is probably imposible for individual Usenet postings. However is should be possible for TV programs, and whole newsgroups. BTW - I think that such hardware/software is a wonderful way train hackers. Most of the teenagers I know, know more about their home electronics than their parents do. And the teenagers RTFM. Bill

4 3

Re: Associating Local Port Number to PID
by pete＠stc.com 17 Dec '03

17 Dec '03

"Karl A. Siil" <karl(a)cosmos.cosmos.att.com> writes: > I'm working on a program for UNIX (SVR4, Solaris 2.4) systems that needs to > associate PID with local TCP/IP port number, so as to pass session keys > accordingly to already running processes. This sounds like such an obviously > needed association that someone must have done it already. Take a look at how implementations of identd (RFC 1413) do it. This daemon associates a TCP port with its UID, but I'm sure the PID is very close by in the netstat data structures. It might actually find the PID first, then look up its owner's UID. Anyway, look at the pidentd stuff at ftp://ftp.lysator.liu.se/pub/ident/. --Pete ======= Pete Wenzel === Senior Member, Technical Staff and DNRC ======= == Software Technologies Corp., P. O. Box 661090, Arcadia, CA 91066 == == Phone: 818-445-7000 x311 = http://www.stc.com = FAX: 818-447-0879 == http://PGP.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=pete@stc.com

1 0

Re: Crippled Notes export encryption
by rah＠shipwright.com 17 Dec '03

17 Dec '03

> The problem is that the government refuses to publish the rules. >They make people ask for approval for every piece of code that is >exported. This gives them lots of wiggle room so that they can keep >changing the rules in the face of technical, legal, or political >innovation. In the legal trade, this is what's called an unpromulgated (secret) law. It's a no-no in the philosophy of law, but a nation state can do whatever it wants and still call it "legal". At least our esteemed congress doesn't do retroactive legislation, like the 1KY reich did. Well, we only do tax hikes that way, anyway. We had a revolution to stop crap like in 1776, but we resurrected unpromulgated laws with the advent of the ICC at the end of the last century, and the IRS at the beginning of this one. It's encouraging to note that the ICC has finally been "sunset". Too bad we can't do the same for the IRS, and maybe even State Department. Maybe in some future world of instant full-sensorium telepresence, encrypted, of course... ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:01 1/24/96, Jeff Weinstein wrote: > I don't think that the TLAs are concerned about people at >foreign universities using kerberos. They are much more worried >about mass market products. If we did the same thing as was done >for kerberos, then exported the code to a foreign subsidiary, I >believe that the government would try to make a case against us >that we had participated in a conspiracy to circumvent the >export restrictions. I think the only reason why the NSA has been getting away with this garbage is because they convinced others that challenging the party line will destroy you. I also think that they are bluffing. It is time that some party with financial resources and public credibility makes a test case out of themselves. An educational institution would be suited best. Any takers? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Signing nyms' keys (Was: Report on Portland Cpunks...)
by jim bell 17 Dec '03

17 Dec '03

At 06:49 PM 1/24/96 -0800, Alan Olsen wrote: >Person X commits treasonable act A. All of the persons who are signed on to >his key could be considered to be co-conspirators. The same applies to >nyms. The difficulty with prosecuting nyms is finding the link to the real >world individual. Anyone associated with him/her/it will be considered to >be guilty by reason of key signage or a way of determining who the real >person is... > >The only way I see getting around this is only signing nyms with nyms or >having some sort of zero knowlege proof on a key signing authority. >Something where you can issue some sort of proof to the signing authority >that you are who you say you are without giving any information about your >"real" identity. I know of no foolproof way of doing this... > >I guess we are stuck with the "Web of Guilt"... Doesn't all this stuff give you a headache <G>?

1 0

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 16:07 1/24/96, Peter D. Junger wrote: >The ITAR are regulations, not a law passed by >Congress. The ITAR regulations relating to the export of cryptography >are probably not authorized by any law (as well as being >unconstitutional). The reason for all the silly twists and turns >under the ITAR is that the censors never succeeded in getting any law >forbidding the use of cryptography, and it is not at all certain that >they could get such a law passed. They couldn't get a law passed _then_. Nor did they need to. They also don't need one now, because they have rubber regulations at their disposal. They will be able to get a law passed, should their interpretation of the regulations be thrown out by a court. Passing such a law will be *trivial*. Just put in the exceptions for the powerful special interest groups, such as banks. The vote will be near unanimous, as it always is in similar cases. See Digital Telephony. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Hack Lotus?
by Alan Olsen 17 Dec '03

17 Dec '03

At 01:38 AM 1/25/96 +0000, you wrote: >I have no doubt that enterprising hackers will be able to hack >the international version of lotus Notes to make it as secure >as the domestic version. It is probably just a matter of NOPing >some code. > >The real problem is the 64 bit key in the domestic version. This >conforms to the NIST "standard" for an exportable system. In other >words to allow the international people to have almost non-existant >40 bit security, they have limited domestic users to 64 bit secuity. >The 64 bits keys must be breakable at least in some sense or the limitation >would not be in the NIST "standard". {stuff deleted] Something just came to mind... What if there is not difference between the exportable and non-exportable versions? Could it be that they are *both* GAKed? Maybe I am just being paranoid (or thinking that IBM might just be lazy enough to push out a single version under two versions), but it is something that needs to be determined. Does anyone out there have access to both versions for a comparison? Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Re: Crippled Notes export encryption
by olbon＠dynetics.com 17 Dec '03

17 Dec '03

At 10:49 PM 1/24/96, Lucky Green wrote: >At 19:34 1/24/96, Derek Atkins wrote: >>If I have a function that does something like this: >> >>authenticate (args) >>{ >> ... >> >> des_encrypt (); >> ... >>} >> >>I would have to remove the des_encrypt() call from the authenticate() >>routine before it can be exported... > >What if you replaced it by rot_13 () ? Surely, they can't ban that. And >someone later could just swap all rot_13 () for des_encrypt () > > >-- Lucky Green <mailto:shamrock@netcom.com> > PGP encrypted mail preferred. Better idea: replace des_encrypt() with fuck_the_itar(). Seriously, this just illustrates the idiocy of banning "hooks" in software. How does one define a "hook"? Just providing source code could be defined as providing a hook, since a good programmer could then modify it to do crypto. Also, how about the various kits and tools used to integrate pgp with pine, eudora, etc -- are these not "hooks"? Clay --------------------------------------------------------------------------- Clay Olbon II | olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: finger olbon(a)mgr.dynetics.com Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 "To escape the evil curse, you must quote a bible verse; thou shalt not ... Doooh" - Homer (Simpson, not the other one) ---------------------------------------------------------------------------

1 0

Re: Crippled Notes export encryption
by Rich Salz 17 Dec '03

17 Dec '03

> Seriously, this just illustrates the idiocy of banning "hooks" in software. Yes. That's why an API that supported generic data transforms and that included compression and for non-export encryption would be a useful thing. I have a start toward such an API definition that I will email to anyone who might wanna finish it off. I started doing it around the time that Raph talked about his per-user crypto server. > How does one define a "hook"? Just providing source code could be defined > as providing a hook, since a good programmer could then modify it to do > crypto. Also, how about the various kits and tools used to integrate pgp > with pine, eudora, etc -- are these not "hooks"? They define a hook. They define it on a case-by-case basis. "They" is the Office of Defence Trade Controls, in conjunction with their consulting experts primarily people in the department of Export Control at the NSA. Luckily the ITAR talks about willful violations. /r$

1 0

The cost of breaking RC4 with a 40 bit key.
by norm＠netcom.com 17 Dec '03

17 Dec '03

I think that special hardware to break RC4 would require 256 bytes of registers and only a few hundred control gates. Lets say 5000 transistors per "module". You can put several hundred modules on a chip. Each module can easily do one step in 5 ns. I havn't figured out what the attack would be (known plain text etc.) and hardware to handle that might be more. In mass production the marginal cost of such a chip might be $100. Perhaps trying one key requires 100 steps. I get the cost per key trial as follows: (100 $/chip)(100 steps/trial)(5 (module*ns)/step)/ ((10^9 ns/sec)(10^8 sec/(economic lifetime))(200 modules / chip)) 10^(2+2+.7 - (9+8+2.3)) $/keytrial= 10^(-15+.4) $/keytrial = 2.5*10^(-15) $/keytrial I compute the cost of breaking a 40 bit key as 2.5*10^(-3) $ or one quarter of a cent.

1 0