- cypherpunks-legacy - lists.cpunks.org

Re: punk's not dead!
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

>hello? i'am new on this stuff, help me! Sorry, this a mailing list for Country & Western music. -- Thank you VERY much! You'll be getting a Handsome Simulfax Copy of your OWN words in the mail soon (and My Reply). <Andrew.Spring(a)ping.be> PGP Print: 0529 C9AF 613E 9E49 378E 54CD E232 DF96 Thank you for question, exit left to Funway.

1 0

ANNOUNCE: bruteRC4, 40 bits all swept
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Well we have demonstrated that 40 bit RC4 can be brute forced in around a weeks compute time. (We've also learned a list of thinks to fix for the next attempt as no key was forthcoming :-|, details on why not and what is being fixed to ensure this doesn't happen with a future RC4-40 or with the coming 40+88 SSL brute forceing are given below) The problems are logistic, human error, etc, from a compute time point of view it *really* was a full sweep of a 40 bit keyspace. And on average you would expect to sweep in half this time. The bulk of the work was done in under one weeks compute time, but problems with people forgetting to acknowledge what they swept, meant that 3 or 4 people swept the remaining key space over, which slowed down this announce. Here's the hall of fame, for bits/percentage swept per identifiable contributer (this is tallied by acknowledgement, if you swept but did not acknoweldge quickly enough or at all, that work won't show as the last keyspace was re-swept to hurry things up. The first acknowledgement to be recieved counts, the rest get ignored). bits/40 percent contributer ---------------------------------------------------------------------- 37.2 bits (14.063%) Jon Shekter <jshekter(a)alias.com> 36.4 bits (8.081%) Alvin Brattli <alvin(a)phys.uit.no> 36.1 bits (6.909%) anonymous 36.1 bits (6.836%) Dan Bailey <merzbow(a)ibm.net> 36.1 bits (6.812%) Piete Brooks <Piete.Brooks(a)cl.cam.ac.uk> 35.6 bits (4.688%) Loren Rittle <rittle(a)comm.mot.com> 35.6 bits (4.663%) Adam Back <aba(a)dcs.ex.ac.uk> 35.4 bits (4.102%) Eric Young <eay(a)mincom.oz.au> 35.4 bits (4.004%) Fred <admin(a)dcwill.com> 35.3 bits (3.809%) Martin Hamilton <martin(a)mrrl.lut.ac.uk> 35.2 bits (3.711%) Kevin Wang <kwang(a)blackbox.punk.net> 35.0 bits (3.125%) Richard Martin <rmartin(a)alias.com> 34.7 bits (2.490%) Dan Oelke <droelke(a)aud.alcatel.com> 34.3 bits (1.978%) Branko Lankester 34.0 bits (1.611%) Simon McAuliffe <sai(a)comp.vuw.ac.nz> 34.0 bits (1.562%) Mike Gebis <m-gebis(a)uiuc.edu> 33.8 bits (1.392%) Pat Finerty <zinc(a)zifi.genetics.utah.edu> 33.8 bits (1.367%) <hodgeman(a)csd.uwm.edu> 33.5 bits (1.123%) Panu Rissanen <Panu.Rissanen(a)lut.fi> 33.4 bits (1.001%) Paul Bell <pjb(a)23kgroup.com> 33.3 bits (0.977%) Matt Thomlinson <phantom(a)u.washington.edu> 33.3 bits (0.952%) Will Kinney <kinney(a)colorado.edu> 33.2 bits (0.903%) T J Hardin <hardin(a)cyberspace.com> 33.2 bits (0.879%) Patrick May <pjm(a)ionia.engr.sgi.com> 32.8 bits (0.684%) Stephane Bortzmeyer <bortzmeyer(a)cnam.fr> 32.7 bits (0.635%) anonner 32.5 bits (0.537%) Matt Pauker <mpauker(a)peganet.com> 32.5 bits (0.537%) Ed Kern <ejk(a)digex.net> 32.5 bits (0.537%) Andrew Kuchling <andrewk(a)cst.ca> 32.5 bits (0.537%) <rmtodd(a)mailhost.ecn.uoknor.edu> 32.4 bits (0.513%) <somogyi(a)digmedia.com> 32.3 bits (0.488%) Jon Baber <jbaber(a)mi.leeds.ac.uk> 32.2 bits (0.439%) Bryce Boland <bryce(a)cybernet.co.nz> 32.0 bits (0.391%) Thad Beier <thad(a)thresher.uucp.netcom.com> 32.0 bits (0.391%) Per Stoltze <stoltze(a)fysik.dtu.dk> 32.0 bits (0.391%) Glenn Powers <gpowers(a)bradley.edu> 32.0 bits (0.391%) <janzen(a)idacom.hp.com> 31.8 bits (0.342%) Mike Bailey <bailey(a)computek.net> 31.7 bits (0.317%) Robert Hayden <hayden(a)krypton.mankato.msus.edu> 31.7 bits (0.317%) John Limpert <johnl(a)radix.net> 31.6 bits (0.293%) Opus 31.6 bits (0.293%) Mark Rogaski <rogaski(a)phobos.lib.iup.edu> 31.6 bits (0.293%) <josh(a)silicon.net> 31.5 bits (0.269%) Michael Bacon <mbacon(a)dfw.net> 31.3 bits (0.244%) Jim Gillogly <jim(a)acm.org> 31.3 bits (0.244%) David Zuhn <zoo(a)armadillo.com> 31.2 bits (0.220%) Russell Ross <rross(a)sci.dixie.edu> 31.2 bits (0.220%) Don Kitchen <don(a)cs.byu.edu> 31.0 bits (0.195%) Scott Renfro <csylvix!srenfro(a)cuok.cameron.edu> 31.0 bits (0.195%) Planar <Damien.Doligez(a)inria.fr> 30.8 bits (0.171%) Matt <panzer(a)dhp.com> 30.8 bits (0.171%) Joe Thomas <jthomas(a)access.digex.net> 30.8 bits (0.171%) Adrian Thomson <a.thomson(a)nexor.co.uk> 30.6 bits (0.146%) Michael Axelrod <mja(a)cacs.usl.edu> 30.6 bits (0.146%) Mark Eichin <mark(a)kitten.gen.ma.us> 30.6 bits (0.146%) Jason Burrell <jburrell(a)crl.com> 30.3 bits (0.122%) Will Ware <wware(a)world.std.com> 30.3 bits (0.122%) Kevin Maher <kmaher(a)ucsd.edu> 30.3 bits (0.122%) Josh Sled <jsled(a)cello.gina.calstate.edu> 30.3 bits (0.122%) Checkered Daemon <cdaemon(a)goblin.punk.net> 30.3 bits (0.122%) Andrew Roos <andrewr(a)realtime.co.za> 30.0 bits (0.098%) Jason Weisberger <jweis(a)primenet.com> 30.0 bits (0.098%) <pdlamb(a)iquest.com> 30.0 bits (0.098%) <matt(a)comp.vuw.ac.nz> 29.6 bits (0.073%) Mark Grant <mark(a)unicorn.com> 29.6 bits (0.073%) Lou Poppler <lwp(a)mail.msen.com> 29.6 bits (0.073%) Edwin de Graaf <graaf(a)iaehv.nl> 29.6 bits (0.073%) David Conrad <conrad(a)detroit.freenet.org> 29.6 bits (0.073%) Dan Tauber <dat(a)netcom.com> 29.6 bits (0.073%) Alexandra Griffin <acg(a)kzin.cen.ufl.edu> 29.6 bits (0.073%) <pkronenw(a)erc.cat.syr.edu> 29.6 bits (0.073%) <ghazelwo(a)cs.oberlin.edu> 29.0 bits (0.049%) Stuart <stu(a)nemesis.wimsey.com> 29.0 bits (0.049%) Pekka Riiali <Pekka.Riiali(a)lut.fi> 29.0 bits (0.049%) Jeffrey Ollie <jeffo(a)noc.netins.net> 29.0 bits (0.049%) James Hightower <jamesh(a)netcom.com> 29.0 bits (0.049%) Hadmut Danisch <danisch(a)ira.uka.de> 29.0 bits (0.049%) Bob Snyder <rsnyder(a)janet.advsys.com> 29.0 bits (0.049%) <stevet(a)smeg.net4.io.org> 28.0 bits (0.024%) Sang Hahn <sghahn(a)math1.kaist.ac.kr> 28.0 bits (0.024%) Roy Silvernail <roy(a)cybrspc.mn.org> 28.0 bits (0.024%) Ollivier Robert <roberto(a)keltia.freenix.fr> 28.0 bits (0.024%) Lucky Green <shamrock(a)netcom.com> 28.0 bits (0.024%) L Futplex McCarthy <futplex(a)pseudonym.com> 28.0 bits (0.024%) Jeff Licquia <jalicqui(a)prairienet.org> 28.0 bits (0.024%) J Francois <frenchie(a)magus.dgsys.com> 28.0 bits (0.024%) Brian LaMacchia <bal(a)mit.edu> 28.0 bits (0.024%) Andy Brown <a.brown(a)nexor.co.uk> 28.0 bits (0.024%) Adam Morrison <adam(a)math.tau.ac.il> 28.0 bits (0.024%) <mikew(a)nersc.gov> ---------------------------------------------------------------------- 40.0 bits (100.000%) 89 cpunks + x * anonners in 1 weeks compute Report is on the brute-rc4.html page also: http://dcs.ex.ac.uk/~aba/brute-rc4.html Problems. --------- But, briefly these are the things which may be responsible for the failure to find a key: a) We weren't sure if we had a known plaintext / ciphertext pair This due to lack of Microsoft Access specs, this was known from the begining, but we thought we'd try it and see. b) Eeek! There was a bug in bruterc4.c for some time which affected Alphas, and possibly other BSD machines. This meant keyspace wasn't being searched when the -v option was used. c) Some people reported that their browser / uuencode software combination meant that cutting and pasting of the uuencode plain text and cipher text files was silently failing due to extra spaces inserted by a flawed pasting operation. d) Human error - it is possible that some keys were unswept - by accident. e) Malicious humans - we don't know, but think this was not a problem. Solutions. ---------- Proposed solutions for future brute forcing efforts (such as the upcoming SSL effort), for respective points above: a) Need better spec of MA, or more experimentation / reverse engineering. For SSL this is not a problem as the SSL specs are openly available and very detailed. b) Write bug free software :-) Test more rigourously on multiple unixs and architectures with a brief test run. c) Use hex numbers in a config file. Ie don't use uuencode on web page. d) We're going to have the programs (bruteRC4.c and bruteSSL.c) produce a checksum on completion. Acknowledgements of swept keyspace must be with checksum. Crude check to reduce chances of mistyped big hex nums. Represent the key space as a 4 digit hex number like this: 1a23, in terms of 24 bit keyspaces, and represent keyspace to sweep in terms of numbers of those, lots of people had difficulty reasoning in log base2 for bits. e) Do nothing yet. If we get lots of compute and it proves to be a problem perhaps implement some redundancy into the system. Coming soon brute force attempt on Hal Finney's brute of 40+88bit SSL. Watch this space, several cypherpunks are hard at work optimising their bruteSSL.c code, and also writing farming software via a system of servers connected via sockets. The WWW page doler will still be available for those with out direct IP. Hal Finney's SSL challenge is here: http://www.portal.com/~hfinney/sslchal.html More on SSL later, but we hoped to give the SSL one a wider announce in sci.crypt, and see how *fast* we can brute 40 bit keyspace. Hope to see your compute in the brute SSL effort when it is announced, Adam -- HAVE *YOU* EXPORTED A CRYPTO SYSTEM TODAY? --> http://dcs.ex.ac.uk/~aba/rsa/ --rsa--------------------------------8<------------------------------------- #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) -------------------------------------8<------------------------------------- TRY: echo squeamish ossifrage | rsa -e 3 7537d365 | rsa -d 4e243e33 7537d365

1 0

Re: cypherpunk "Zen" victories
by Doug Hughes 17 Dec '03

17 Dec '03

Vladimir Z. Nuri scribbled: > >I was recently marvelling at how much the "cypherpunk agenda" >is being advanced even in light of what would seem to be setbacks. >Particularly in the area of anonymous remailers. We now have a very >major article on remailers and Julf's setup in the NYT that portrays >them in an unbiased, unhysteria-stricken mode. Also in the article, >it quotes the police as regretting their falling victim to >Scientology manipulation and investigating the remailer "without >cause". A major officer is quoted as saying, roughly, "we are >going to need a crime before we investigate in the future". > Could you provide a page, date, and title for this article? I would like to read it but don't get a daily subscription. Muchas gracias Doug Hughes Engineering Network Services doug(a)eng.auburn.edu Auburn University

1 0

Re: "Hey Phil! Stop telling people *not* to use PGP!" (plus: "help me with my PGP problems!") (fwd)
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 19 Jul 1995, Bryce Wilcox wrote: [lots of really really good stuff deleted, because I really don't have anything good to add to it] > I am fond of saying that we PGP enthusiasts have two choices ahead of us > within a couple of years: either 5,000 enthusiasts using PGP with > MAXIMAL SECURITY at all times, or 5,000 enthusiasts with MAXIMAL > SECURITY and 10,000,000 computer-illiterate e-mail users using PGP with > push-button interfaces and multi-user remote systems. I said it last week, and I'll say it again. From a sociological standpoint, it's those 10,000,000 computer-illiterate e-mail users that we need to focus all of our efforts towards. Those 5,000 literate people we really don't have to care about. I will say, and this makes for interesting commentary, over the last week or so, I've released those simple scripts for Pine (and today for Tin) that integrate digital signing fairly seamlessly with those programs. I've received about 200 requests since Monday from people asking where to find PGP, asking about similiar scripts for Windoze or Dos or Mac, or thanking me for providing an easier way to do digital signatures. And that was a simple sh script! Imagine if some people with REAL writing ability worked on some programs... Pushing for wide use of digital signatures is one way to get PGP to be a "household" name for people writing on the net. I now sign everything I post and mail. It gets people's attention and interest. Interest leads to use. > The important thing, of course, is the easy-to-use, e-mail-integrated > software (version 3.0, I hope?), but it would also help if Zimmermann's > PGP Doc didn't tell those computer-illiterates to either "become enthusiasts > or don't use it." I think the politics of PGP is stagnated at about two years ago or so. The demographics are no longer accepting to long technical rants. Today's generation of net.user doesn't need 100% security 100% of the time, what they need is "good" security when they want it, but in a way that they don't have to think much about. Sorry if I'm ranting again abotu everything I said last week. I'm in the process of doing research on social evolution using the net as an example of accelerated cultural change. I'm kinda in a specific mindset right now :-). -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.1 iQCVAwUBMA1WVjokqlyVGmCFAQEtJgP+JPbrM4KSQGiIznlnghYs1FEizGGhHLJZ +cSz36jatErJ/kFOEsNSwLz0crjdyHtv2v3ojsExTQVgQxzS/U60zwNR+gPxwdr7 bpIoEaZwGtANmsrkUtTqIwEncs7WPAF08ZbbaZpeB58qcvnpAergshrJya7gtOSM Wp8BqFcU+84= =TOLZ -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> Cthulhu Matata \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> hayden(a)krypton.mankato.msus.edu \/ Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden

1 0

Adding
by netchaos＠ix.netcom.com 17 Dec '03

17 Dec '03

I would like to be added to your list.

1 0

Re: "Hey Phil! Stop telling people *not* to use PGP!" (plus: "help mewith my PGP problems!") (fwd)
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Robert A. Hayden writes: > I said it last week, and I'll say it again. From a sociological > standpoint, it's those 10,000,000 computer-illiterate e-mail users > that we need to focus all of our efforts towards. Those 5,000 > literate people we really don't have to care about. [...snip...] > Imagine if some people with REAL writing ability worked on some > programs... [...snip...] > I think the politics of PGP is stagnated at about two years ago or > so. The demographics are no longer accepting to long technical > rants. Today's generation of net.user doesn't need 100% security > 100% of the time, what they need is "good" security when they want > it, but in a way that they don't have to think much about. This has been hashed over on the list many, many times in the past. I suspect there are competent programmers out there who want to write easy-to-use interfaces for PGP (I know at least one), but there are problems. To write a good GUI interface (with proper key-management features) on Windows or Mac, for instance, you need to have access to PGP's internal crypto routines as well as the routines for reading and writing PGP messages and key certificates. The problem is that the PGP 2 code does not have the internal 'core' routines separated from it's command-line interface. The answers are to either shell out to PGP (which, AFAIK, is what every interface except MacPGP does), hack the PGP 2 code, or use PGPTools. Shelling out to PGP isn't going to cut it for a slick GUI package, especially if you want to have a decent key-management interface. You could do it, but it will be slow and kludgy and you will have to change it all when PGP 3 comes out. Hacking PGP would be a major effort. Additionally, there is risk of introducing a subtle flaw in the crypto routines. However, the main killer is that PGP 3 is going to have a brand new key-ring format along with many other enhancements, fixes, and other changes to the crypto code. All of the work will have to be done again to bring the interface up to date when PGP 3 is released, which could be within 6 months (who knows?). PGPTools is buggy and not supported. Any effort to bring PGPTools up to a stable level would likely be thrown away when PGP 3 is released. The real solution is that PGP 3 will have all of it's core routines in a separate library with a stable API specifically for the purpose of writing slick interfaces. So basically all of the would-be PGP interface developers are waiting for beta releases of the library. Unfortunately, this has been the situation for almost two years now. By now the PGP 2 code could have been completely turned into a library with a clean API and no command-line interface remnants, but developers have been discouraged by the promise of PGP 3 coming out 'RSN'... andrew ...still waiting for pgp 3 news...

1 0

cfs on linux - rpcgen broken in slackware distribution!
by zinc 17 Dec '03

17 Dec '03

cpunks, yesterday i requested some help compiling cfs on my linux system. well, after some serious help i got it to work. the problem was that my copy of rpcgen was broken. this was the copy installed with the slackware distribution. damn, this is some sort of never ending contest between my sanity and the slackware distribution! -pat patrick finerty = zinc(a)zifi.genetics.utah.edu = pfinerty(a)nyx.cs.du.edu U of Utah biochem grad student in the Bass lab - zinc fingers + dsRNA! ** FINGER ME for my pgp public key ** crypto for the masses! zifi runs LINUX 1.2.11 -=-=-=WEB=-=-=-> http://zifi.genetics.utah.edu

1 0

Re: "Hey Phil! Stop telling people *not* to use PGP!" (plu
by jfmesq＠ibm.net 17 Dec '03

17 Dec '03

>I've received about 200 requests since Monday from people asking where to >find PGP, asking about similiar scripts for Windoze or Dos or Mac.... If anyone asks about OS/2, a good script is available at ftp.gibbon.com. FWIW. --JFM

1 0

EVENT: NY-only, non-NY folks ignore (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=================================================================93======= + ^ + | Ray Arachelian | Amerika: The land of the Freeh. | \-_ _-/ | \|/ |sunder(a)escape.com| Where day by day, yet another | \ -- / | <--+-->| | Constitutional right vanishes. |6 _\- -/_ 6| /|\ | Just Say | |----\ /---- | + v + | "No" to the NSA!| Jail the censor, not the author!| \/ | =======/---------------------------------------------------------VI------/ / I watched and weeped as the Exon bill passed, knowing that yet / / another freedom vanished before my eyes. How soon before we see/ /a full scale dictatorship in the name of decency? While the rest / /of_the_world_fights_FOR_freedom,_our_gov'ment_fights_our_freedom_/ ---------- Forwarded message ---------- Date: Tue, 18 Jul 1995 01:12:41 -0400 (EDT) From: She Devil With A Modem! <redsonja(a)computel.com> To: sunder(a)escape.com Subject: EVENT: NY-only, non-NY folks ignore (fwd) Also Sprach Shabbir J. Safdar: >From shabbir(a)panix.com Mon Jul 17 23:51:37 1995 Date: Mon, 17 Jul 1995 23:45:32 -0400 From: "Shabbir J. Safdar" <shabbir(a)panix.com> Message-Id: <199507180345.XAA05923(a)panix3.panix.com> To: stop314(a)panix.com Subject: EVENT: NY-only, non-NY folks ignore ====================================================================== Campaign to stop the 1995 Communications Decency Act FREE NEW YORK WORKSHOP We encourage you to forward this to friends DO NOT REDISTRIBUTE AFTER July 22, 1995 ______________________________________________________________________ WORKSHOP DETAILS What: A free workshop on current online censorship legislation and the viable alternatives. When: Saturday July 22nd, 1-4pm Where: ACLU offices at Times Sq (132 West 43rd St at 6th Ave) Who: Everyone (teachers, librarians, businesses, everyone!) Agenda: Crash Course on the First Amendment and the New Censorship Legislation Questions and Answers About How the CDA Affects You and Your Business How to Lobby Your Representative Plans for the New York Lobby Day Against the CDA: Wednesday, July 26th ______________________________________________________________________ WHY YOU SHOULD ATTEND THE WORKSHOP Are you interested in seeing our government become less intrusive, not larger, and less involved in personal decisions about what you read? Do you believe that Constitutionally-protected speech should not be regulated by the FCC (or any other Federal agency)? Do you believe that computer networks are a tremendously powerful tool for giving many more people in our society a voice, bypassing traditional forms of media? If you find the above three questions compelling, you should be concerned about the 1995 Communications Decency Act (CDA). Having already passed the Senate, the CDA is headed for the House and has favorable odds of passing there as well if nothing is done. The CDA was passed by the Senate 84-16. It was voted on by many legislators who not only never use a computer, but have never read email, logged onto a BBS, read Usenet news, or seen a Web page. They were simply voting with their gut reaction, unaware that they were disastrously affecting the future of American expression and the most explosive industry seen in the last ten years. It *doesn't* have to be that way. We as New Yorkers can't expect our elected officials to vote out of a vacuum. We need to tell our Representatives that online systems are a new medium, not the same as a telephone, nor the same as television. They need to understand that the Internet and bulletin boards aren't simply Dial-A-Porn lines, or adult cable channels. However they won't come to these conclusions themselves; they need your help. Come to this free workshop and learn what you can do to help ensure that online communication isn't restricted unreasonably. _______________________________________________________________________ SUPPORTING ORGANIZATIONS American Civil Liberties Union, College Art Association, Creative Coalition, Feminists for Free Expression, and the Voters Telecommunications Watch _______________________________________________________________________ FOR MORE INFORMATION For more information about the CDA Workshop on July 22nd, contact: Shabbir Safdar, Voters Telecomm Watch Email: vtw(a)vtw.org (718) 596-7234 Ann Beeson, American Civil Liberties Union Email: beeson(a)aclu.org (212) 944-9800 x788 For more information about the CDA, see: Web Sites URL:http://www.panix.com/vtw/exon/ Gopher Archives: URL:gopher://gopher.panix.com/11/vtw/exon Email: vtw(a)vtw.org (put "send cdafaq" in the subject line) ________________________________________________________________________ LIST OF PARTICIPATING ORGANIZATIONS In order to use the net more effectively, several organizations have joined forces on a single Congressional net campaign to stop the Communications Decency Act. American Civil Liberties Union * American Communication Association * American Council for the Arts * Arts & Technology Society * Association of Alternative Newsweeklies * biancaTroll productions * Californians Against Censorship Together * Center For Democracy And Technology * Centre for Democratic Communications * Center for Public Representation * Citizen's Voice - New Zealand * Computer Communicators Association * Computel Network Services * Computer Professionals for Social Responsibility * Cross Connection * Cyber-Rights Campaign * CyberQueer Lounge * Dutch Digital Citizens' Movement * Electronic Frontier Canada * Electronic Frontier Foundation * Electronic Frontier Foundation - Austin * Electronic Frontiers Australia * Electronic Frontiers Houston * Electronic Frontiers New Hampshire * Electronic Privacy Information Center * Feminists For Free Expression * First Amendment Teach-In * Florida Coalition Against Censorship * FranceCom, Inc. Web Advertising Services * Friendly Anti-Censorship Taskforce for Students * Hands Off! The Net * Human Rights Watch * Inland Book Company * Inner Circle Technologies, Inc. * Inst. for Global Communications * Internet On-Ramp, Inc. * Joint Artists' and Music Promotions Political Action Committee * The Libertarian Party * Marijuana Policy Project * Metropolitan Data Networks Ltd. * MindVox * National Bicycle Greenway * National Campaign for Freedom of Expression * National Coalition Against Censorship * National Gay and Lesbian Task Force * National Public Telecomputing Network * National Writers Union * Oregon Coast RISC * Panix Public Access Internet * People for the American Way * Rock Out Censorship * Society for Electronic Access * The Thing International BBS Network * The WELL * Voters Telecommunications Watch (Note: All 'Electronic Frontier' organizations are independent entities, not EFF chapters or divisions.) ________________________________________________________________________ End Alert ======================================================================== -- ()()()()() All that matters is that ]{ |BTCOMH|-| Eileen Tronolone -===========================]*\\\{O | (tm) | | System Administrator two stood against many... ]{ |______|-/ redsonja(a)computel.com

1 0

Re: Is it legal for commercial companies to use PGP?
by tim werner 17 Dec '03

17 Dec '03

>From stewarts(a)ix.netcom.com Tue Jul 18 02:51:50 1995 >Date: Mon, 17 Jul 1995 23:52:35 -0700 >At 09:07 PM 7/17/95 -0400, tim werner wrote: >>>... I was talking to one of the sys admins at >>>A-B, and he said that we weren't allowed to use PGP to encrypt our mail, >>>because Viacrypt owned the commercial rights. >Actually, it's less clear than that. >Selling software containing the code is pretty clearly commercial. >Non-commercial messages from your personal non-business machine are >clearly non-commercial. Providing a service of encrypting and decrypting >messages for people for money sounds like it's _very_ probably commercial. >Encrypting and decrypting messages to/from your business that deal with money >are a very gray area. Maybe "commercial company" is the wrong expression. All I meant was that my company is not non-profit, or a university, or a government organization. It is an engineering firm. What I have in mind is nothing to do with a commercial use of encryption per se. If they decided to put encryption into a product, that would be something else entirely. I doubt they would ever be using it to accept payment for the stuff they sell, although I don't really know much about the marketing aspect of the business. Basically, I have two potential uses for it: 1) I have some email pen-pals that I would like to be able to use PGP to talk with. All my other accounts (freenet, school) have mail forwarded to what I think of as my email "home address", which is my work address. I would like to use that work account to process my email. Is it legal to use PGP 2.6.2 for this purpose? I'd also like to be able to tell fellow workers that they can use it, and show them how. 2) It's entirely likely that people within the company may wish to get into the habit of transmitting company data in encrypted form. This is not a question of incorporating the encryption technology into a product, or even into the sale of a product -- it's just a question of keeping intra-company information transfers private. The first is the one I'm really concerned with. The second would be sort of a natural extension that, if legal, would be nice. I can't imagine that these uses are subject to the ViaCrypt license, but I need some reassurance/ammunition in order to be a little more open about getting it installed on the machines in my department. thanks, tw -- Well, Bust My Britches! Eggs Almondine and a Bottle of Beaujolais!

1 0