- cypherpunks-legacy - lists.cpunks.org

Re: gephardt slams crypto regs
by Bill Frantz 17 Dec '03

17 Dec '03

>At 06:16 PM 8/24/97 -0700, Vladimir Z. Nuri wrote: >>Encryption is vital to the Net >> BY RICHARD A. GEPHARDT > >Thanks for posting this! My hat's off to Senator Gephardt for >coming out in favor of economic and personal freedom! > >(Of course, it's not like I'd set my hat _down_ where he could >steal it or check its national origin label :-) Dick's still a >statist protectionist, but even if he's doing the right thing >just to annoy the right-wing statists like Clinton, it's a good start!) I also thank Vladimir for posting the article. I was going to post a summary, but I found myself buried under a kilomessage or so of back email after my trip to Switzerland. I think this article is principally interesting because Senator Gephardt is the Democratic leader in the House. It seems to indicate considerable disarray in the administration on what our crypto policy should be. As the ever optimist, this article, along with Dorothy Denning's new stand, and the Burnstein decision indicates that the forces of crypto repression are in retreat. GO TEAM! ------------------------------------------------------------------------- Bill Frantz | The Internet was designed | Periwinkle -- Consulting (408)356-8506 | to protect the free world | 16345 Englewood Ave. frantz(a)netcom.com | from hostile governments. | Los Gatos, CA 95032, USA

1 0

ASK ToolKit Clarifications
by Myron Lewis 17 Dec '03

17 Dec '03

I thought I would write one answer to all instead of getting embroiled in a number of individual engagements. I know that the claims we make for the ASK ToolKit(TM) sound a little too good to be true. In fact, someone I have been talking to for a while about other subjects and who I thought respected my views told me that "If it sounds too good to be true, it probably is-- too good to be true. " But I have been on the same end of other controversial products and in the final analysis was vindicated because the product worked as advertised -- even better. I wouldn't lend my name to a "Snake-Oil" product. I don't need that kind of aggravation -- I'm too old. Let me clarify what the toolkit is and what it isn't. Unfortunately, I cannot talk about those things that are being patented, but maybe in the near future. The ASK ToolKit does not do encryption. It only provides keys on demand for encryption. These keys are synchronized across a communication link without the keys or information about them being given out. The keys are both random and unpredictable -- meaning that you will not be able to deduce what the next key is even if you have any key that was used in the past. The system does not depend on the secrecy of internal algorithms for security. The ASK ToolKit does not "manage keys", it just generates them on demand. The developer can do what he/she wants with them. To me, managing keys means distributing them to the appropriate users (with authorization) or moving them around outside of an application. That never needs to happen in an application using a symmetric system. The ASK ToolKit can be used in a Public-Private system, but that's a waste. We are not blindly implying that applications using the ASK ToolKit are unbreakable. However, the toolkit provides the means for intrusion detection and prevention. We know of no method this simple that does that. The toolkit provides a number of bells and whistles to allow the developer of an appliction using it to do many things like change keys as often as wanted -- even every bit (not practical) or re-synchronize (which is different from re-initializing). It also allows the last session information to either be stored in encrypted form on the machine or removed to a portable medium. The ToolKit does not provide the initial strong authentication needed to start the process off. There are many very good methods for doing this, so why should we bother. These range from formal encrypted methods like Diffie-Hellman to simple things like telephone calls, distributing floppy disks to users, filling out online applications where the other side already has critical information about the user, etc. One thing that these shared secret methods have going for them is that they can occur spontaneously -- random in time. That is one of the best means of security. The use of a shared secret with an application containing the ASK ToolKit is only necessary once for initialization. After the first Master Recovery Key (which can be thrown away immediately), there is no relationship to the shared secret and therefore the shared secret needn't remain secret. Short of real clairvoyance, there is no method of determining to 100% certainty that someone is who they say they are. All methods suffer from this first-time syndrome. It's what comes next that is important. Even that first CA needs to be authenticated. The ToolKit just cuts out the subsequent CA fetching process which for large systems of users who need to communicate often (more than once) can be overwhelming. The claims we make are not so much for the ToolKit itself but for the applications that we envision can be developed given the ingenuity of the developer. We invite everyone who has a genuine interest in possibly using the ToolKit, and who is not just tossing flame about, to contact us with their questions. If you are a responsible consultant or represent a responsible organization and can sign an NDA, then we would be glad to fill in the details. Myron Lewis President KeyGen Corporation The Key to Secure Communications(TM)

4 4

Re: Monkey Wrench into the works
by Feanor 17 Dec '03

17 Dec '03

On Aug 27, 10:44, Robert Hettinga wrote: } Subject: Monkey Wrench into the works > > --- begin forwarded text > > > Reply-To: "Myron Lewis" <mrlewis(a)keygen.com> > From: "Myron Lewis" <mrlewis(a)keygen.com> > To: "Robert Hettinga" <rah(a)shipwright.com> > Subject: Monkey Wrench into the works > Date: Tue, 26 Aug 1997 22:25:55 -0400 > MIME-Version: 1.0 > X-Priority: 3 > X-MSMail-Priority: Normal > X-MimeOle: Produced By Microsoft MimeOLE Engine V4.71.1008.3 > > We communicated today about the DCSB luncheon at the Harvard Club and I have > been looking at some of the e$pam traffic. I am somewhat amused because our > company is about to throw a monstrous perturbation into Public-Private Key > encryption. > > We invite you and everyone on the list (Please send this invitation out to > them as the info on how to do that didn't come through.) to visit the KeyGen > webpage, www.KeyGen.com and learn about Automatic Synchronized > KeyGeneration(TM). If you think you recognize it as something you have seen > before, you're close but wrong. > > We are obviously biased, but we feel strongly and so do many others, that > ASK will solve many of the security problems presently under discussion. In > time, it will probably sink Key Management and Certificate Authorities. It won't change dick all as long as it's got that nice (TM) beside it, which I assume means it's not source available or open to peer review. Please, no-one trust proprietary algs in the arena. <bzzzt> Sorry, try again.

1 0

Re: Socio-Economic Cults (Re: Cypherpunk Cults)
by John Smith 17 Dec '03

17 Dec '03

Jonathan Wienke: >It really isn't that hard to figure out that shooting a guy breaking >through your bedroom window at 3 AM with a crowbar and a TEC-9 is a Good >Thing, (at least if you value your continued existence, and that of your >family) while shooting someone giving you the finger on the way in to work >is a Bad Thing. In the second case, there is no threat to your life >involved, so there is no reason to kill anyone. In the first case, there >is. Is this brain surgery? Maybe not, but how about the suggestion earlier to shoot people who are painting graffiti on your property? What happens if someone gets shot in that situation, or in some other gray area? How would you propose to handle claims that a shooting was unjustified. Mob justice? Get enough people in the streets to storm the house of the shooter? Keep in mind that the majority of people may have views about the proper use of force which differ from yours and mine. Consider the roundup of Japanese Americans during WWII. Yes, a government action, but one with popular support. A Japanese man holes up in his house and shoots at those who try to take him away. A Caucasian man outside shoots back, fearing that the Japanese is a spy, whose information will lead to Japanese victory in the war. Both men are shooting, both fear for their lives. And in each case, the fear could arguably be justified, based on the information available to each man at the time. How does your simple rule solve this case? "John ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

6 5

Re: Stewart Baker on Bernstein encryption decision (fwd)
by Blanc 17 Dec '03

17 Dec '03

Declan McCullagh wrote: >I share part of the blame here; I forwarded Baker's message to >cypherpunks. Now, you shouldn't blame the messenger. >I should point out that Baker is an interesting fellow. Check out his >article on Japan's crypto export ctrls in last Oct? Wired. He currently >represents Netscape; he's one of two lawyers in DC who does. He's an interesting fellow, all right; it can't be denied that his current position is a rather opportunistic conversion from his previous attitude. Like Bill Frantz said, it "indicates that the forces of crypto repression are in retreat." What would be *really* interesting is to know the reasons, their own explanations, for this. I mean, they can't expect that no one will notice the change. .. Blanc

1 0

SAFE D.O.A.
by John Young 17 Dec '03

17 Dec '03

29 August 1997, C4I News: A key member of the House National Security Committee (HNSC) said that a bill loosening export controls on U.S. encryption technology is "dead on arrival." HNSC has until September 12 to issue recommendations on the bill. "I'm not going to support something being ramrodded down our throats," Rep.Curt Weldon said in a recent telephone interview. Weldon said Goodlatte's bill will not reach the House floor because of Rep. Solomon's opposition. Unlike NSA, Weldon is unsure whether "key recovery" is an answer to the security issue posed by loosening export restrictions on encryption. "I don't like the idea of government controlling business," Weldon said. ----- Full story: http://jya.com/safe-doa.txt

1 0

Court Allows Unlicensed Crypto Export
by John Gilmore 17 Dec '03

17 Dec '03

COURT ALLOWS UNLICENSED CRYPTO EXPORT Professor Bernstein can publish soon San Francisco, August 29, 1997 - Yesterday a federal judge here denied a government motion to silence mathematician Daniel Bernstein. On August 25, District Court Judge Marilyn Hall Patel declared the Commerce Department's cryptography regulations unconstitutional. Judge Patel also issued an injunction to prohibit prosecution of Prof. Bernstein and others who publish Prof. Bernstein's work. In response to an emergency motion from the government on August 28, Judge Patel ruled that most of the injunction would be put on hold until the 9th Circuit Court of Appeals has had a chance to review Prof. Bernstein's case. However, part of the injunction will remain in effect: after September 8, Prof. Bernstein will be free to publish his Snuffle 5.0 software on the Internet without fear of prosecution. Snuffle 5.0 is at the heart of Prof. Bernstein's lawsuit against the government. Scanned images of the Government's emergency request for a stay are available from EFF's online archives at: http://www.eff.org/pub/Privacy/ITAR_export/Bernstein_case/ Legal/970827_stay_motion.images Prof. Bernstein's opposition to the stay is at: http://www.eff.org/pub/Privacy/ITAR_export/Bernstein_case/ Legal/970827_stay.opposition Full text of the lawsuit and other paperwork filed in the case is available from EFF's online archives at: http://www.eff.org/pub/Privacy/ITAR_export/Bernstein_case/ Press Contacts: Shari Steele, Staff Attorney, Electronic Frontier Foundation 301/375-8856, ssteele(a)eff.org John Gilmore, Founding Board Member, EFF 541/354-6541, gnu(a)toad.com Cindy Cohn, McGlashan & Sarrail 415/341-2585, cindy(a)mcglashan.com

1 0

Court Allows Unlicensed Crypto Export
by Cindy Cohn 17 Dec '03

17 Dec '03

>X-Authentication-Warning: toad.com: Host localhost [127.0.0.1] didn't use HELO protocol >To: bernstein-announce(a)toad.com, eff-board(a)eff.org, eff-staff(a)eff.org >Subject: Court Allows Unlicensed Crypto Export >Date: Fri, 29 Aug 1997 17:21:45 -0700 >From: John Gilmore <gnu(a)toad.com> >Sender: owner-bernstein-announce(a)toad.com >Reply-To: John Gilmore <gnu(a)toad.com> > > COURT ALLOWS UNLICENSED CRYPTO EXPORT > Professor Bernstein can publish soon > >San Francisco, August 29, 1997 - Yesterday a federal judge here denied a >government motion to silence mathematician Daniel Bernstein. > >On August 25, District Court Judge Marilyn Hall Patel declared the >Commerce Department's cryptography regulations unconstitutional. >Judge Patel also issued an injunction to prohibit prosecution of Prof. >Bernstein and others who publish Prof. Bernstein's work. > >In response to an emergency motion from the government on August 28, >Judge Patel ruled that most of the injunction would be put on hold >until the 9th Circuit Court of Appeals has had a chance to review >Prof. Bernstein's case. However, part of the injunction will remain >in effect: after September 8, Prof. Bernstein will be free to publish >his Snuffle 5.0 software on the Internet without fear of prosecution. >Snuffle 5.0 is at the heart of Prof. Bernstein's lawsuit against the >government. > >Scanned images of the Government's emergency request for a stay >are available from EFF's online archives at: > http://www.eff.org/pub/Privacy/ITAR_export/Bernstein_case/ > Legal/970827_stay_motion.images > >Prof. Bernstein's opposition to the stay is at: > http://www.eff.org/pub/Privacy/ITAR_export/Bernstein_case/ > Legal/970827_stay.opposition > >Full text of the lawsuit and other paperwork filed in the case is >available from EFF's online archives at: > http://www.eff.org/pub/Privacy/ITAR_export/Bernstein_case/ > >Press Contacts: > > Shari Steele, Staff Attorney, Electronic Frontier Foundation > 301/375-8856, ssteele(a)eff.org > > John Gilmore, Founding Board Member, EFF > 541/354-6541, gnu(a)toad.com > > Cindy Cohn, McGlashan & Sarrail > 415/341-2585, cindy(a)mcglashan.com > > ************************ Cindy A. Cohn McGlashan & Sarrail, P. C. 177 Bovet Road, 6th Floor San Mateo, CA 94402 (415) 341-2585 (tel) (415)341-1395 (fax) Cindy(a)McGlashan.com http://www.McGlashan.com

1 0

Re: ncash? (was Re: pgp details)
by Feanor 17 Dec '03

17 Dec '03

On Aug 26, 13:47, Mike wrote: } Subject: Re: ncash? (was Re: pgp details) > Lucky Green wrote: > >It doesn't provide payee anonymity, coins are neither divisible nor > transferable, why do you bother? > > Could it be... because Chaum won't license? That's not nescessary, actually. All you need is for the mint to put _no_ information at with the coin except it's serial number and a signatrue (possibly a timestamp as well). Voila, anonymity. I was thinking of implementing a low-cost server ofthis type, but there's the trust problem: this nym is relatively new... > Any ecash is better than none, and until Chaum's patent expire we > probably won't have an ecash system with all the bells and whistles. > Just consider that Mark Twain has been up for two years and they still > don't have a client that implements crash recovery (recover your money > if your disk crashes)! At last count they had all of 32 merchants signed > up. There might be other reasons for this: have you looked at their _fees_??? Holy crap! That's the only reason I don't have an account. They're charging top dollar for every aspect of a system that has it's only overhead in minimal amounts of CPU time. I was thinking of having my server charge only on deposit of real money and only a tiny amount (like 1-2%). I.e. no charge at all to open an account to recieve money...

3 3

DigiCash issuers
by Zooko Journeyman 17 Dec '03

17 Dec '03

Feanor wrote: >There might be other reasons for this: have you looked at their _fees_??? >Holy crap! That's the only reason I don't have an account. They're charging >top dollar for every aspect of a system that has it's only overhead in minimal >amounts of CPU time. You might be a bit behind the times on this issue. Recently MTB announced new lower fees: http://www.marktwain.com/fee.html Are these the ones you consider excessive? Note that if you consider the new fees to be reasonable, then you are now obliged to open account as per your publically posted exclamation quoted above. :-) Also check out Advance Bank in Australia: http://www.advance.com.au/ecash/intro/fees/default.htm I anticipate continually cheaper ecash fees as banks start to compete for selective, price-conscious customers like Feanor here. :-) Regards, Zooko

1 0