- cypherpunks-legacy - lists.cpunks.org

Note on "Barring Netscape"
by Richard Charles Graves 17 Dec '03

17 Dec '03

The Microsoft Internet Explorer sends the user-agent "Mozilla 1.22 (compatible" to hte server, which triggers an incorrect response from, e.g., www.c2.org. This little fraud has the potential to make you look silly if left unexplained. If you get the string "compatible;" (or Compatible;?), you should instead pop up Netscapisms that show that Microsoft is lying. Or maybe Billisms. <font face="Symbol">, which affects only MSIE, might be appropriate. -rich

3 2

Roger Schlafly's court hearing today
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

Roger Schlafly had a brief hearing this morning in Judge Williams federal court on summary judgements with respect to the validity of the various public key patents, and alleged anti-trust and unfair trade practices. Bob Wells and I were the only pro-tossing-the-patents out people there, although sometimes-cypherpunk-meeting-attender Whit Diffie was there as well. The judge said right at the outset that he would not be making a decision today, that he wanted guidance from Roger and the other sides lawyers about the relevant issues, to help him wade through the tremendous amounts of documentation provided. I suppose that this could be expected, but the issues here seemed to me, at least, to be relatively clear-cut. There were basically four issues to be discussed, the Diffie-Hellman, Hellman-Merkle, and RSA patents, and these unfair trade practices. The judge had only allocated an hour for this discussion, and then showed up 20 minutes late, which proved inadequate. Still, I thought that everyone was remarkably clear and concise with their answers, and the judge asked reasonable questions. First discussed were the unfair trade practices, where the lawyer for what used to be PKP dragged in a lot of dirty laundry from the past, describing why Roger got interested in this in the first place. I don't understand what the complaint here was, the PKP lawyer said that since Roger didn't have a product, what was he complaining about, anyway? It seemed like an odd defense to me, but again, I don't know exactly what Roger's complaint was. Roger agreed with the judge that yes, everything he wanted to say was in his submission. Next discussed was the Diffie-Hellman patent. Roger stated that he had four clear instances where the an "enabling disclosure" was made about Diffie-Hellman; three were presentations to large audiences, and one was a pre-print of the famous "New Directions in Cryptography" paper. Roger actually had the viewgraphs that Diffie used in his presentations. These disclosures were all made more than 1 year before the patent was filed, which is the limit in the US. The lawyer from CalCan (something like that) handled this one. He said that the law specifically mentioned publication, and that none of these was a publication. I'm not sure what the law says, and Roger disputed the claim that that is what the law says. Disappointingly to me, it appears that neither Diffie or Hellman have any recollection of when, to whom, or how many preprints of the article were sent out. It's terrible how the law seems to cloud people's minds, isn't it? What little I do know about patent law tends to support Roger on this one, I think that it should be an open and shut case, but we'll see. Then we came to the Hellman-Merkle patent, which basically claims all of public-key cryptography. Roger's claim here was that the mechanism described doesn't work, because knapsacks don't work, that is, the invention is supposed to make generation of the decryption key infeasable, by a very specific description of infeasability in the claims of the patent. (10^30 arithmetic operation necessary) Well, that's not true. The same lawyer for the other side took this on two different ways: 1) that nobody knew that knapsacks were insecure at the time that the patent was filed, how could the patent be found invalid based on something that happened later 2) and some variations (dense, iterated knapsacks) might still be secure. Roger presented an analogy. Say someone was able to persuade the patent office that a drug cured cancer, and so he was able to obtain a patent on it. Later, it was found that the drug killed everybody who took it. Should the patent be valid, if it really didn't do what it said that it would? Roger could have gotten melodramatic, and said that bad cryptography could really kill people, and has many times, but he didn't; as I said, everybody was remarkably concise and to the point. Even so, we were out of time here, not having discussed the RSA patent or the Schnorr patent at all. The judge said that he will call another hearing if he feels that it is required. I thought, in my incredible naivete, that it went really well for Roger, although I didn't have time to hang around and ask him how he thought it went. I think that his arguements are good, and if the law is sensible he will prevail. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-2244

1 0

SKIP
by rogaski＠phobos.lib.iup.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Can anyone remember the URL for SKIP for Solaris, that little piece of paper has become a victim of the clutter ... - ----- Mark Rogaski 100,000 lemmings rogaski(a)phobos.lib.iup.edu aka Doc, wendigo can't be wrong! http://www.lib.iup.edu/~rogaski/ VMS is as secure as a poodle encased in a block of lucite ... about as useful, too. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMYNYx0c4/pqJauBAQHPFwQAoG6wtJJsq9QJB2MU02G08Vo436jK0sZs XscSvlpKUtYbyJORj4ETVdfDAAoyQdjZFQQTeH4vt413DPbmqgwKs+QnBrI49evv UjhmcGvxFMj8DpkxiL+5ANu6nrzLWM9smUDWlpKTa3HN59Kq5shlHIlp+yo6AH08 AIInsCZh+YU= =jUrp -----END PGP SIGNATURE-----

1 0

Press Release on Response to Microsoft Internet Announcements
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I just posted the following from stanford.edu; it probably won't be approved and propagated in time, though. By the way, alt.internet.media-coverage, to which someone pointed me, is explicitly *not* for press releases. I do not plan to utter the string "cypherpunks(a)toad.com" because I think there's enough noise here already (some from me). Apologies to sameer for being presumptuous, but I did say "hope," and I also think tomorrow would be a really good time to document the .PWL file bugs... - -rich - ---------- Forwarded message ---------- Date: Wed, 06 Dec 1995 14:39:23 -0800 From: Rich Graves <w95netbugs(a)aol.com> Newgroups: misc.news.internet.announce, misc.news.internet.discuss Subject: Info on Microsoft Internet Announcements Thursday, December 7, 1995 Please reply, if necessary, to the address in the current FAQ, because I very seldom actually log on to America "On Line." Before forwarding this along, please check whether this has already been done; and let me know after the fact. As has already been announced in the print press, Bill Gates, who works at a large software company, will hold a press conference tomorrow, December 7th (a date with some historical significance), to announce Microsoft's Internet strategy. For information on Microsoft-sponsored marketing events in your area, please see http://www.microsoft.com/events/ Approximately fifteen minutes after Mr. Gates begins speaking (anyone have the exact schedule? please phone me), we hope to release very significant updates to the following Internet sites: http://www.c2.org/hackmsoft/ [information on a few security problems with Microsoft products] http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html [canon URL; multiple DNS-load-balancing SPARCServers] http://www-dccs.stanford.edu/NetConsult/Win95Net/faq.html [use this mirror of the above if you have an old DNS server that barfs on the www-leland lbnamed tricks] news.answers, comp.answers, comp.protocols.tcp-ip.ibmpc, and several higher-traffic groups will receive a text rendering of the above. This will be the first approved and rtfm-archived posting; the news-answers folks got back to me last week. gopher://quixote.stanford.edu/1m/win95netbugs will get a text rendering of the above, and contains relevant messages from an email discussion list. An email autoresponder to be named later (finger llurch(a)elaine.stanford.edu in the morning). The various archives on http://www.hks.net/ have additional information for the technically minded. A PGP-signed copy of this announcement is available on request, but I don't want to confuse the unwashed masses unnecessarily. - -rich "A day that will live in infamy" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMYaz43DXUbM57SdAQEeDQP/a8ZccX4fpMbKCNa6Cllii0qWI6A8oUKH 30fdoGl1HvlgWVhsB0paVLsQS8tQGsVt/MzKJLasTsnKuYVJCmdgmXcj9nEE9YIY SxBEDn6yGno2ey7G1lXJSkeVAjB8o/fX+kZXGNKfOGKgNqjIl12jHbW7NX1bsIKi wQl/s4uikQs= =6Z1M -----END PGP SIGNATURE-----

1 0

Re: News on Congressional Debate on Exon
by tcmay＠got.net 17 Dec '03

17 Dec '03

This is a VERY positive idea! At 3:54 PM 12/6/95, Peter Trei wrote: >Actually, I've been thinking about this quite a bit recently. I'm building >an SSL enabled server, and clent-side authentication may provide >some help. I could see a user getting his or her public key certificate >signed with different CA keys which assert any number of conditions, >such as: > >Key holder was born before (some particular date). >Key holder has access to sales data for XYZ corp. >Key holder is an adult who takes the first amendment seriously. > >... and the server would recognize different CA signatures as permitting >different levels of access. This is something that could get two things done: 1. Protect ISPs and Web sites from claims they aren't taking any steps to block children. (I won't get into the "children should be allowed to appreciate the beauty of the human body" issue, just noting that an ISP or Web site could deny access to account holders under 18, or over 30, or whatever he wants to do.) 2. Get wider currency for the concept of digitally signed credentials, especially if these are _blinded credentials_, where the credential is for an age, say, and not an identity. (Standard Chaumian stuff, though likely to be nontrivial to implement.) >If your browser permitted you to select the key certificate used in >setting up the encrypted link (and different certs or sets of certs >could be protected with different passphrases), then Mom or Dad >could use their I-am-an-adult credential to read www.xxx.com, >while Junior could not. There *is* a loss of anonymity in this scheme, >however. There may be ways around the loss of anonymity. Ideally, with blinded credentials, But in the short term, through Web proxies and/or servers. For example, Sameer's c2.org could issue accounts to people who can prove they are over 18 (notarized copies of birth certif., passport, etc.). Sameer's system would then have a credential saying "this account name is over 18." (There is of course little that can be done about people who lend their accounts to minors, absent any effective biometric security measures. No current system, certainly not Exon-Coates, can deal with this.) >I realize that digital credentials are old hat on this list. The point I am >making is that the pieces for doing this are here - we just need to >assemble them. > >(This is not to suggest that I am in favor of Exon/Coates in any way - >I am not. ) I think this could be quite a good project, provided it is not trying to be all things to all people. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Responding to Exon -- technology is not enough
by Bill.Humphries＠msn.fullfeed.com 17 Dec '03

17 Dec '03

Jason Burrell <jburrell(a)crl.com> writes: >*Sigh*. Are we really ready to go back to UUCP? It looks like we'll have >to. That is, if someone doesn't set up a couple cryptographically enhanced >subnets first, or come up with some better idea. Interesting prospect, >actually. Fine for the tiny subset of Net users who understand crypto enough to use it on a daily basis. I'm not one of people either. This crypto isn't user friendly stuff. Before you propose such as solution, better make sure people can use this stuff. >Anyone wish to comment on the prospect of a double blind server, set >outside U.S. borders, that can act as an interface to the rest of the >world, perhaps encrypting or stego'ing the data transfered between it and >the user? Basically, an anonymous remailer that acts as a cross between >an NNTP, POP3, and SMTP servers. How are you going to pitch this technology to all the people with AOL and Microsoft Network accounts who barely understand the net? These are the people who need exposure to all the uncensored expression they can get. Instead of figuring out how to build a new treehouse that excludes Exon and Hyde, how about fighting the damned bill in the courts? bill.humphries(a)msn.fullfeed.com | WisCon 20: Two Decades of Feminism & SF http://www.cs.wisc.edu/wiscon/ | Ursula K. Le Guin: Guest of Honor

3 2

Still more on the Digicash protocol
by daw＠guaymas.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ian & I were talking about the Digicash protocol some more. Hal has pointed out that payments & deposits with a wildcard in the payment_hdr should NOT be sent in the clear, since they can be stolen by any passive eavesdropper. Ian has pointed out the same problem with cancellations: the payer_code should NOT be sent in the clear, since any passive eavesdropper can grab this info and steal the corresponding payment. Sadly, the current Digicash client DOES send those items in the clear (without even warning users to avoid wildcards). Why? Anyhow, the obvious solution is encryption. Our new observation is that encrypting deposits & cancellations with the mint's public key is not enough to solve the problem. To see this, recall how the public key encryption works: a session key for a bulk cipher is encrypted under the public key, and the data (e.g. userhdr, payment_hdr, coins, ...) is encrypted under the bulk cipher. Digicash hasn't told us yet what bulk cipher they use, but let's assume for concreteness they use RC4. Now I'm an attacker -- I want to modify userhdr.userID -- and then the mint will accept the payment and deposit the coins into the wrong account. But this is just easy for an active attacker -- I just flip bits in the ciphertext! (Presumably I can guess fairly well what plaintext value is expected for the userhdr.userID field.) This is just a corollary of my Pet Peeve for protocol designers: Don't use encryption when you want message authentication; with encryption, you should only count on confidentiality! Ok, so you mention that maybe Digicash uses DES-CBC or somesuch instead of a stream cipher like RC4. I'll briefly note that while the attack isn't so trivial anymore, DES-CBC ciphertext is not tamper-proof -- again, encryption does not provide message authentication. Another nitpick from your friendly neighborhood techno-geek. I noticed that signatures (when used) don't cover the headers. Since the mint uses header information to make important decisions (e.g. the userhdr.userID field specifies who's account a deposit should go to), shouldn't this be signed, just as a matter of ordinary everyday paranoia? While I'm ranting, let me also remind you of a problem Ian discovered earlier through reverse-engineering: the payment & deposit messages aren't encrypted, and they send payee (e.g. shop) identity payer's and payee's banks payer's currency-of-choice amount of money transferred description of the product time of payment in the clear, accessible to any passive eavesdropper. With traffic analysis, if payers use the default TCP connection, all this information about them can be compiled. If I target a payer, I'll probably be able to record all his transactions (unless he's using remailers or pipenet). If I sit outside a small business, I can compile a dossier on its buying habits. Worse still, anonymity for the shop is worse with Digicash than with real cash. If I pay you real cash on a secluded street, you're fairly anonymous. If I pay you Digicash over the Internet, any passive eavesdropper could be recording your identy and the whole transaction. Blech. So Digicash's product does all sorts of neat crypto to provide you with anonymity from the bank, but doesn't do much to provide anonymity from eavesdroppers on the Internet. This is exactly backwards from how I'd prioritize -- I'll trust my bank to keep me private long before I'll trust messages sent in the clear over the Internet (on a virtual postcard) for all to see! Blech. So, what should Digicash be doing to remedy these problems? * always set up an encrypted, authenticated connection before sending any messages in the Digicash protocol. (Yes, this means shops will need to have certificates if you want to avoid a man-in-the-middle attack. So be it. Most online shops will be using SSL, and thus have a certificate anyhow. You can safely punt on the authentication between customer <-> shop if you're not worried about active attacks.) * add a big warning to the documentation: users should not use wildcards in payments (unless they know the dangers & are encrypting with e.g. PGP). * sign the header stuff too. * continue specifying the protocol at a deeper level, like you promised (and throw in source for security-critical modules too, eh? :-) - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMYgtioZzwIn1bdtAQHx9QF+J6qWEqWcsaoVOUQ3i9qaVF8MgYdztCLg 9si9YDnjqPnFEsGTHYBjZXB8/TpOfiZe =cBGu -----END PGP SIGNATURE-----

1 0

SEQ_uel
by John Young 17 Dec '03

17 Dec '03

Science, Dec 1, 1995. "The Evolution of Molecular Computation." By Willem Stemmer. Comments on the limitations of Leonard Adleman's and Richard Lipton's DNA-computation research compared to the utility of sequence evolution computation. Although DNA sequencing of the selected solutions poses a practical problem for molecular computation, this drawback does not exist for computation with genetic algorithms or for in vitro evolution or computer simulations of natural evolution, called artificial life. Sequence evolution appears to be a useful general tool for solving many complex problems, whether the solution is a number, sequence, program, or structure. SEQ_uel (6 kb)

1 0

Re: NIST GAK export meeting, short version
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:11 AM 12/6/95 -0400, pfarrell(a)netcom.com wrote: >They claimed it was needed so that they can serve a court order >that is SECRET. .... >The main area that they claimed was for FISA orders. Maybe this is just an artifact of Pat's wording, but this sounds like there may be classified court orders other than FISA? > Plus, since you have to be a US citizen to get a clearence, > how can there be approved foreign escrow agents? By deals with the foreign governments, presumably reciprocal. The US would allow export of software using the escrow keys for Banque du Commerce et Credit Internationale - Paris, if the bank and the French spooks signed an agreement for escrow access, and in return the US would probably agree to give the French access to some US-escrowed keys (with proper requests, of course.) >And the usual, why in hell would a competent spy use >crypto escrowed in the US? Competent spies appear to be a surprisingly small fraction of even government-employed espionage personnel, or maybe long-term espionage is just inherently difficult the Soviet Empire, Nazi Germany, and WWII Britain had all identified most of the spy rings operating against them. Philip Agee's article on how to identify the CIA agents in a US embassy may have surprised the CIA, but wouldn't have given any significant new information to the KGB. (They might have been surprised he'd _say_ it...) And amateurs and newcomers to the business aren't always that good. Also, maybe a spy would be using GAKed crypto to avoid attracting attention. Much of espionage, especially emerging economic espionage, primarily uses open-source information; there's nothing too secret about sending the latest SAIC want-ads from EE Times back home, but the CIA may learn what targets you're watching by watching enough of your traffic to guess at your filtering criteria. And sometimes you're just stuck on the Beltway and have to use your car phone to say you'll be a bit late dropping off the secret plans. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281 # Anybody notice that Microsoft's Wide Open Road ad has barbed-wire fences # on both sides of the road?

1 0

Re: Secret Clearance (was: re: NIST GAK export meeting, sv)
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:00 PM 12/5/95 -0500, Pete Loshin <pete(a)loshin.com> wrote: >The point is, if you want to keep your organization's systems secure, >you need some mechanism to do so. Security clearance is one way; >banks and other financial institutions do other things (like finger prints, >background checks, etc.) ... >My big question is, do any of the companies providing Internet services, >or Internet software, or digital commerce services/software, employ >any of these security mechanisms on their employees? Few, if any, other than companies already in the military business; secret clearances are _expensive_, usually take a long time to get, and the military only gives them to people who need them. Normally, to get clearances for your employees, you need to have a security bureaucracy to also get clearance for handling classified material in your building, though perhaps they'd make other arrangements so the cleared escrow agent could take the master keys down to the local FBI office to unlock somebody's correspondence. Commercial companies are more likely to use bonding services to insure themselves against employee theft, though they also do things like talking to previous employers, and for sensitive positions some companies check criminal records. Many companies will run a TRW-or-equivalent credit check on applicants to see if there are major outstanding problems (though somehow the Mafia seldom reports bad gambling debts to TRW :-), and some companies pretend they're doing drug tests to check for people with expensive habits. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281 # Anybody notice that Microsoft's Wide Open Road ad has barbed-wire fences # on both sides of the road?

2 1