- cypherpunks-legacy - lists.cpunks.org

Re: PGP Key Preview...
by Ed Falk 17 Dec '03

17 Dec '03

> is there a way to preview the contents of a received public key, > without adding it automatically to the public key ring? Trivial. Just have pgp look at the file without giving it any commands. I.e. instead of pgp -ka <filename> do pgp <filename> Pgp will examine the file, tell you it contains keys, show them to you and then ask if you want to add them to your keyring. This is the way I normally add keys, just because I like to look at *any* file before I add it to any system.

1 0

Re: Last nail for US crypto export policy?
by Ed Falk 17 Dec '03

17 Dec '03

> I just ran out of asswipe. > Does anyone have any RSA Data Security, Inc. stock they'd like to > sell? Now, now. I don't think RSADSI had any illusions of 40-bit keys being secure; they just wanted to find out just *how* insecure they were. I suspect that this crack will *benefit* RSADSI, and the rest of the crypto community, by helping to convince the feds to ease up.

1 0

Cats Out of Bags
by Duncan Frissell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "In an interview Tuesday, [David L.] Aaron [the Feds' Crypto Ambassador] disputed the industry's view that the U.S. efforts to control cryptographic technology are being outstripped by the pace of the technology. "When I talk to other governments," he said, "they still don't feel that the cat is out of the bag." What the fuck do *they* know? DCF -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBMu+CdoVO4r4sgSPhAQHMqgQAhLoHArHx76zdXu8yM7WrThPi0pn8U5wG IQQItZFQAK84MnnbKDEDsW4SW5e9pM7JaFWbFqUg4VooAnKRd/2oITSijEW57jsR SQrhdqztR5fX82Wi9kBNsx92+McywzaeJBI6t+oTEYqqUlhQhzCoJiUpjMu9Q9FR 2gg8Mc01l4E= =MgUH -----END PGP SIGNATURE-----

5 6

Re: Best Computer School?
by Patrick May 17 Dec '03

17 Dec '03

Rick Osborne writes: > At 12:32 PM 1/28/97 -0500, Derek Atkins wrote: > >This is really exagerating. You do not need a 4.0, 1600, etc. to be > >admitted to MIT. Sure, you need good grades, but a 3.6 average and > >1350-1400 SAT scores is perfectly adequate to be admitted to MIT. > > I disagree and can speak from experience. I was denied admission to MIT > even thought I had a 3.82 GPA, 1440 SAT (one try), and had taken 9 AP tests > with two 5's, four 4's, two 3's, and one 2. As for being well-rounded, I > was on several academic teams, sang in Chorus, acted and stage managed in > Drama, and played Tennis. I have a degree from MIT and got in with marks only slightly higher than these. My verbal SAT was actually higher than my math. > The only thing I didn't have that the next MIT applicant had was money. I > made the mistake of letting them know that I was dirt poor and would need > full aid/grants/etc, and to quote "The Great Escape" it was "Zzzt! To the > Russian front!" This is an incorrect conclusion. I'm replying publicly to your message because I would hate for a kid with ability and little or no money to give up on getting into MIT without trying. I grew up on a small farm in Maine and got zero financial help for college from my folks. The financial aid people at Tech assured me that, if I were admitted, they would come up with a package of grants, scholarships, and loans to make the nut. With me working through school, they did. I've just finished retiring the $45k+ debt. > MIT may be a great school, but they tend to be snooty assholes for the most > part. (DISCLAIMER: Not all MIT grads/attendees are necessarily "snooty > assholes", I'm just saying that I've yet to meet one that wasn't.) I've been accused of being an asshole on more than one occasion (although never snooty). I think it's more a matter of temperament than anything Tech did to me, though. Regards, pjm

1 0

Complying with the EAR [was: More Circumventing the ITAR]
by Michael Paul Johnson 17 Dec '03

17 Dec '03

On Tue, 28 Jan 1997, Mark Rosen wrote: > I'm curious as to exactly what the ITAR/EAR/Whatever says specifically > about "unrestricted FTP sites." My program, Kremlin, is available for You should check the exact text yourself, but the way I read the EAR, you are not "exporting" strong cryptographic software without a license (exept to Canada, which needs no license) if you do things "such as" (1) have the guests to your site acknowledge that the EAR restricts export, (2) have the guests affirm that they can legally get the software (proper citizenship or residency & location), and (3) "check the address of the destination computer to see if it is in the USA" or Canada. The last one, I interpret rather loosely to mean that if the guest's email address domain isn't one commonly used in the USA or Canada, then I deny access. We all know that not all .com addresses are North American, but chances are really good that if the address ends in .ru, then the destination machine is probably not in North America. This is not a perfect way to prevent export, of course, but it is what the regulations say, as I read them. For a pointer to the regulations and to my access request form and crypto site, see http://www.sni.net/~mpj/crypto.htm Disclaimer: I am not a lawyer, and most lawyers don't even understand this stuff, so you read and act on it at your own risk. This is just my best effort to comply with the law without sacrificing my right to publish. > download at the web page below. On my web page, I have some stuff in bold > print that informs about the ITAR and tells people to go away if they're > not from the US or Canada. Does this count as an unrestricted FTP site? Is there any reason why people have to look at your warning before reading your warning? At my site, the ftp site itself is in a hidden directory that changes names often enough that people can't successfully link to the restricted files for very long without going through my warning page. Indeed, my site can't be navigated and indexed properly by web search robots. At your site, it is extremely likely that someone would find your software without ever seeing your warning. Indeed, your software is on another server with another interface. I think that your site counts as unrestricted. > Also, back to the question of registration numbers. A registration number > is just a string of letters and numbers, and is essentially the same as a > friendly letter; it contains no cryptographic code. For all anyone knows, I > could just be charging for pseudo-random numbers, again, nothing of > cryptographic significance. Is it illegal for me to mail someone outside of > the US or Canada a registration code? Thanks for any help. The registration code is legally equivalent to the registered software that it unlocks. Sending the registration code to France, for example, would be likely to be considered the same as sending the registered software to France (in violation of the laws of both countries). Now if the "unregistered" software is weak (i. e. crippled key length) without the registration code, you need not worry about posting it publicly and without restriction, as long as you don't export the registration code (except to Canada) without a license. I do this with Quicrypt (ftp://ftp.csn.net/mpj/qcrypt11.zip) BTW, I posted krem104.zip at my site. Please let me know if I mangled it in the process... http://www.sni.net/~mpj/crypto.htm Michael Paul Johnson Opinions herein are not necessarily Exabyte's. Work: mpj(a)exabyte.com http://www.exabyte.com Personal: mpj(a)csn.net http://www.csn.net/~mpj BBS 303-772-1062

1 0

Re: Last nail for US crypto export policy?
by Toto 17 Dec '03

17 Dec '03

Ed Falk wrote: > Toto wrote: > > I just ran out of asswipe. > I suspect that this crack will *benefit* RSADSI, and the rest of the > crypto community Ed, You're not 'outing' me, are you? Toto

1 0

Re: Fighting the cybercensor
by Sean Roach 17 Dec '03

17 Dec '03

At 09:40 PM 1/27/97 -0500, Phillip M. Hallam-Baker wrote: > > >jim bell <jimbell(a)pacifier.com> wrote in article <5ch9f2$cuu(a)life.ai.mit.edu>... > >> Look, I've proposed what I consider to be a remarkably consistent method to >> prevent the kind of political tyranny that you criticize, and I don't see >> any recognition of this fact. > >Thats because its a whacko solution that has no credibility >or consistency. > >If anyone tried to set up such a market and a price went out >on any of the heads of state fantasized about Mr Bell would be >dead as a doornail in a week. > So you're saying that the system would work. Mr. bell would be targeted, a price on his head, for starting that very system. Mr. Bell would be a martyr, his system being proven by his own death. It would be some varient of his idea that would be used to kill him, a bounty. I think that the system would work, I also think that it would be easiest to use by those already in possession of the money. It would take care of part of our overpopulation problem though...

1 0

Re: FBI=LIE
by Secret Squirrel 17 Dec '03

17 Dec '03

>From http://www.nytimes.com/yr/mo/day/news/washpol/fbi-lab.html: > The World Trade Center bomb was made of urea-nitrate, a compound > that can be confused with non-explosive mixtures of the same > ingredients. In an informal internal check of lab procedures, some > senior FBI lab workers mixed human urine with fertilizer and added > samples of that non-explosive mixture to the flow of material being > tested by the chemistry unit. A manager in the chemistry lab > identified the urine-fertilizer mixture as an explosive. Just coincidentally, these errors imprison the innocent instead of freeing the guilty. > Still, Joseph E. DiGenova, a former U.S. attorney in Washington, > said the issues raised in the report would allow defendants to > contest lab findings against them and would permit people convicted > of crimes to attempt to reopen their cases, based on the possibility > of flawed forensic evidence. > "It's going to be a royal pain in the neck for federal judges and > prosecutors and a godsend for defense attorneys looking for a means > of getting their clients off," he said Why not "proving their innocence"? A prosecutor - and one who does not respect our legal tradition of presumed innocence - is not a good choice for a quote here. Nowhere in the entire article is there evidence that the reporters talked to anyone outside the FBI/Justice Department milieu. > Scientists at the lab said they were often stifled in a lab run by > non-technical field agents who had little knowledge of science and > who regularly altered reports to help prosecutors. But law > enforcement officials said there was little evidence that anyone had > been wrongly convicted based on improper lab work. Why isn't this the story? FBI agents regularly committed perjury, and we see a story about lab errors. Elliot Ness

1 0

Re: uae_1.html
by Toto 17 Dec '03

17 Dec '03

jim bell wrote: > I wonder what these people will think when organizations like Teledesic and > Iridium start operating (low-earth-orbit satellites) to allow > totally-wireless connectivity. It seems to me that there will be a market > for services that allow anonymous browsing, perhaps with encrypted requests > that return otherwise-unidentified data on a publicly-accessible airwaves. Think of the possibility of satellite-fed 'roving' InterNet sites. What will be the 'export' implications of sending crypto to a place such as site.nowhere, site.somewhere, and site.intheUS-hee-hee. Toto

1 0

Workaround for filtering/cybersitter
by Mark Rogaski 17 Dec '03

17 Dec '03

If I had experience with Netscape plugins and spare time, I'd try it myself. But here's my proposed solution. A plugin in Netscape intercepts all requests, encrypt the URL with a pubkey algorithm, encode the string base64, send it as GET input to a proxy server. The proxy server decodes and decrypts the URL, gets the requested page, and returns it. This beats out URL-based filtering. Still need to figure out the specifics of key-exchange. If we use 40-bit encryption, it's exportable, and it still works in our threat model (ie. we don't care if the watchers figure out the URL a few hours later). To beat out dropping packets with unacceptable pattern in them, we could use an SSL-based server as the proxy. The plugin could even have a nice little on/off switch and a list list of available proxies. mark -- [] Mark Rogaski || "Computers save time like kudzu [] [] wendigo(a)pobox.com || prevents soil erosion." [] [] http://www.pobox.com/~wendigo/ || - afcasta(a)texas.net [] [] >> finger for PGP pubkey << || []

1 0