- cypherpunks-legacy - lists.cpunks.org

Re: Object Oriented Crypto API
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Good idea. I would have some suggestions, but first an important question: Is it to be discussed on the Cypherpunks list? Hadmut

3 2

Appropriate Topics?
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 8:35 PM 8/3/95, Ray Cromwell wrote: >> Good idea. >> >> I would have some suggestions, but first >> an important question: >> >> Is it to be discussed on the Cypherpunks list? > > I don't see why not. It's related to crypto, and it's related to >writing code. Or has the cypherpunks list degenerated into an arena >where the top subjects are the Waco hearings, paranoid government/NSA >rumors, US vs German censorhip, and irrelevent political messages? As I see things, talking about Ray's ideas for an object-oriented crypto library is a big part of what this list is for. (Ditto for Wei Dai's code, for Hal's code, and so on.) However, it's a mistake to think that the _only_ thing appropriate for the list is talking about code (of either kind). Not that Ray said this. It seems to me the list is pretty well-balanced between several different kinds of topics: * crypto -- RSA, Diffie-Hellman, entropy, randomness, denial of service attacks, and so on. * software -- PGP implementations, hooks to other programs, MIME, Unix, C++, Java, TCL, etc. * policy -- Exon, EFF, Perl t-shirts, law, export, etc. (The worst of these are the long policy analyses forwarded to this list from other places.) * cultural -- movies with crypto or security themes, books, comments, humor, etc. * speculation -- tax effects, money laundering, crypto anarchy, etc. * rants and conspiracies -- coverups, NSA, Waco, black helicopters, Masons, etc. (the worst of these rants are long, rambling conspiracy theories forwarded to this list from other places...these are probably the items that least belong here). (Note that the two serious problems--policy statements and conspiracy rants forwarded from other places--share a common point: they are not written for the Cypherpunks list by Cypherpunks...they are just stuff forwarded, with only tangential interest to the list. And they tend to be long.) Are these themes appropriate? Some folks want to read posts on one topic, some on others, etc. It's a fact that highly-specialized or detailed posts about, say, crypto libraries, will not get as many general comments--in real life or on this list--as a reference to a current movie will get. That's the nature of things. I could go on about why this is so, but I think you all know why. The "Cypherpunks write code" mantra, sometimes cited by those who dislike the discussions they see, has a broader interpretation. To wit, instead of asking others to write the code you want to see, try writing it yourself. And this directly relates to postings: instead of asking for a different kind of post, one should just _write_ that kind of post! People will talk about what they want to talk about. If they get _too_ far off into themes only distantly related to the ostensible themes of this list, then usually some slight peer pressure will work. Plus, if people don't respond, the threads die. The noise messages of the form "This is not about writing code; this does not belong on Cypherpunks" are misguided. The list is made up of people who have crypto and privacy concerns broader than just writing C++ code for Sparcstations. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Re: Java, Netscape, OpenDoc, and Babel
by strick at Jihad 17 Dec '03

17 Dec '03

> But in which framework or language, given the profusion of frameworks and > languages? > > We had some TCL advocates a while back (Strick, Hal...)...any reaction to Java? TCL solved my specific problem at that time. Unfortunately I haven't studied Java. PM's comments (as usual) intrigue and bother me; I need to study it. TCL's biggest problem is that it's slow -- it's designed to be used in the parts where speed doesn't really matter -- and it sounds like java sovles that. Perry -- do you have the same basic objection to Safe-TCL that you do do to Java? I would think so. strick > And so it goes. > > --Tim May

3 2

Re: Java, Netscape, OpenDoc, and Babel
by Rich Salz 17 Dec '03

17 Dec '03

>Perry -- do you have the same basic objection to Safe-TCL that you do >do to Java? I would think so. Safe-TCL comes from a different starting place. For example, the original intent was to actually remove all the dangerous operations such as file manipulation. As Perry's explained, this is different, and better, then just having the run-time "guarantee" that all file I/O is in a "Safe" place. Claimer: I invented safe-tcl, started by creating a mailing list with Ousterhout and Borenstein. Disclaimer: I walked away in disgust with the announcement of "enabled mail" so they may have broken things. /r$

3 2

RSA has been proved correct
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

Serendipity strikes. I was reading the logic programming/theorem proving chapter of my new Russell and Norvig book on AI, and came across something I once knew about but had forgotten: the Boyer-Moore theorem prover was applied to the RSA algorithm and the correctness of it was verified. Correctness in the sense of showing that outputs match formal specs, for all inputs. The paper is: Boyer, R.S and Moore, J.S. (1984). Proof checking the RSA public key encryption algorithm, "American Mathematical Monthly," 91(3):181-189. Now this does not mean: - that implementations cannot have flaws, backdoors, etc. - that larger systems which use RSA cannot have flaws, backdoors, etc. What it says is that there is hope that formal verification of critical modules is possible. I can't imagine too many areas of software engineering that are more critical to modularize and verify than crypto and digital money sorts of things. Huge monolithic programs are vastly more difficult--probably intractable--to verify. The "crypto library" project(s)--I use the plural because there have been several such projects--are good ideas. Small modules that do one thing and one thing only are best for building larger modules robustly. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

5 5

Re: RSA has been proved correct
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Mmmh, correctness does not mean "it's a nice thing". It just means that something fulfills the specs. Do you know which specs were fed into the prover? The specs could be as weak as - RSA must terminate if fed with the number 42 - x ^ (e * d) = x mod n for all x from 0..(n-1) Hadmut

1 0

Re: EU Data Protection
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:43 PM 8/4/95 +0002, Kari Laine wrote: >Excuse me - what the f**k is this? Does it bear some truth in it >or is it just a bad joke? If it is not a joke where to get the damn >text - thanks. Sorry for the language but this does sound just >the thing I have heard some rumours of and which certainly >would result in banning strong crypto. http://snyside.sunnyside.com/cpsr/privacy/privacy_international/internationa l_laws/ec_data_protection_directive_1995.txt Has the preliminary text. The final won't be up for a while but won't be that different. Also try: http://www.open.gov.uk/dpr/dprhome.htm The UK Data Protection Registrar's home page. They've been trying to control electronically stored records since 1984. DCF

3 2

to usura
by NSA Spook 17 Dec '03

17 Dec '03

usura cfs coming send note to list if you receive

1 0

to usura
by Chris Brenton 17 Dec '03

17 Dec '03

Original-From: NSA Spook <remailer(a)spook.alias.net> Original-Date: Fri, 4 Aug 1995 10:37:00 -0500 >usura >cfs coming >send note to list if you receive Thank you for posting this to the list. I needed some more useless mail...

1 0

NIST/NCSSC National Information Systems Security Conference
by droelke＠spirit.aud.alcatel.com 17 Dec '03

17 Dec '03

A couple of days ago I got a booklet about the "18th National Information Systems Security Conference (formerly the National Computer Security Conference) " being held October 10-13 in Baltimore. Just a little excerpt about it: One of the tracks is "The Internet and Beyond" Several of the sessions look rather interesting. The "Management and Administration" track includes at least two sessions by D. Denning of Georgetown Univ. One of them is "Legalities: Will Encryption Keep Out Hackers" and the other is "Critical Factors of Key Escrow Encryption Systems". The first of those has a panel of S. Bellovin of AT&T, M. Higgins of DISA, S. Kent of BBN, and E. Spafford of COAST. So, is this a converence that is really worth something, or something that the management heads might learn something at? ;-) I guess that ordering my personal set of the Rainbow books gets me on more lists than I thought :-) Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX http://spirit.aud.alcatel.com:8081/~droelke/

1 0