HDTenEightyP/NetNews huggingface dataset:
From: sspy@west.darkside.com (mshannon)
Newsgroups: sci.crypt
Subject: Help
Date: 28 Dec 92 09:26:09 GMT
Organization: The Dark Side of the Moon +1 408 245 SPAM

Hmmm. Not having much experience on the Internet, I tend to be easily 
confused. Now I heard that .sci meant science, and .crypt meant 
cryptography, so naturally I assumed...
Actually, this newsgroup is apparently for legal and political 
discussions about cryptography, and not the science of...
As I can't find the proper place, I will pose a few questions here in the 
chance that they might elicit some needed answers. 
This is for publication in Digital Privacy, to be released in January. 
LOOMING deadline.
If I may quote you, please advise, otherwise I will assume that I may 
not.
1. Is there any real, actual, documented, case of the DES having been 
cracked through brute force alone, in ECB or CBC mode?
2. Is there any hard evidence that this has not happened and isn't likely 
to happen within n years?
3. Can anyone state the amount of time a given computer would need to try 
out all of the DES key combinations? For example, the Cray Y-MP C-90 
which is supposedly the fastest computer on Earth.
4. Does anyone know why the DES key was REALLY changed to 56 bits?
5. Does double encryption, meaning enc with key A, dec with key B then 
enc again with key A, actually increase the resistance to attack? Can 
anyone put numbers on this?
6. Is it possible to state for a known fact that there are no weaknesses 
or trap doors, or any other ways of comprimising the DES and that no 
matter how carefully the DES was designed 15 years ago, today's 
technology would without question, reveal any such weakness?
Thanks in advance for any replies.
M. Shannon PO Box 192171 San Francisco 94119 FAX 408-732-7980.
Newsgroups: sci.crypt,alt.sources
From: injc@helios.rz.tu-clausthal.de (Joerg Czeranski)
Subject: Re: PGP as a World Standard
Organization: Techn. Univ. Clausthal
X-Newsreader: Tin 1.1 PL5
Date: Mon, 21 Dec 1992 16:58:29 GMT

Tim Moore (moore@cs.utah.edu) wrote:
: The IDEA cipher is patented in Switzerland.  I admit that I don't know
: if Switzerland is considered part of the EC or not.

Switzerland ist not member of the EC.  Recently the people have voted
against joining the european trade community (I don't know if this is the
right word, in german it is Europ"aische Wirtschaftsgemeinschaft), so it
is unlikely that Switzerland will join the EC in the near future.

Joerg

--
Joerg Czeranski
Osteroeder Strasse 55          EMail injc@sun.rz.tu-clausthal.de
W-3392 Clausthal-Zellerfeld    SMTP  injc@[139.174.1.3]
Germany

(.sig under construction, sorry for the inconvenience)
From: strnlght@netcom.com (David Sternlight)
Newsgroups: sci.crypt
Subject: Re: PKP/RSA comments on P
Date: 25 Dec 92 19:41:09 GMT
Organization: Netcom - Online Communication Services (408 241-9760 guest)

In article <931.204.uupcb@ssr.com> dick.zeitlin%acc1bbs@ssr.com (Dick Zeitlin)  writes:

>Cryptography is certainly one mechanism for message concealment, but
>there are many others.  I hope you're not suggesting that all message
>concealment should be discouraged.

No, I wasn't even suggesting that cryptography should be discouraged.
With respect to my massage about 'lives saved and lost' the only
purpose of that statement was to refute what I thought was the
ridiculous claim that governments should be just as interested in
leaks of airplane dimensions of the sort that show up in Japanese
plastic models as they should be in cryptography. I was showing the
much greater importance to governments of cryptography than plastic
plane models. That someone should attempt to challenge the
self-evident notion that governments are strongly interested in
cryptography shows the ridiculous level this discussion has sunk to on
the part of some.

------- 

On the general sub-subject--not directed to Dick Zeitlin:

That some others should attempt to turn that into a discussion of
"what about the enemy dead?" which was totally irrelevant to my point
about the importance governments give all this, shows something else
about the behavior of some here, but rather than saying what I think
that is (which will just spin off yet another sub-thread to little
purpose), I'll leave speculation about that in the mind of the reader.

The more I participate here, the more i realize that this place is
not a rational discussion forum for some, but a zoo. One correspondent
even sent me an e-mail charging me with racism for mentioning that
the Purple decryption saved American lives, and the Enigma decryption
saved British lives, both heavily documented facts.

Before I get yet another loutish e-mail screed, let me say that I'm
sure any Japanese or German decryptions also saved Japanese or German
lives.  The point in this sub-discussion is the importance with which
governments take cryptography, not whose lives are more valuable.

David



-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail
Newsgroups: sci.crypt
From: smb@research.att.com (Steven Bellovin)
Subject: Re: Legal Stuff!
Date: Fri, 25 Dec 1992 19:18:04 GMT
Organization: AT&T Bell Laboratories

In article <1992Dec25.172233.1663@cbnews.cb.att.com>, jap@cbnews.cb.att.com (james.a.parker) writes:
> In article <1992Dec25.060924.14629@netcom.com> tenney@netcom.com (Glenn S. Tenney) writes:
> >35 USC 271 (g)
> >"Whoever without authority imports into the United States or
> >sells or uses within the United States a product which is made by a
> >process patented in the United States shall be liable as an infringer, if
> >the importation, sale, or use of the product occurs during the term of
> >such process patent.  
> 
> If the "process" is encryption of plaintext by a public key, then wouldn't
> the "product made by the process" be:
> 
>    o The public/private key pair, and
>    o Text encrypted by the public key
> 
> To cover the code, I would expect the statute to say something like, "product
> incorporating the process," or "product making use of the process".  Case law
> may have (mistakenly, IMHO) extended the law to include this, but the statute 
> listed doesn't seem to say that.

Umm -- there's a legal subtlety here.  Note the phrase ``process patent''.
There are (at least?) two forms of claims that can appear in a patent, a
``method'' claim and a ``process'' claim.  The difference is a bit fuzzy
to me, but if you don't claim a process for doing such-and-such, as well
as, or instead of, the method (which covers the actual apparatus), I don't
think the quoted clause applies.  The question here is whether or not the
RSA patent has process claims.  I don't know, and my copy of the patent is
in my office, which I don't expect to visit till ~Jan 4.

No, I'm not a laywer, though I sometimes seem to play one on the net.
But a patent lawyer did explain to me about process vs. method claims;
if I got it wrong, it's my fault, not his....
Newsgroups: sci.crypt,alt.security.pgp,alt.security.ripem
From: smb@research.att.com (Steven Bellovin)
Subject: Re: Legal Stuff!
Date: Sat, 26 Dec 1992 15:15:56 GMT
Organization: AT&T Bell Laboratories

In article <BzvAs7.sI@mentor.cc.purdue.edu>, hrubin@mentor.cc.purdue.edu (Herman Rubin) writes:
> RSA may seem miraculous to those who do not know mathematics, but not to
> those who do; I suspect the Patent Office to be staffed by those in the
> former class.  A BS in mathematics does not mean knowing much, if any,
> non-computational mathematics, and certainly not the number theory and
> knowledge of computational complexity needed to appreciate what has been
> done by the promoters.  As a professor for a long time, I must question if
> many are really "skilled in the art", as the patent laws put it.

I fail to see your point.  Are you claiming that RSA was obvious?
I suggest you read

@article{Diffie88,
   author = {Whitfield Diffie},
   journal = {Proceedings of the IEEE},
   month = {May},
   number = {5},
   pages = {560--577},
   title = {The First Ten Years of Public Key Cryptography},
   volume = {76},
   year = {1988}
}

Believe me, it wasn't obvious to a lot of smart *and* educated people.

Yes, RSA is eminently comprehensible now, almost obvious, one would say.
Lots of brilliant inventions are obvious in retrospect.  So what?

To my way of thinking, RSA is about the best example there is of why
``software'' patents should be valid.  Apart from the technicality that
it can be (and often is) implemented in hardware, we have something that's
new (that factoring is difficult isn't new -- but a practical use is),
useful (or we'd be discussing this in sci.math, not sci.crypt), and
very definitely non-obvious.
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Legal Stuff!
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Tue, 22 Dec 1992 20:51:02 GMT

Note--this discussion applies to the U.S. situation.

Toward the end of his latest message, Arthur L. Rubin finally reaches
a point on which we can agree. It is a legitimate question to ask if
the RSA patents are "legal" (whatever that means). One can ask
such a question about any patent, or indeed law.

The way to handle that, in my view, is not by reciting an incantation
("I don't think it's legal.") and then violating the patent (which IS
legal until ruled otherwise). Where I come from we call that "taking
the law into one's own hands", and despite the attempts to cloak that
act in legitimacy by citing civil disobedience of a historically
ethical character, this isn't about civil rights or freedom--it's
about whether one may use a specific patent for personal advantage
without paying.

Instead, the way to handle it is to challenge the patent. As I understand
it, the way you do that is by infringing, putting the patent holder
on formal notice you are so doing, and then if he wishes, adjudicate
the matter in court.

David
Newsgroups: sci.crypt
Subject: Re: PKP/RSA comments on PGP legality
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Date: 21 Dec 92 19:48:45 GMT
Organization: Beckman Instruments, Inc.

In <1992Dec19.000207.15616@netcom.com> strnlght@netcom.com (David Sternlight) writes:


>In order to stop the silly discussion about "technical data", 
>is source code o.k., etc., by some here who are making it up
>as they go along, here are some facts:

>"(c) Disclosures. Unless otherwise expressly exempted in this
>subchapter, a license is required for the oral, visual, or documentary
>disclosure of technical data...  A license is required regardless
>of the manner in which the technical data is transmitted (e.g., in
>person, by telephone, correspondence, electronic means, telex, etc.)."
>                

But "public domain" technical data was exempted -- in effect, there is no
disclosure.

>What is "export?" Section 120.10, "Export," begins:

>"'Export' means, for purposes of this subchapter: ...(c) Sending or
>taking technical data outside of the United States in any manner
>except that by mere travel outside of the United States by a person
>whose technical knowledge includes technical data; or..."

>Is pgp subject to the ITAR? See Part 121, the Munitions List, in
>particular Category XIII, of which paragraph (b) reads, in part,
>"...privacy devices, cryptographic devices and software (encoding and
>decoding), and components specifically designed or modified
>therefore,..."

>A further definition in 121.8, paragraph (f) reads: "Software 
>includes but is not limited to the system functional design, 
>logic flow, algorithms, application programs, ..."
             ^^^^^^^^^^

So, SciAm was in violation of ITAR, after all, even without the presence of
code.

--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
Xref: sparky sci.crypt:6070 alt.security.pgp:373 misc.legal:21659
From: strnlght@netcom.com (David Sternlight)
Newsgroups: sci.crypt,alt.security.pgp,misc.legal
Subject: Re: Legal Stuff!
Date: 22 Dec 92 21:12:06 GMT
Organization: Netcom - Online Communication Services (408 241-9760 guest)


Jyrki asks me to cite the law prohibiting the possession of illegally
imported munitions. I've already done so. Since possession of
munitions of foreign source requires an import license, the charge
would be possession of unlicensed imports, a felony. They might
even get you under the customs laws as well as the Munitions laws.

Moreover, it could be dealt with severely if it could be shown that
the possessor knew PGP wasn't licensed as, for example, those in this
discussion do. As I recall, there are even warnings about U.S. use of
PGP in the PGP documentation.

This response is probably going into thin air, with respect to Jyrki,
since he says he's put me in his kill file.

I've noticed that this discussion is degenerating into a lot of
nit-picking questions; I guess that means it's time to ignore them in
aid of moving on. Henceforth I won't answer such questions; my silence
won't denote assent. (Sigh of relief from some correspondents.)

I will, however, pick up on new issues that seem significant.

David
Newsgroups: sci.crypt
From: gardner@convex.com (Steve Gardner)
Subject: Re: PKP/RSA comments on PGP legality
Date: Tue, 22 Dec 1992 16:33:14 GMT
Organization: Engineering, CONVEX Computer Corp., Richardson, Tx., USA
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.

In article <1992Dec21.214415.2257@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>
>Bill O'Hanlon is correct to call attention to my remark about
>Jyrki's first name. It was a lapse. Regrets.
	The rest of the message was unwarranted as well.  Jyrki 
	is not Anti-American.  He is merely anti-American government.
	That doesn't set him against any honest americans.  It certainly
	doesn't make me feel threatened.  Any american who has carefully
	watched his government's behavior and has a conscience is pretty
	disgusted by now.  


						smg
From: rick@ee.uwm.edu (Rick Miller)
Newsgroups: sci.crypt
Subject: Where can I get MD5 (source)?
Date: 21 Dec 1992 11:15:23 GMT
Organization: Just me.
NNTP-Posting-Host: 129.89.2.33
Summary: I saw it here before...

A while ago, some kind soul *posted* the source for an MD5 implementation
which even included a nice little test file to check that it worked right.

Could someone give me a pointer to that code?  I think I've deleted it.

Rick Miller   <rick@ee.uwm.edu> | <rick@discus.mil.wi.us>   Ricxjo Muelisto
Occupation:  Husband, Father, WEPCo. WAN Mgr., Discus Sys0p, and  Linux fan
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Legal Stuff!
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Tue, 22 Dec 1992 01:54:59 GMT

In article <a_rubin.724977120@dn66> a_rubin@dsg4.dse.beckman.com (Arthur Rubin) writes:

>(2>) We've gone through this.  I haven't tracked the exception to the
>exception to the exceptions in the regulations, but it is unclear whether
>"public domain" (meaning essentially, published) crypto software is covered
>by ITAR.

" It would be useless to continue this given that you seem to be
making this up as you go along. I've quoted the law that says PKP is
covered, and if you claim an exception to an exception you have to
produce it. Since you seem not to know what it says, and the specific
definition of "public domain" in the exception is critical to the
discussion I'm at a loss to how to continue. The obligation is on me
to produce the law backing my assertions and I've done so. The ball
is now in your court.

>>Next Vesselin claims U.S. users may obtain PGP legally from a number 
>>of U.S. sites, which he lists. He is mistaken. It is on those sites 
>>illegally, for reasons stated just above, and ftping them to other 
>>U.S. sites is just as illegal. It does not matter who did the
>>importing; possession of illegally imported munitions is illegal.
>>Maybe in Bulgaria what is physically possible is equivalent to what is 
>>legal, but not in the U.S.

> >See (1>) above re patents.  

You seem not to be listening here. The issue of the legality of PGP is
not a patent one but a Munitions Act one, since the U.S. copies were
brought in from outside the U.S. without a Munitions Act import
license, and since PGP includes IDEA, it requires one.

David
Newsgroups: sci.crypt
From: ted@nmsu.edu (Ted Dunning)
Subject: Re: Motorola 'Secure-Clear' Cordless Telephones
Reply-To: ted@nmsu.edu
Organization: Computing Research Lab
Date: Sat, 2 Jan 1993 16:51:00 GMT


In article <1i2up9INNk5e@usenet.INS.CWRU.Edu> bz223@cleveland.Freenet.Edu (Danny Guy Frezza) writes:

   >     Yes, technically, it is a felony for you to use a speech-
   >inversion descrambler to monitor these Motorola 'Secure Clear'
   >cordless. Or for that matter, the new Radio Shack DUoPHONE ET-499,
   >cordless phone which also depends on speech-inversion for privacy
   >protection.  The public utility of the ECPA has been argued about

	Excellent point here.  The very simple point is that having some
   basic scrambling of the signal is better than not at all!


well, yes, but...


i don't remember the reference, but i think that during ww2, several
bell lab's engineers showed that a person could be trained to
understand speech inversion scramblers without any hardware aids.  the
scramblers in question were ones which permuted multiple bands in a
changing manner, and didn't just invert the entire band.

if people's ears can crack the system in real time without special
hardware then simple speech inversion really shouldn't be called a
security device.



Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: Re: PGP technical question (Not a flame)
Organization: Chinet - Public Access UNIX
Date: Tue, 22 Dec 1992 23:53:33 GMT

In article <168C413C13.UC445585@mizzou1.missouri.edu> UC445585@mizzou1.missouri.edu (John M. Kelsey) writes:
>   Why did PGP change from bassomatic to IDEA?  Where can I find references
>to IDEA?  (It's Swiss?)
 
X. Lai and J. Massey, "A Proposal for a New Block Encryption Standard,"
Advances in Cryptology: Proceedings of Eurocrypt 90, Springer-Verlag, 1991,
pp. 389-404.

X. Lai, J. Massey, and S. Murphy, "Markov Ciphers and Differential 
Cryptanalysis," Advances in Cryptology: Proceedings of Eurocrypt 91, Springer-
Verlag, 1991, pp. 17-38.

X. Lai and J. Massey, "Hash Functions Based on Block Ciphers," Advances in
Cryptology: Proceedings of Eurocrypt 92, Springer-Verlag, to appear.

X. Lai, "On the Design and Security of Block Ciphers," ETH Series in
Information Processing, Volume 1, Hartung-Gorre Verlag, Konstanz, 1992.

The fifth reference is best, but very hard to get.  The third reference is
also good, albeit much shorter.  Source code for IDEA is in PGP.

Bruce
Newsgroups: sci.crypt
From: robert.heuman@rose.com (robert heuman)
Subject: Export Controls
Organization: Rose Media Inc, Toronto, Ontario.
Date: Tue, 22 Dec 1992 23:53:17 GMT
X-Gated-By: Usenet <==> RoseMail Gateway (v1.70)


Date Entered: 12-22-92 10:34
I was asked to supply information re export control over anti-virus 
software, since I stated it was restricted in some cases.

The exact information follows:

Source: A Guide to Canada's Export Controls, January 1, 1992

Page 25, item 1150.Information Security

NOTE: The embargo status of "information security" equipment, 
"software", systems, application specific "assemblies", modules, 
intergrated circuits, components or functions is defined in this 
Category even if they are components or "assemblies" or other 
equipment.


Page 25, item 1154. Software

1154.a.c.3. "Software" designed or modified to protect against 
malicious computer damage, e.g., viruses.


Page 1, General "Software: Note

This List does not embargo "software" which is either:
1. Generally available to the public by being:
    a. sold from stock at retail selling points, without restriction,
       by means of:
        1. Over the counter transactions
        2. Mail order transactions
        3. Telephone call transactions _AND_
    b. Designed for installation by the user without further 
       substantial support by the supplier, _OR_
2. "In the public domain".

A check with Ottawa resulted in the statement that F-PROT was export 
restricted (controlled) as shareware did not meet the criteria of this 
general "software" note... Therefore SCAN by McAfee also would not 
meet the requirements.

I believe a similar restriction will be found in the US regs, as 
Canada's are based in good measure on the US regs, and this specific 
restriction was added at the request of the US gov't.

Bob
---
   RoseReader 1.70 P001886: Twice as human as anyone else my opinions are my own
   RM 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285
Newsgroups: sci.crypt
From: robert.heuman@rose.com (robert heuman)
Subject: LUC vs. RSA
Organization: Rose Media Inc, Toronto, Ontario.
Date: Wed, 30 Dec 1992 15:17:51 GMT
X-Gated-By: Usenet <==> RoseMail Gateway (v1.70)


Date Entered: 12-30-92 10:07
amanda@intercon.com (Amanda Walker) writes, in 

re something developed in Aussie land:

A> Where it was developed is not relevant to ITAR.  If it performs encipherment, 
A> it's covered--doesn't matter if it's foreign, domestic, PD or commercial.  
A> This is the principle manner in which ITAR presents a trade barrier to U.S. 
A> vendors who are trying to compete in international markets.
A> 
A> The Department of Commerce likes exports.  The Department of State doesn't.
A> That's the U.S. regulatory system for you.

I believe (I could be wrong) Australia is part of COCOM, which means 
that crypto software and hardware are covered, and cannot be exported 
or imported without permission from the government.  The ITARs are US 
only, but the COCOM regs are not, and still cover the product.

Bob
---

 ! ! ! ! ! ! ! !  Enjoy the season, for next year is but a few days away, 
 x x x x x x x x  with its new set of governmentally imposed problems.
 x x x x x x x x
 x x x x x x x x  (and in Canada, new and higher postage rates......)
  xx x x x x xx
   x x x x x x
    xx x x xx
     x x x x
      xxxxx
       xxx
      xxxxx
     xxxxxxx

   RoseReader 1.70 P001886: This Canadian has an Opinion...His Own!
---
   RM 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285
Newsgroups: sci.crypt
From: hausner@qucis.queensu.ca (Alejo Hausner)
Subject: Re: DES (Was: Re: 800MHz Trunked Radio System Signals)
Summary: Lock picking isn't worth it.
Organization: M.Sc, C.S, Queen's, Kingston, Canada.
Date: Thu, 31 Dec 1992 03:06:57 GMT

In article <herman.725755696@phage> herman@nosc.mil (John W. Herman) writes:
>smb@research.att.com (Steven Bellovin) writes:
>
>
>One other point, any examination of the open literature regarding
>protection of sensitive information reveals that the easiest way to get
>access to that information is by corrupting someone with access.  In
>commercial endeavors, this is frequently very easy since only money and
>honor are involved.  Other popular methods are illegal entry and bugging
>of various types.  None of these techniques require any cryptographic
>capability.  (When was the last time you checked your mechanical pencil
>to see if it was bugged.)
>

This reminds me of something I read on alt.locksmithing.  The analogy
between an encryption system and a lock on the door applies here.
Locks are meant to keep out respectable citizens, not thieves.

Burglars will not usually go to the trouble of picking the lock on the
door.  It usually takes too much time.  Besides, it takes years to
learn the technique (tools are not hard to get).

Instead, they usually kick the door in, or break a window.

Alejo Hausner (hausner@qucis.queensu.ca)

Newsgroups: sci.crypt,alt.security.pgp,alt.security.ripem