HDTenEightyP/NetNews huggingface dataset:
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Legal Stuff!
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Wed, 23 Dec 1992 18:50:40 GMT

In article <bontchev.725109870@fbihh> bontchev@fbihh.informatik.uni-hamburg.de writes:
>smb@research.att.com (Steven Bellovin) writes:
>
>> I just asked a patent attorney I know.  Importing a patented device
>> into the U.S. constitutes infringement, as does making, selling, or using
>> the device.  Lots of other obvious loopholes are covered as well.
>
>Very interesting... Thanks for clearing this up. So, the next time I
>visit the States, I should be careful with my dentbrush... It's a
>special model that might be patented there... I'd better check with a
>lawyer... :-))
>

Most countries have such laws, to prevent the mass import of
counterfeits of patented or copyright materials, and to protect
exclusive distribution arrangements. Customs inspectors usually allow
the import of a single item for personal use if it's
non-controversial.  Thus your toothbrush would be o.k., but not PGP.

-- 
David Sternlight
RIPEM key on server
Newsgroups: sci.crypt,alt.security.pgp,alt.security.ripem
From: gardner@convex.com (Steve Gardner)
Subject: Re: Legal Stuff!
Date: Sat, 26 Dec 1992 01:11:39 GMT
Organization: Engineering, CONVEX Computer Corp., Richardson, Tx., USA
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.


In article <QHZVBBVV@cc.swarthmore.edu> eoliver@ralph.cs.haverford.edu (Erik Oliver) writes:
>At the risk of getting myself into deep **** (choose the word of your
>choice), I must say, that I see the import and installation of PGP on my
>machines and my usage of it as a form of protest.
	Good.  Let the tea party begin. ;-)  You sound like a patriot to me.

>By privately maintaining floppies with source code as well as installing
>PGP on my machine, I am guaranteeing my ability to securely use my
>computer without pryihng eyes reading my files.  Also, I am protesting
>the idea that software/algorithms are patentable.  
	Good, I wish it were obvious to more people how stupid the concept
	of a software patent is.  Imagine having to pay Newton for the 
	algorithm for calculating the derivative of a polynomial. . . 
	Utterly ridiculous.  It amazes me how many engineers fall for this
	foolishness.  I think it is because they harbor false hopes of
	profiting from it.  They seem not to realize that most inventions 
	aren't REALLY owned by the people who created them but instead by
	money men who own the ideas of the "kept" engineers that make up 
	the vast majority of working engineers and scientists in this
	country.


							smg


Newsgroups: sci.crypt
From: dave@tygra.Michigan.COM (David Conrad)
Subject: Re: Opinions on RSA's RC2 and RC4?
Organization: CAT-TALK Conferencing System
Date: Wed, 23 Dec 1992 14:52:29 GMT

In article <bontchev.725111504@fbihh> bontchev@fbihh.informatik.uni-hamburg.de writes:
>karn@servo.qualcomm.com (Phil Karn) writes:
>> Yeah. If NSA will let them out of the country, then they can't be very
>> good at all. It's as simple as that.
>
>Hmm... I've heard ... that there is an exportable
>version of MailSafe, which is limited to 512 (... 540?) bit keys
>... Does that mean that NSA can factor such
>numbers?...

Probably not.  Was it not that the reduction in key size for DES from
128- to 56-bits (with redesigned S-boxen) resulted in a stronger cipher
once differential cryptanalysis was taken into account?

Perhaps I remember wrong, I'm no expert.  The U.S. has somewhat
skewed views on these things, but this still isn't France.

David R. Conrad
-- 
=  CAT-TALK Conferencing Network, Computer Conferencing and File Archive      =
-  1-313-882-2209, 300bps-14400bps, V.32/V.32bis/TurboPEP New users use 'new' - 
=  as a login id.  AVAILABLE VIA PC-PURSUIT!!! (City code "MIDET")            =
   E-MAIL Address: dave@Michigan.COM
From: dick.zeitlin%acc1bbs@ssr.com (Dick Zeitlin) 
Newsgroups: sci.crypt
Subject: Re: PKP/RSA comments on P
Date: 22 Dec 92 12:04:00 GMT
Distribution: world
Organization: Advanced Computer Concepts BBS, New Rochelle, NY 914-654-1981
Reply-To: dick.zeitlin%acc1bbs@ssr.com (Dick Zeitlin) 

DS = David Sternlight

DS> .Steve Gardner's response that nobody is harmed by cryptography is
  > .appalling. Consider the lives lost or saved through cryptographic
  > .activities during wars, anti-terrorism, drug enforcement, etc.

I believe you're using "cryptography" in the above statement where it
would be more accurate and appropriate to use "message concealment."
Cryptography is certainly one mechanism for message concealment, but
there are many others.  I hope you're not suggesting that all message
concealment should be discouraged.

Once you allow for message concealment, you should allow for _effective_
message concealment, by the "good guys" as well as the "bad guys."
Somehow the definitions of "good guys" and "bad guys" seem to be very
dynamic.

        D/
---
 . QMPro 1.0 41-3345 . Bring back A-N airways!!    Dick.Zeitlin%acc1bbs@ssr.com
Newsgroups: sci.crypt
Subject: Re: Federal Taxes -- Online? Encrypt/Decrypt part of the Package?
From: pgut1@cs.aukuni.ac.nz (Peter Gutmann)
Date: Mon, 4 Jan 1993 00:01:44 GMT
Organization: Computer Science Dept. University of Auckland

In <1i4ou1INNnjn@usenet.INS.CWRU.Edu> bz223@cleveland.Freenet.Edu (Danny Guy Frezza) writes:


>	I have a question:  for some who may use a modem to receive their
>tax refunds from the Federal Government, does the Government employ 
>some form of encryption/decryption utility in the delivering/sending of
>sensitive information?

This doesn't directly answer your question, but I know that Inland Revenue in
NZ uses an incorrect DES implementation run in ECB mode to protect its data
(on the other hand they only want to keep out casual browsers, I don't think
it's worth the effort using some high-security system when there are 1001 other
ways to get tax information).

Peter.
--
    pgut1@cs.aukuni.ac.nz || peterg@kcbbs.gen.nz || peter@nacjack.gen.nz
			   (In order of preference)
Newsgroups: sci.crypt,alt.security.pgp
From: gtoal@pizzabox.demon.co.uk (Graham Toal)
Subject: Re: PKP/RSA comments on PGP legality
Organization: Cuddlehogs Anonymous
Date: Tue, 22 Dec 1992 01:21:07 GMT

In article <1992Dec21.155528.15433@cbnews.cb.att.com> jap@cbnews.cb.att.com (james.a.parker) writes:
:Mr. Sternlight:
:
:Jyrki may not be an American native or citizen, but he has a grasp of U.S.
:law and history that probably would put him in the 95th percentile of
:U.S. citizens.  He is not at all anti-American, just anti-American government
:-- a position which is both sensible and admirable.
:
:You have just lost what little credibility you may have had with me.

To quote our national poet,

"Would the Lord the gift tae gi'e us, tae see oursel's as others see us."

G
Newsgroups: sci.crypt,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PKP/RSA comments on PGP legality
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Mon, 21 Dec 1992 07:57:54 GMT


Steve Gardner also ignores facts he must know in order to minimize
the seriousness with which the government takes crypto, by trying
to compare crypto to good boots (in order to make it appear silly
to consider crypto as munitions). Thousands of lives have been
saved by crypto, and several generals have referred to the 
Enigma and Purple decrypts as worth several divisions. Though
some may want universal secure cryptography, and make arguments
in support of it which are rational (though not without the
possibility of counter-argument), it is not possible to make
an argument that governments don't take crypto seriously,
and with good reason, because the data are incontrovertible.

David

P.S. I am not nor have I ever been a Jesuit, though I knew several
doing Ph.Ds in theoretical physics when I was at M.I.T., and
admired them enormously.
From: philip@meiko.com (Philip Gladstone)
Newsgroups: sci.crypt
Subject: Re: Exporting password protection
Date: 22 Dec 92 03:02:02 GMT
Distribution: usa
Organization: Meiko Scientific Corp.

bill@texan.rosemount.com (William Hawkins) writes:
[stuff deleted]
: the data
: encryption algorithm is RC4 and/or RC2 with a key space of 40
: bits.  It is noted that RC4 and RC2 are proprietary to RSA
: Data Security, Inc.  

Is there a published description of these algorithms anywhere? If not,
then does anyone know if software incorporating these algorithms has
actually been exported out of the US?

Philip
Newsgroups: sci.crypt,alt.sources
From: rdippold@cancun.qualcomm.com (Ron Dippold)
Subject: WP Cracker Source Code Prelude
Organization: Qualcomm, Inc., San Diego, CA
Date: Tue, 22 Dec 1992 17:51:53 GMT

Okay, I've had tons of mail from people saying "post it here!"  So
here goes, crossposted to alt.sources.  It comes in four parts:

	WPCRACK.DOC
	WPCRACK.C
	WPUNCRYP.DOC
	WPUNCRYP.C

It was written and compiled under Borland C, but I tried to make
everything as generic as possible, and it has been successfully
compiled on Unix systems (once I exchanged the non-standard "//"
comments for "/* */ comments).

-- 
The gods do not protect fools.  Fools are protected by more capable fools.
  -- Ringworld.
Newsgroups: sci.crypt,alt.security.pgp,misc.legal
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: Legal Stuff!
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Tue, 22 Dec 1992 13:19:28 GMT

In article <1992Dec21.203115.12176@netcom.com>, strnlght@netcom (David Sternlight) writes:
>Next Vesselin claims U.S. users may obtain PGP legally from a number
>of U.S. sites, which he lists. He is mistaken. It is on those sites
>illegally, for reasons stated just above, and ftping them to other
>U.S. sites is just as illegal. It does not matter who did the
>importing; possession of illegally imported munitions is illegal.
>Maybe in Bulgaria what is physically possible is equivalent to what is
>legal, but not in the U.S.

Could you site the law which makes this illegal?  Has anyone been
convicted of this?

//Jyrki
Newsgroups: sci.crypt
From: smb@research.att.com (Steven Bellovin)
Subject: Re: RIPEM vs. PGP
Date: Thu, 24 Dec 1992 15:27:27 GMT
Distribution: na
Organization: AT&T Bell Laboratories

In article <842074929DN5.61R@tanda.isis.org>, marc@tanda.isis.org (Marc Thibault) writes:
>     Why not wait (or not) until the RSA patent expires and join the
>     rest of the world with PGP? The IDEA is crypto tech that everybody
>     understands and doesn't have any secret design parameters. It's
>     also a heck of a lot easier to implement than the DES.

Well, it's 7 years till the RSA patent expires.  As for IDEA -- it's
patented, too, which certainly restricts the use of PGP for commercial
purposes.  And at least some of DES's secret design parameters are now
known to have strengthened it.  FEAL was *much* weaker than DES because
it didn't possess those secret attributes.  That you don't understand
something about a cryptosystem doesn't mean that it's necessarily weaker.
It just means that the designers know more than you do.
Xref: sparky sci.crypt:6100 alt.security.pgp:390
From: karn@servo.qualcomm.com (Phil Karn)
Newsgroups: sci.crypt,alt.security.pgp
Subject: Re: export rules -- a new wrinkle
Date: 23 Dec 92 05:17:14 GMT
Article-I.D.: qualcomm.1992Dec23.051714.16866
Organization: Qualcomm, Inc

In article <1992Dec23.022218.803@ulysses.att.com> smb@research.att.com (Steven Bellovin) writes:
>     (If your the treaty between your country and the United States did not
>     require you to respect U.S. export control restrictions, then you would
>     not have Internet connectivity to this host.  Check with your U.S. embassy
>     if you want to verify this.)

This is an interesting assertion, since all it takes to get "internet
connectivity" these days is a PC and a modem on an ordinary telephone
line that can call into a SLIP or PPP server anywhere in the world..

Phil
Xref: sparky sci.crypt:6207 news.groups:24923
From: magnus@thep.lu.se (Magnus Olsson)
Newsgroups: sci.crypt,news.groups
Subject: Re: sci.crypt.research
Date: 27 Dec 92 13:52:35 GMT
Organization: Theoretical Physics, Lund University, Sweden

In article <1992Dec26.130926.8025@infodev.cam.ac.uk> rja14@cl.cam.ac.uk (Ross Anderson) writes:
>In <Bzru3E.1I4@chinet.chi.il.us> schneier@chinet.chi.il.us (Bruce Schneier) 
>writes:
> 
>>Anyone besides me sick of all the political discussions?  How about splitting
>>this into sci.crypt.science and sci.crypt.politics?  Or booting all of the
>>political talk to alt.security--and having someone moderate this newsgroup to
>>ensure compliance?
>
>I agree.
>
>However, in the interests of naming consistency, we should probably keep 
>sci.crypt for the hobbyists and create a new group called sci.crypt.research 
>for academic researchers. 
>
>Look at sci.math and sci.math.research; the partition works pretty well.

I think sci.crypt.research would be a good idea. It would probably have
to be moderated to keep the political posts away, but I think the
moderation policy shouldn't be too strict (i.e. posts shouldn't be
rejected because they aren't up to academic standards, but only
if they don't agree with the charter of the group, or if they
only restate what's been said earlier).

Does anybody feel like posting a formal RFD (Request For Discussion)
to news.announce.newgroups? 

BTW, I most emphatically think that it would be a bad idea to moderate
(i.e. censor) sci.crypt - the right way to go is to create a new,
moderated, low-noise group.

And sci.crypt.politics would be a good idea if it'd work, but I'm
afraid it wouldn't keep the politics out of sci.crypt. Look at all the
political posts that are crossposted between sci.space and
talk.politics.space, for example.

              Magnus Olsson                | \e+      /_
    Department of Theoretical Physics      |  \  Z   / q
        University of Lund, Sweden         |   >----<           
 magnus@thep.lu.se, thepmo@seldc52.bitnet  |  /      \===== g
PGP key available via finger or on request | /e-      \q
From: gerben@rna.indiv.nluug.nl
Newsgroups: sci.crypt
Subject: Re: Non-U.S. crypto laws
Date: 22 Dec 92 16:38:10 GMT
Organization: G.R.O.S.S.

In article <1992Dec21.203915.14465@netcom.com> strnlght@netcom.com (David  
Sternlight) writes:
> 
> I've been reading a number of messages by those outside the U.S.
> who claim PGP is legal there.
> 
> I'm curious.

I can tell you about two countries.

The Netherlands:

	It is legal. There are also laws that protect individual privacy against  
(government) infringement. There is one person at the justice department currently  
researching the issue.

France:

	A law has been passed, stating you need a permit to use cryptohgraphic  
soft- or hardware. But the law is not in effect yet, because they still have been  
unable to think of a workable scheme to implement it. So currently, it is legal,  
but it might become illegal as soon as the implementation has been arranged.
-- 
Gerben Wierda                 Tel. (+31) 35 833539
  "If you don't know where you are going, any road will take you there."
  From the Talmud(?), rephrased in Lewis Carroll, "Alice in Wonderland".
Newsgroups: sci.crypt
From: jlnance@eos.ncsu.edu (JAMES LEWIS NANCE)
Subject: Anyone know about FEAL-8
Originator: jlnance@volt.ece.ncsu.edu
Keywords: FEAL-8
Reply-To: jlnance@eos.ncsu.edu (JAMES LEWIS NANCE)
Organization: North Carolina State University, Project Eos
Date: Tue, 22 Dec 1992 13:49:51 GMT


I have been reading a 1988 paper by Miyaguchi, Shiraishi, and Shimizu in which
they describe an encryption algorithm they call FEAL-8.  I am interested in
this algorithm because it was designed to run quickly on computers.  I have 
never heard of it anywhere before and I have the following questions about it.
Can anyone help me?

1) Is FEAL-8 Secure (as compared to DES)?

2) Is C source code available for it anywhere?

3) Is it patented

4) Is it a good choice for a fast, secure private key method?


Thanks for any help you can give me.


Jim Nance
Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: Re: Opinions on RSA's RC2 and RC4?
Organization: Chinet - Public Access UNIX
Date: Wed, 23 Dec 1992 19:48:21 GMT

In article <bontchev.725111504@fbihh> bontchev@fbihh.informatik.uni-hamburg.de writes:
>karn@servo.qualcomm.com (Phil Karn) writes:
>
>> >Does anyone have an opinion on the technical merits of RC2 and RC4?
>
>> Yeah. If NSA will let them out of the country, then they can't be very
>> good at all. It's as simple as that.
>
>Hmm... I've heard (rumours, rumours...) that thre is an exportable
>version of MailSafe, which is limited to 512 (or was it 540?) bit keys
>(or was it moduli?)... Does that mean that NSA can factor such
>numbers?... Would be a pretty serous advancement in mathematics, not
>just in cryptography... It would also mean that they find cracking the
>key easier than the other forms of attack... Could somebody in the USA
>check that there is indeed an exportable version of MailSafe and see
>what the max key size is?
>
I have a copy of the MailSafe manual sitting in front of me.  It's the U.S.
domestic version--and it says that the modulus size is 400 bits.  Also, "you
can purchase...files for generating larger keys from RSA Data Security...."
I have no idea about the exportable version.

Regarding RC2 and RC4, their primary claim to fame is that they accept
variable-length keys.  The NSA is willing to let them be exported as long as
the key length is less than 40 bits (or maybe it's 40 bits or less--I forget).
Some simple calculations should convince you that this key length is very
succeptible to a brute-force attack.

Some literature from RSADS counters that the key generation for RC2 and RC4
are very lengthy.  This doesn't mean much for encrypting large files--you do
the key generation once in the beginning, and then encrypt successive data
blocks.  However, if you are trying one key after another, this will greatly
increase the time required for a brute-force attack.  To me this is a red
herring.  It would be very easy to encrypt a commonly used block in every
possible key, and then store all the ciphertexts on a dozen or so magnetic
tape cartridges.  After that, a chosen-ciphertext attack with one ciphertext
block goes as fast as the tape I/O.

Bruce


Newsgroups: sci.crypt,alt.security.pgp,alt.security.ripem
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Legal Stuff!
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Sat, 26 Dec 1992 11:01:16 GMT


Steve Gardner writes:
"Imagine having to pay Newton for the 
        algorithm for calculating the derivative of a polynomial."

Actually, Sir R.A. Fisher did something somewhat analogous to that
(the publication/ academic equivalent). He invented the method of
maximum likelihood, a powerful general method for deriving all sorts
of statistical tests, and kept it a secret. He then derived one test
after another, published each one separately in the journals, and got
payment for each usage of the method, in effect, in the form of kudos
if not money.

As I recall hearing, his secret came out only at the end of his life,
or perhaps even after he was dead.

I promise you, if Newton lived today and developed the calculus,
he or his university would try to patent as much of it as possible,
probably in the form of various applications of the algorithms. Of
course Leibnetz would have been racing him for the German rights, and
Hewlett Packard would probably have hired them both to develop
patented ROMs for their calculators.

:-)

David
.

-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail
From: karn@servo.qualcomm.com (Phil Karn)
Newsgroups: sci.crypt
Subject: Re: PGP - Legal?
Date: 4 Jan 93 00:41:07 GMT
Article-I.D.: qualcomm.1993Jan4.004107.25668
Organization: Qualcomm, Inc

In article <1993Jan3.193639.1398@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>As to PGP, it is in the realm of possibility that if the U.S.
>Government wished and knew about it, he can be accused of
>espionage and expelled.

Espionage? For obtaining unclassified information that is very widely
and readily available to anyone in the US? And outside too? First
there was NSA's brief threat to prosecute John Gilmore for what he
found in a public library. Now this.  My, what a country we live in.
With constitutional democracies like ours, who needs fascist
dictatorships?

Dave, you'd better start rehearsing your confirmation hearings.
You're a sure candidate for the Supreme Court the next time a
Republican takes the White House.

Phil
From: jwh@cs.bham.ac.uk (James Hawtin)
Newsgroups: sci.crypt
Subject: Breaking RSA?
Date: 22 Dec 92 06:58:41 GMT
Reply-To: jwh@cs.bham.ac.uk
Organization: School of Computer Science, The University of Birmingham, UK

Ok so I understand now how the RSA system works, I am sure others have already asked
but what is the best way to attack it?

Lets say we were encoding only using RSA and I can get the source to encode any number
I like, and I know public key and modulus. What is the best line of attack? Getting it
to encode numbers such as 2,4,8 etc?

Also how long are the predicted times to break keys such as 256 bit or 1024 bit?


			James.
Newsgroups: sci.crypt,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Legal Stuff!
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Mon, 21 Dec 1992 20:31:15 GMT

In article <bontchev.724943800@fbihh> bontchev@fbihh.informatik.uni-hamburg.de writes:
>strnlght@netcom.com (David Sternlight) writes:

>
>> Thus PGP does not violate the restriction
>> against exporting DES since it doesn't use DES, though it cannot be
>> imported legally into the U.S. where it violates RSA's patents. Some
>> argue it can't be imported into the U.S. without a Munitions Act
>> license either.
>
>The above statement, is a complete mess.

No, it carries two separate thoughts: 1. PGP cannot be imported legally
since it violates RSA's patents. Patents cover copying, possessing,
or use, and where Vesselin got the idea U.S. patents cover only
use is beyond me.  2. PGP cannot be imported legally since
it violates the Munitions Act/ITAR, which requires a license for
importing, as well as exporting crypto, and PGP contains IDEA.

Next Vesselin claims U.S. users may obtain PGP legally from a number
of U.S. sites, which he lists. He is mistaken. It is on those sites
illegally, for reasons stated just above, and ftping them to other
U.S. sites is just as illegal. It does not matter who did the
importing; possession of illegally imported munitions is illegal.
Maybe in Bulgaria what is physically possible is equivalent to what is
legal, but not in the U.S.

David

Xref: sparky sci.crypt:5979 talk.politics.misc:64999
From: jkreznar@ininx.UUCP (John E. Kreznar)
Newsgroups: sci.crypt,talk.politics.misc
Subject: Re: PGP as a World Standard
Summary: How do you know he's not?
Date: 21 Dec 92 07:36:03 GMT
Followup-To: sci.crypt
Organization: Independence Industries, Los Angeles

In article <BzHF96.IAK@world.std.com>, jeffb@world.std.com (Jeffrey T Berntsen) writes:

> BTW, I also think PKP is missing out in a major way by not having David on
> their payroll...

How do you know they haven't?  I've been suspicious for nearly a week
now that he _is_ their agent.  It's the most parsimonious explanation
for his absurd position.
-- 
        Relations among people to be by mutual consent, or not at all.
         ---John E. Kreznar, jkreznar@ininx.com, uunet!ininx!jkreznar