HDTenEightyP/NetNews huggingface dataset:
From: mrr@scss3.cl.msu.edu (Mark Riordan)
Newsgroups: alt.security.ripem
Subject: Re: RIPEM: Output file of 0 bytes necessary if error occurs?
Date: 8 Jan 93 22:26:41 GMT
Organization: Michigan State University
NNTP-Posting-Host: scss3.cl.msu.edu
X-Newsreader: TIN [version 1.1 PL6]

Danny Guy Frezza (bz223@cleveland.Freenet.Edu) wrote:
: 
: 	I am just getting used to RIPEM, using version 1.0.2 for 386 msdos,
: and I have a question: Is it necessary, if one goofs, let's say in answering
: the password, for decrypting or maybe encrypting, while an -o option was
: specified followed by the name of the file on the command line, for RIPEM
: to exit by writing a file with 0 bytes? I am not really complaining, but
: was wondering if that is a good idea?

You're right--it's not a good idea.  I'll add this to the
list of things to change in RIPEM.

Mark R.
Newsgroups: alt.security.ripem,sci.crypt
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: Exportable RIPEM code available
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 12 Jan 93 22:14:24 GMT

mrr@scss3.cl.msu.edu (Mark Riordan) writes:

> A copy of RIPEM 1.0.3 source code, with all cryptographic code
> removed, is now available via anonymous FTP from ripem.msu.edu.
> I am now reasonably certain that this code is exportable, so
> non-USA users can now get it.  Without RSAREF, RIPEM is just
> a big mail header parser/DER-encoder/command-line parser/etc.

Great, so now I guess those users outside the USA who would like to
use RIPEM could try to rewrite the missing stuff... As a beginning, it
should be relatively easy to adapt one of the public domain DES
packages. And equivalent of RSAREF could probably be written using the
parts of PGP.

> Note that the code will not compile and link, and it certainly
> won't run, due to the lack of RSAREF and RSAREF's header files.

Ah, yes, indeed, this is a problem. Those header files actually
contain the interface to the RSAREF routines... Maybe RSA should be
asked to publish at least them freely? The interface alone does not do
any encryption, so there shouldn't be any problems exporting it...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: wingo@apple.com (Tony Wingo)
Newsgroups: alt.security.ripem
Subject: Re: What's troubling Dave Sternlight now....
Date: 12 Jan 93 20:47:29 GMT
Followup-To: alt.security.ripem,sci.crypt
Organization: Apple Computer

kstore and read.
> 
> >It's also inconsistent with what I know, since though DES may
> >be published, it's still not freely exportable. Ask any large
> >company, with adequate in-house legal staffs, who publishes DES.
> 
> Well, McGraw-Hill sells Andy Tennenbaum's (sorry if I misspelled his
> name) book on computer networks world wide, and it has full DES
> sources in it. I guess that their lawyers disagree with you. Even if
> they don't, whats the point -- the Russians already have damn good DES
> chips and have for years. Who cares if its illegal if the law serves
> no rational purpose?

No. David is right.  DES is widely published overseas as well as here. But
even given that fact, an American vendor may not EXPORT a product that DOES
DES, at least not without explicit permisission from the gummint.

I know, I know.  It doesn't make any sense to me either.  And I can assure
you that it is a royal pain in the behind for any person or company with a
product that performs encryption.  Especially since most foreign
competitors are not, to the best of my knowlege, saddled with such
restrictions.

-tony

>>usual disclaimer<<
Newsgroups: alt.security.ripem,sci.crypt
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: RSAREF and RIPEM now available via anonymous FTP
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Wed, 6 Jan 1993 23:14:52 GMT

In article <1993Jan6.224021.986@nntp.hut.fi>, jkp@cs (Jyrki Kuoppala) writes:
>Could someone please post the copyright notices of the RIPEM and
>RSAREF packages (or possibly just the code) here?

To partly answer my own question:

From: mrr@cl.msu.edu (Mark Riordan)
Newsgroups: sci.crypt
Subject: Announcing RIPEM 1.0
Summary: Release of RIPEM public key crypto program
Date: 23 Dec 92 02:36:46 GMT
Organization: Michigan State University
NNTP-Posting-Host: scss3.cl.msu.edu
X-Newsreader: TIN [version 1.1 PL6]

Announcing the availability of RIPEM 1.0, a public key encryption
program oriented toward use with electronic mail.

[ deleted ... ]

LICENSING

RIPEM itself (i.e., the code I wrote) is in the public domain.
However, RIPEM is based on RSA Data Security's RSAREF cryptographic
toolkit.  RSAREF is not in the public domain, but its authors, RSA
Data Security, do license it free of charge for non-commercial use.
Because RIPEM uses RSAREF, use of RIPEM is subject to the RSAREF
license agreement.

The RSAREF program license seems pretty straightforward.  It
can be obtained via anonymous FTP from rpub.cl.msu.edu, and is
distributed along with the RIPEM source.  Also, I intend to post
the RSAREF license to sci.crypt.  You should read the license before
using RIPEM, because use of RIPEM is dependent upon your agreeing
to the RSAREF terms.

[ rest deleted ]
Newsgroups: alt.security.ripem,sci.crypt
From: mrr@scss3.cl.msu.edu (Mark Riordan)
Newsgroups: alt.security.ripem
Subject: Re: Bug in RIPEM?
Date: 11 Jan 1993 03:42:43 GMT
Organization: Michigan State University
NNTP-Posting-Host: scss3.cl.msu.edu
X-Newsreader: TIN [version 1.1 PL6]

Darrell Long (darrell@cse.ucsc.edu) wrote:
: I'm getting "Can't allocate memory" if I use X to paste in the text of a
: message, but it works just fine from a file.

This is a strange one.  I'll have to investigate.
Thanks for the report.

Mark
Newsgroups: alt.security.ripem
From: Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu>
Subject: Re: Another bug in RIPEM?
X-Quoted: 33%
Organization: Computer Science Dept, Indiana University
Distribution: us
Date: Sun, 10 Jan 1993 22:08:07 -0500

Thus said darrell@cse.ucsc.edu (Darrell Long):
>If I set the RIPEM_KEY_TO_PRIVATE_KEY environment variable, I can encrypt but
>not decrypt.  For example,
>
>sequoia [2]% ripem -e -m encrypted -r darrell@sequoia | ripem -d
>Hello world!
>Private key could not be decrypted with this password.

Hmmm.... curious.

The fact that it complains "private key could not be decrypted with this
password" does not necessarily mean that the error was in the "ripem -d"
call; it probably was in the first call to RIPEM to encrypt.  Most likely,
there was something about the passphrase (spaces, shell metacharacters,
etc.) that didn't get to RIPEM unchanged.  Was "XYZZY" the passphrase?

I can't duplicate this bug; what does it show if you turn on debugging
output (-D 5)?
-- 
Marc VanHeyningen    mvanheyn@whale.cs.indiana.edu    MIME & RIPEM accepted
"I cannot recommend this candidate too highly or say enough good things about
him.  In my opinion you will be lucky to get him to work for you.  I urge you
to waste no time making him an offer.  No one would be better for the job."
Newsgroups: alt.security.ripem,sci.crypt
From: hamrick@convex.com (Ed Hamrick)
Subject: Re: RSAREF and RIPEM now available via anonymous FTP
Organization: CONVEX Computer Corporation, Richardson, Tx., USA
Date: Thu, 07 Jan 1993 20:56:45 GMT
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.

In article <1993Jan7.095453.29864@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>In article <1993Jan07.075317.15435@convex.com> hamrick@convex.com (Ed Hamrick) writes:
>>
>>The attached information clearly states that publicly available software
>>is freely exportable.  There aren't ANY weasel words about types of software.
>
>My reading of the English language seems to be somewhat different
>from Ed Hamrick's. His quoted material is shot through with what he
>calls "weasel words" and restrictions of all sorts, and is not as
>open and shut as he would like to make it seem. Apologies for not
>editing more than I've done--I'm only trying to show various
>kinds of restrictions in the language. Not all apply to the current
>case:

I wouldn't say it's written in English <smile>.

I agree with you that the text is full of weasel words, that's why I was
careful to include all of it instead of excerping parts.  However, I
must apologize for not being more clear about what I meant.  I really
meant to say that publicly available information, including software,
is exportable under this license.  The paragraphs you've excerpted focus
on preventing some types of information from becoming publicly available.
The government's strategy appears to be to attempt to control the information
that becomes public by contractual pre-publication review.  This is a
pragmatic approach, because of the impracticality of controlling access to
information in bookstores, libraries, and anonymous ftp.

The sections you excerpted describe types of non-publicly available information
(such as research results subject to pre-publication review) that are not
automatically exportable.

The focus of my premise is that IF it's already publicly available information,
it is freely exportable.  I find nothing in what you've quoted that makes me
believe otherwise, but I would readily concede that there may be something
subtle buried in this mess that may say otherwise.  If you can find it, I'd
appreciate your pointing it out.

I can't find any weasel words which talk about _types_ of publicly available
information, such as public information about cryptographic techniques
and algorithms.  Once the cat's out of the bag, it's fundamentally
uninteresting for NSA, the State Department, and the Commerce department
to try to limit the spread of the information.

Regards,
Ed Hamrick
Newsgroups: alt.security.ripem
From: burt@chirality.rsa.com (Burt Kaliski)
Subject: RSAREF and RIPEM now available via anonymous FTP
Organization: RSA Data Security, Inc.
Distribution: alt
Date: Wed, 6 Jan 1993 14:37:46 GMT

RSAREF is now available via anonymous FTP to 'rsa.com'. Along with
RSAREF you can get RIPEM, Mark Riordan's RSAREF-based privacy-enhanced
mail application, and an Emacs command interface to RIPEM. See the
file 'README' in the FTP directory 'rsaref' for more information.

Sorry, U.S. persons only.

-- Burt Kaliski
RSA Laboratories
Xref: sparky alt.security.ripem:41 sci.crypt:6467
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Newsgroups: alt.security.ripem,sci.crypt
Subject: Re: RIPEM Access
Date: 7 Jan 93 00:33:56 GMT
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland

In article <bontchev.726359270@fbihh>, bontchev@fbihh (Vesselin Bontchev) writes:
>Actually, not. The README file describes how to download the package,
>but I didn't read it - I was told how to get the package by a friend.
>He just specified the full path of the files that I needed to
>download. Only after I got the package and began reading the
>documentation I found out that the export of this software is still
>restricted and I shouldn't have it... :-)

So I guess now we'll just say "oops" and note that the cat is out of
the bag.  According to information here the RIPEM code is in the
public domain so now that the accident has happened there's no problem
with further distributing it.

The questions only remain whether there will be men with dark glasses
and machine guns to say "Hi" at the airport/border if Vesselin ever
decides to visit USA, and whether the country of Vesselin's residence
will face the same fate as Panama.

//Jyrki
From: palmer@icat.larc.nasa.gov (Michael T. Palmer)
Newsgroups: alt.security.ripem
Subject: Is RSA too slow for whole message?
Date: 12 Jan 93 13:50:39 GMT
Organization: NASA Langley Research Center, Hampton, VA  USA
NNTP-Posting-Host: icat.larc.nasa.gov
Keywords: RSA, RIPEM

Is the RSA algorithm simply too slow to use for even short messages?
Like, on the order of one or two sentences up to one or two paragraphs?
Would the security of a RIPEM message be enhanced by not using DES at
all?

I can understand that if you wanted to transmit the draft of your new
book to your publisher you'd want something fast, but most of my email
is less than one page long.  What sorta time would I be looking at to
encrypt solely with RSA?  Could this option be (easily) added to RIPEM
(and PGP for European readers).  Would this make it easier for RIPEM
and PGP to communicate?

The machines used for this range from a 386/33 PC to an Iris Crimson.
If anyone has some timing data I'd love to see it.  Thanks.

-- 
Michael T. Palmer, M/S 152, NASA Langley Research Center, Hampton, VA 23681
Voice: 804-864-2044,   FAX: 804-864-7793,   Email: m.t.palmer@larc.nasa.gov
RIPEM Public Key now available  --  Consider it an envelope for your e-mail
Newsgroups: alt.security.ripem
From: markh@wimsey.bc.ca (Mark C. Henderson)
Subject: Re: RSAREF and RIPEM now available via anonymous FTP
Organization: Wimsey Information Services
Distribution: alt
Date: Thu, 7 Jan 1993 17:51:18 GMT

In article <C0GI7J.6so@wimsey.bc.ca> markh@wimsey.bc.ca (Mark C. Henderson) writes:
>In article <BURT.93Jan6093746@chirality.rsa.com> burt@chirality.rsa.com (Burt Kaliski) writes:
>>RSAREF is now available via anonymous FTP to 'rsa.com'. Along with
>>RSAREF you can get RIPEM, Mark Riordan's RSAREF-based privacy-enhanced
>>mail application, and an Emacs command interface to RIPEM. See the
>>file 'README' in the FTP directory 'rsaref' for more information.
>>
>>Sorry, U.S. persons only.
>>
>>-- Burt Kaliski
>>RSA Laboratories
>
>Why not Canadians?
>Considering that RSAREF has been distributed to Canadian citizens on
>Canadian hosts the past, it seems strange that we are excluded
>from distrubution via anonymous ftp from rsa.com

I received the following response from burt@rsa.com:

} Export law requires that we submit a shipping declaration whenever we
} send RSAREF to Canada. We can do this for email distribution, but not
} for anonymous FTP, because we don't know who took the software.
} Perhaps we could request that Canadians who take RSAREF via anonymous
} FTP send email saying so, but I'm not sure yet that this is good
} enough. (Although it's probably no worse than saying "don't take
} it if you're not in the U.S. or Canada.")
} 
} -- Burt

Oh well. I don't really see how RSADSI could get around this easily.

Mark
-- 
Mark Henderson
markh@wimsey.bc.ca
RIPEM key available by key server/finger/E-mail
Xref: sparky alt.security.ripem:102 sci.crypt:6670
From: cgra@btma74.nohost.nodomain
Newsgroups: alt.security.ripem,sci.crypt
Subject: Re: What's troubling Dave Sternlight now....
Date: 11 Jan 93 14:34:24 GMT
Reply-To: cgra@se.alcbel.be
Followup-To: alt.security.ripem


I wish the UK government would get the cat-out-of-bag thing.  The Spycatcher
affair caused me a lot of trouble, having to scour Belgian bookshops trying
to find one that hadn't sold out just to get a copy for yet another friend
back home. To say nothing of carting bulky hardbacks over the North Sea.

__________________________________________________________________________
Chris Gray        | Any views expressed are those of the author and not of 
cgra@se.alcbel.be | any organisation with the author may be associated.
Xref: sparky alt.security.ripem:111 sci.crypt:6709
From: mrr@scss3.cl.msu.edu (Mark Riordan)
Newsgroups: alt.security.ripem,sci.crypt
Subject: Exportable RIPEM code available
Summary: RIPEM, minus RSAREF, is now freely available
Date: 12 Jan 93 16:18:15 GMT
Organization: Michigan State University
NNTP-Posting-Host: scss3.cl.msu.edu
X-Newsreader: TIN [version 1.1 PL6]

A copy of RIPEM 1.0.3 source code, with all cryptographic code
removed, is now available via anonymous FTP from ripem.msu.edu.
I am now reasonably certain that this code is exportable, so
non-USA users can now get it.  Without RSAREF, RIPEM is just
a big mail header parser/DER-encoder/command-line parser/etc.

Note that the code will not compile and link, and it certainly
won't run, due to the lack of RSAREF and RSAREF's header files.

The filename is /pub/crypt/ripem/ripem-1.0.3-no-crypto-stuff.tar.Z.
It includes RIPEM documentation, which is very short on 
cryptographic theory.

This code is in the public domain.

The export restrictions on the binaries and the full source
distribution remain in effect.

Mark R.
Newsgroups: alt.security.ripem,sci.crypt
From: karn@servo.qualcomm.com (Phil Karn)
Subject: Re: What's troubling Dave Sternlight now....
Organization: Qualcomm, Inc
Date: Fri, 8 Jan 1993 06:01:03 GMT

strnlght@netcom.com (David Sternlight) writes:
>It's troubling because it would permit any old provocateur to post
>restricted information on a bulletin board and then have it claimed
>that it was then exportable.

If you read that Q&A list for the Commerce regs, you'll note that it
addresses this issue directly. If somebody with access to classified
information publishes it, he's in deep doo doo whether or not he
exports it.  But once the information is out and freely available to
the US public, it's no longer restricted and can be freely exported by
anyone else because there's no longer any point in attempting to control it.

Example: several years ago, somebody with access to KH-11 spy photos
sent some pictures of a Soviet aircraft carrier under construction to
Jane's Defense Weekly. The photos were secret, and this guy ended up
going to jail. But Aviation Week then picked up and ran the same
photos, and so did William Burrows' book "Deep Black". And you didn't
hear a peep about this because the photos were already public.

Phil

Newsgroups: alt.security.ripem,sci.crypt
From: karn@servo.qualcomm.com (Phil Karn)
Subject: Re: RSAREF and RIPEM now available via anonymous FTP
Organization: Qualcomm, Inc
Date: Thu, 7 Jan 1993 08:37:40 GMT

In article <1993Jan07.075317.15435@convex.com> hamrick@convex.com (Ed Hamrick) writes:
>The attached information clearly states that publicly available software
>is freely exportable.  There aren't ANY weasel words about types of software.

Unfortunately, the information attached applies specifically to the
Commerce Department's "Core List" controls, *not* to the State
Department's ITARs (International Traffic in Arms Regulations). In
theory, the Core List controls "dual use" technologies (stuff with
both military and civilian uses, general purpose computer hardware
being the classic example) while the ITARs are supposed to regulate
only munitions (i.e., pure weapons, a Stinger missile being the
classic example.)

Unfortunately, the government can't seem to decide which category
(dual use/munition) crypto belongs in. ("It's a floor wax! No, it's a
dessert topping!") So in classic bureaucratic fashion, *both* sets of
export controls mention it. And to make things even more fun, there's
something called a "Commodity Jurisdiction Request" you can file in
this institutionalized turf war between State and Commerce to have
them battle out which set of rules applies to *your* proposed crypto
export.

In practice, whenever crypto is involved, NSA makes the determination.
If they can't crack it, they tell State to rule that it's ITAR
controlled, and thus not eligible for any of the Commerce Dept's
general licenses. If you don't like the determination, about the only
way you can get NSA to change it is to show them, step by step, how to
crack your cipher. This can include describing the Berlekamp-Massey
algorithm to them.

Your tax dollars at work.

Phil
Newsgroups: alt.security.ripem
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: RIPEM Access
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date:  6 Jan 93 22:27:50 GMT

strnlght@netcom.com (David Sternlight) writes:

> Since some have noticed that RIPEM is up on rsa.com for downloading, and
> have incorrectly inferred it is now available without condition,
> the following may be useful. Prior to being able to download it,
> one must read the license.

Actually, not. The README file describes how to download the package,
but I didn't read it - I was told how to get the package by a friend.
He just specified the full path of the files that I needed to
download. Only after I got the package and began reading the
documentation I found out that the export of this software is still
restricted and I shouldn't have it... :-)

> According to the announcement, it is available to U.S. Sites only,
> so presumably there is also some access control mechanism to enforce
> that.

It seems obvious to be so, I agree, but it isn't. The anonymous ftp
site rsa.com performs no filetring of the anonymous users by their
host. As stupid as it is...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bz223@cleveland.Freenet.Edu (Danny Guy Frezza)
Newsgroups: alt.security.ripem
Subject: RIPEM: Output file of 0 bytes necessary if error occurs?
Date: 7 Jan 1993 02:26:27 GMT
Organization: Case Western Reserve University, Cleveland, OH (USA)
Reply-To: bz223@cleveland.Freenet.Edu (Danny Guy Frezza)
NNTP-Posting-Host: hela.ins.cwru.edu


	I am just getting used to RIPEM, using version 1.0.2 for 386 msdos,
and I have a question: Is it necessary, if one goofs, let's say in answering
the password, for decrypting or maybe encrypting, while an -o option was
specified followed by the name of the file on the command line, for RIPEM
to exit by writing a file with 0 bytes? I am not really complaining, but
was wondering if that is a good idea?

-- 

Dan Frezza
Internet: bz223@cleveland.Freenet.Edu