HDTenEightyP/NetNews huggingface dataset:
From: strnlght@netcom.com (David Sternlight)
Subject: Re: RSAREF and RIPEM now available via anonymous FTP
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Sun, 10 Jan 1993 23:57:39 GMT

In response to John Kreznar:

[personal material omitted]

"his nation's arbitrary interference into the peaceful activities of
unaffiliated third parties, such as non- nationals who would trade in
encryption software?"

The U.S. is sovereign in its own territory and may make whatever laws
it wishes with respect to the activities of non-nationals within our
borders, regardless of where the non-national is physically located.
Non-nationals who live outside the U.S. but have accounts in U.S.
banks inside the U.S. must, for example, obey our banking regulations.
Electronic transmission of materials from or to the U.S. is covered
under this notion.  Such things as PGP 1.0 finding its way out of the
country, or PGP 2.x finding its way in do cross our sovereign borders.
Those are simple facts of physics.

Thus non-nationals who would trade in encryption software may freely
do so outside the U.S. within their own laws, but when it comes to
importing or exporting anything, to quote the old aphorism about
smoking, "Your right to smoke ends where my nose begins."

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Any way to *CREATE* Vcr+ (VCR PLUS) codes??? (please read)
Keywords: VCR+ patent
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Tue, 5 Jan 1993 19:11:38 GMT


As I understand things from my conversations with the inventor of the
VCR+ (they are down the street from me and make another wonderful
American success story--he's a very young recent Cal Tech graduate of
Chinese extraction who had a brilliant idea and seems to have done
everything right--the next American self-made multi-millionaire),
they provide the program to the stations on very stringent security
terms, to compute the codes. That was my info as of six months
ago--it may have changed--dunno. Back then, I noticed that two
sources of published codes, the L.A. Times and TV guide occasionally
had different codes for the same program, which suggests other
than a central source. (They weren't typos, and both worked.)

I don't know what his motives are on refusing to publish or give out
the algorithm, but if I were he, I'd behave that way in order to
avoid the legal costs and niusance of having to take infringers
to court. if that makes life harder for innocents who simply want
a few codes for personal use, that's unfortunate.

Further, the 900 number (it works by touch tones) MIGHT be a source
of revenue, though my guess is that it's run at a loss. I say that
because it isn't very highly publicized.

By the way, the local PBS station has now gotten on the bandwagon, and
their monthly program guide (KCET) carries the codes.

Finally, there seem to be two sets of codes. One, of up to six digits,
is for the standard start times (on the half-hour) and lengths (multiples
of 30 minutes). A second, of more digits, seems to be for the exception
cases. The first set has now been broken and a convenient pair of
"c" routines is making its way around the world. The second has not
yet been broken, as far as I can tell, but is mostly of interest only to
make sure the recordings of cable movies with odd ending times are
correctly stopped to avoid wasting tape.

Either the primary code is a table look-up in the chip, or it has been
broken by trial and error--the c routines work by table look-up.
Since there aren't as many published canonical instances of the
secondary code, it may be a while before it is broken.

-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt
From: jac54@cas.org ()
Subject: Re: DES (Was: Re: 800MHz
Organization: Chemical Abstracts Service, Columbus, Ohio
Date: Mon, 11 Jan 1993 17:25:02 GMT

In article <1993Jan10.060013.4644@csi.uottawa.ca> cbbrowne@csi.uottawa.ca (Christopher Browne) writes:
>
>If it "only" costs $56, then they must have some CHEAP ways to break
>DES, unless they're COMPLETELY ignoring the cost of computer
>resources.  In short, for $56 a pop, they can't be using brute force.
>Maybe they can use differential analysis.  Maybe they can use
>something analogous to D.A.  But for $56 per pop, they're either
>lying, or they have SOME "silver bullet."

	I have a modest familiarity with government accounting,
	being married to a government accountant, and it does
	work in mysterious ways but let me comment on this anyway.

	If the machine(s) had been bought for a specific purpose,
	e.g. reading DES, then the cost of the machine would have
	to be included in the cost of the decrypt.  If the machine
	was already present and being used to heat the parking tower
	in winter, then its purchase price need not be include in the
	cost of the decryption.  What would have to be included would
	be the cost of developing the decryption procedure, writing the
	software, mounting and debugging it.

	Then, of course, you can amortize these costs over the prime factors
	of the cost of a B-2 bomber...

	Alec Chambers
Xref: sparky sci.crypt:6573 alt.security.pgp:476
From: caronni@nessie.cs.id.ethz.ch (Germano Caronni)
Subject: Re: KH-11 pictures -
Organization: Swiss Federal Institute of Technology (ETH), Zurich, CH
Date: Sun, 10 Jan 1993 12:24:15 GMT

In article <1993Jan9.000917.22206@qualcomm.com> karn@servo.qualcomm.com (Phil Karn) writes:
>wavelengths from minimum orbital altitude.  I.e., the KH-11 is already
>operating damn close to the theoretical limits. It's simply not
>possible to do better without getting closer and/or using a larger
>mirror. The laws of physics are the same for classified projects as
>they are for the rest of us.

Isn't there a possibility to place some mirrors up there, align their 
positions by measuring distances between them with laser or whatsoever,
and then computationally combine the so won pictures ? Using something
like the Fresnell-Effect for lenses. I am just guessing, but I think
one could 'simulate' a bigger telescope (better resolution) by placing
some little telescopes at strategical points and combine the input. 
I thought I heard of something like this some time ago, but I can't 
remember well. So if anybody could clarify :-)
Greetings,
    gec

-- 
Instruments register only through things they're designed to register.
Space still contains infinite unknowns.

Germano Caronni    caronni@nessie.cs.id.ethz.ch
Newsgroups: sci.crypt,alt.security.pgp
From: karn@servo.qualcomm.com (Phil Karn)
Subject: Re: Name & Number of the Bills to restrict crypto
Organization: Qualcomm, Inc
Date: Mon, 4 Jan 1993 22:32:09 GMT


As far as anyone knows, there are *no* pending bills in the US
Congress to restrict the domestic use of cryptography. This whole
firestorm was started by one misguided private citizen, Dr. Dorothy
Denning, writing an article proposing a mechanism by which mandatory
cryptographic key registration could be implemented.

This is not to say, of course, that there aren't factions within the
government that would love to see Denning's proposal become law. But
that is not enough to pass or even introduce a bill in Congress.
Admiral Bobby Inman found this out a decade ago when, as Director of
the NSA, he stridently called for "born classified" controls on
academic cryptography resembling those of the Atomic Secrets Act. He
was roundly jeered and/or ignored. As Bamford said in the Puzzle
Palace, "Thus far, however, Inman's 'tidal wave' of public outrage
[over the open publication of cryptographic research] has yet to
dampen the soles of his shoes."

In other words, don't become complacent, but don't overreact either.

Phil
From: todd@palomar.tivoli.com
Newsgroups: sci.crypt
Subject: Re: How fast is DES?
Date: 11 Jan 93 06:16:50 GMT
Distribution: sci
Organization: Tivoli Systems, Inc.


In <1494@eouk9.eoe.co.uk>, Andrew Haley (ahaley@eoe.co.uk) writes

> Another possibility is using a hash function such as MD4 as a stream
> cipher generator.  One advantage of using stream ciphers is that the
> stream can be generated offline, so that when you want to transmit a
> message it can be done instantly.  The total processing time to
> encrypt will not be any less, but the stream can be generated while
> the processor would otherwise be idle, effectively reducing the
> encryption overhead to zero.

I'm not sure how practical this technique is, I believe that IBM owns
a patent on it.  And it won't be expiring for even further in the
future than the RSA patents!!!

--

Todd
-- 
Todd Smith                                     TIVOLI Systems, Inc.
todd@tivoli.com                                6034 West Courtyard Dr.
                                               Suite 210
(512) 794-9070 [794-0623 fax]                  Austin, TX   78730
Newsgroups: sci.crypt
From: pmetzger@snark.shearson.com (Perry E. Metzger)
Subject: Re: RIPEM and RSAREF available by anonymous ftp !!!
Organization: Partnership for an America Free Drug
Date: Fri, 8 Jan 1993 19:32:17 GMT

strnlght@netcom.com (David Sternlight) writes:
>
>Arthur Rubin posts a factually incorrect message echoing Perry
>Metzger's assertion that I'm the only one with my position on
>ITAR.
>
>I have the e-mail to prove otherwise.
>
>It's a common propaganda technique to try to squelch those with whom
>one disagrees by pretending they are somehow alone in their views,
>with the implication that "normal" people wouldn't have such views.

I'm not asserting you are the only one with these views. I am
asserting that you are the only one who is continuing to post on this
topic, over and over and over again. You remind me of the christians
posting "FIND JESUS OR BURN IN HELL!!!!" messages on alt.atheism. I'm
sure a couple of people agree with you, but you are the only person
around with the bad taste to whip the horse not only after it is dead
but even after it has decomposed. You aren't going to convince anyone.
Lay off.

--
Perry Metzger		pmetzger@shearson.com
--
Laissez faire, laissez passer. Le monde va de lui meme.
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Any way to *CREATE* Vcr+ (VCR PLUS) codes??? (please read)
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Wed, 6 Jan 1993 04:00:19 GMT


Curt Welch posts a fascinating explanation of the cracking of the
VCR Plus codes, replacing my speculation and inference with facts--
always welcome.

Good job.

Since some of the movies shown on Cable are of unusual length or
occur at odd times, and since it is convenient to be able to 
tape several shows in sequence without having to back up over
extraneous material at the end (especially if one is away), it would
be a real public service if Curt and his colleagues would find their
way clear to returning to the task for longer numbers.

By the way, I should have realized that one doesn't need published codes
to do the job--just a VCR Plus device and the time to punch in codes.
I'm not clear on one thing, though. The device doesn't tell you the
duration of the program, except to the nearest hour. How does one
determine that part of the coding system without using published
codes?

Finally, I wonder of Curt or any of his colleagues have compiled the
c code for the Mac?

-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Complete ITAR Available
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Mon, 11 Jan 1993 17:26:10 GMT


dik winter says following the logic of my message that PGP would
infringe ITAR only if it infringed the patent and thus the patent
case would have to be decided first.

That's not the way the law works. The patent is presumptively valid
unless and until it is overturned. Thus a conviction could be
obtained under ITAR (assuming the argument is correct), and the
issue of the patent's validity would have to be raised separately
or on appeal.

In any case, as I read the ITAR, it says what's permitted in
this area, not what's forbidden. Thus PGP (assuming the
argument) would not be permitted. Thus it's a violation,
since it's not included in what's permitted.

Before someone is tempted to respond with counter-arguments,
let me say that only an attorney can probably get to the
bottom of this, and the thread is already tiring many.

Out of respect for the sensibilities of those individuals,
let me say to make it easy to terminate this part of the
conversation that it's all speculation, counter-arguments
are perfectly valid, and let's move on. We're not going to
decide this one based on smart non-attorneys exercising
what they think to be logic, since the logic of the law
is quite different (and specialized) compared to "layman's
logic."

I have a position that says that at least it's risky, and I'm
not going to do it. Others have positions arising out of quite
different assumptions and motivations.

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail
From: Christopher_C_Lapp@cup.portal.com
Newsgroups: sci.crypt
Subject: Keys&Encrypts Transmitted Together
Date: Sat,  9 Jan 93 07:07:33 PST
Organization: The Portal System (TM)
Distribution: usa

I wonder if anyone has thought of including the key of a 
message with the message, in such a way that the key of the 
message was on the surface indistinguishable from the 
message.  An example might be a copy of the federal 
register.  The Federal Register is a daily publication that 
details federal regulations.  It is about 1000 pages on  a 
good day.  Suppose the encryptor referenced 1000 or so 
regulatory citations in an article about, say car emissions in 
California.  In another part of the 1000 page federal 
register, the exact regulations were given.  In yet another 
part of the Federal register, a regulation meeting 
description was given, citing a few regulations to be 
discussed, and the reasons for discussing them.  A 
decrypting party would look at the three articles, and see 
that the meeting announcement  filtered  the 1000 
regulations in another part of the FR, and those could be 
applied through some standard algorithm to the article 
about emissions in California.  The point is, the entire 
message is contained in one package, and the key is 
extracted from the sending signal.  Has this been tried?
 Chris Lapp
Newsgroups: sci.crypt
From: rcain@netcom.com (Robert Cain)
Subject: Re: Nonlinear Amplification of Information
Organization: Netcom - Online Communication Services  (408 241-9760 guest) 
Date: Sat, 9 Jan 1993 22:15:53 GMT

I have watched and crossed swords with Mr. Sternlight before in other
groups.  One thing to know about him is that in whatever group or
discussion in which he participates he manages to find the most
extreme, unpopular and self serving position he can to draw the most
flames, contoversy and attention.  He seems to me to be primarily a
net.masochist.  He argued vociferously in a local netcom group that
most of us there had no right to be on the internet because we had no
"legitimate" academic or research purposes whereas he of course did.
From the ammount of effort he puts in to it it seems that his area of
resarch is the sociology of net.confrontation.  This is just one
example, there are others.  Please consider this to reduce our noise
level before responding to or otherwise engaging his egocentricity in
the future.

I have been watching this example of his nonsense in silence because I
do not like engaging in personal or ad hominum attacks but he has
finally pissed me off sufficiently that feel I have to speak out.
While I too am a supporter and future licensee of RSA and PKP, with
friends like him they need few enemies.

On the subject of RSA and PKP, people should really find out for
themselves the facts regarding the cost and availability of licenses
from them before blindly attacking.  In my experience they are more
than reasonable.  I was astonished when I finally quit buying the net
legends and asked them.

Your shot David, but don't expect a response.

Bob
-- 
Bob Cain    rcain@netcom.com   408-358-2007

    'The meek shall inherit the earth--the rest of us will move on..'
                                                    Sameer Parekh


               PGP 1.0 or 2.0 public key available on request.
Newsgroups: sci.crypt,misc.legal.computing,comp.org.eff.talk
From: nagle@netcom.com (John Nagle)
Subject: Re: Complete ITAR Available
Organization: Netcom - Online Communication Services  (408 241-9760 guest) 
Date: Mon, 11 Jan 1993 03:47:33 GMT

hamrick@convex.com (Ed Hamrick) writes:

>I just got hold of what I think is the latest ITAR from the Federal
>Record, in electronic form (Compu$erve really is useful).  If anybody
>would like a copy of the whole thing, please send me e-mail and I'll send
>you a copy (it's 225 KBytes).

>I've extracted verbatim what I think provides convincing evidence that
>public domain software is not subject to the export controls of these
>regulations.  This extract is attached at the end of this e-mail.

      This is important.  Any comments from lawyers?

					John Nagle
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Zimmermann's responses to Sidelnikov's PGP critique
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Sat, 9 Jan 1993 01:39:36 GMT


In yet another cowardly post via an anonymous forwarding agency,
the writer claims to have checked the "computerized" visa
files.

Anyone who has cleared the border guard posts at Sheremetyevo Airport
has observed the primitive method they use to check visas by
sending them elsewhere via CCTV. Hardly "computerized." Anyone
who has actually seen the laboriously carbon-paper-typed visa
itself knows how primitive the system is there.

Even in the U.S. the visa files were computerized only relatively
recently.  Before that the immigration guys had to check your passport
in a book.

We have enought legitimate differences to discuss here without
being subjected to posts by jerks.

David 
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: NIST Conference on DSS 2/17/93
Date: 7 Jan 93 20:22:57 GMT
Distribution: usa
Organization: Stratus Computer, Software Engineering
NNTP-Posting-Host: ellisun.sw.stratus.com


In case anyone cares, NIST is having a conference on 2/17-18/93 in
Rockville MD about DSS/DSA and SHA.

The registration deadline is 1/26/93.

The cost is $200 (plus $88/night for a single room in a Holiday Inn for
those who want it).

Technical Info:  Miles Smid & Donna Dodson (301) 975-2921 FAX: 948-1233
Registration info: Tammie Grice (301) 975-2775 FAX: 948-2067

(This is from the announcement which showed up today in the mail.)

-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488
Newsgroups: sci.crypt,alt.security.pgp,alt.security.ripem
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Zimmermann's responses to Sidelnikov's PGP critique
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Sun, 10 Jan 1993 00:00:15 GMT


Rob Stampfli suggests there may be a problem with unix systems'
granularity in measuring the intervals between random characters
typed as part of the PGP key generation process.

I notice that one RIPEM public key in the public server file has its
first 34 characters identical to my ripem public key. Perhaps this is
related. It seems an unlikely coincidence, given that the two keys
were generated by different individuals, apparently on different
computers, and very likely at different clock times.

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt
From: Owen.Lewis@purplet.demon.co.uk (Owen Lewis)
Subject: Re: Limits on the Use of
Organization: FidoNet node 2:252/305 - The Purple Tentacle, Reading
Date: Tue, 5 Jan 1993 15:24:00 +0000

 -=> Quoting Jonathan Haas to All <=-

                
 JH> ...............(PGP)................ If the government tosses me in
 JH> jail for refusing to relinquish my private key as required by law,
 JH> it will likely get access to my UNIX account and all the files
 JH> contained thereon. My private key is protected by a password, and PGP
 JH> demands it each time I attempt to use it. Just how secure is PGP's
 JH> encryption of secret keys?

 
 Bull point. 
 
 The better the cryptography, the greater the need to attack an 
 information security system obliquely through its peripheral 
 vulnerabilities or lax management.
 In private hands, too often the discipline to build and maintain a 
 complete and strong security system is missing - even antipathetic to 
 libertarian concepts. Information security requires thinking through from 
 A-Z and to be made just as strong as as particular circumstances sensibly
 require.

 I think you correctly identify a potential vulnerability. What you or I 
 do about it is up to us an not the writers of PGP. Close attention must
 reveal many other potential weaknesses beyond the control of the writrs.
 To be fair, Phil Zimmermann points this out and alludes to several 
 potential causes of concern in PGP's documentation. 
 
 Fundamentally, security is always a relative term.




.. A truly wise man never plays leapfrog with a unicorn.
___ Blue Wave/QWK v2.11
From: wack@ariel.ncsl.nist.gov (John Wack)
Newsgroups: sci.crypt
Subject: Re: How to get a copy of NIST pub
Date: 12 Jan 93 13:43:28 GMT
Organization: National Institute of Standards & Technology

In article <1993Jan12.002340.15177@linus.mitre.org> hal@gateway.mitre.org (Hal Feinstein) writes:
>
>To get a copy of  NIST's special publication Public Key Cryptography
>(NIST special publication 800-2) you have to buy it from the US 
>government printing office. The best I can find is the usual 
>boiler plate: superintendent of documents, US government printing office
>washington, DC. 20402. I ordered my copy through an telephone order
>line that they have. But I had a detailed flier number to do it with.
>You might try to see if the clerk on the other end of the telephone
>can help you out. Its in NISTS reports on comptuer security series
>code number  NSPU2.  

Another way is to ftp it from our archive, HOWEVER WAIT FOR SEVERAL DAYS!
We just had the internal disk go bad and we're still waiting for that
"overnight" delivery to arrive!  But, by Wednesday or Thursday, Jan 14,
ftp to csrc.ncsl.nist.gov (129.6.54.11), user anonymous, and cd to 
pub/nistpubs, and get 800-2.txt.  Sorry, no .ps available.  I'll second
the recommendation for this text - it is a very good introduction to
cryptography and has enough math to really get you started.  And, it's
free!

-John Wack
From: karn@servo.qualcomm.com (Phil Karn)
Newsgroups: sci.crypt
Subject: Re: Motorola 'Secure-Clea
Date: 7 Jan 93 04:10:14 GMT
Article-I.D.: qualcomm.1993Jan7.041014.17859
Distribution: na
Organization: Qualcomm, Inc


The Commerce Dept's "Core List" (note: not the ITARs) exempts "fixed
band [analog] scrambling not exceeding 8 bands and in which the
transpositions change not more frequently than once every second",
"fixed band scrambling exceeding 8 bands and in which the
transpositions change not more frequently than once every ten seconds"
and "fixed frequency inversion in which the transpositions occur not
more frequently than once every second."

I think it's safe to assume that the NSA can easily crack anything
that fits within these limits.

I note that the very next paragraph controls items "designed or
modified to suppress the compromising emanations of
information-bearing signals", but then it notes: "does not control
equipment specially designed to suppress emanations for health or
safety reasons". You figure that one out.

Phil