HDTenEightyP/NetNews huggingface dataset:
From: strnlght@netcom.com (David Sternlight)
Subject: Re: A Silver Bullet to Limit Crypto?
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Wed, 11 Nov 1992 19:59:34 GMT


Timothy May posts a thoughtful message suggesting that the government
wishes (for what IT sees as perfectly good national security or crime
prevention reasons) to infringe on our right to be secure in our speech
and our papers by requiring key registration. Some have suggested these
government agencies might wish to go even further and outlaw the use
of cryptography by the general public.

It would seem to me that the fundamental issue is a Consitutional one.
Thus one would hope to make a civil liberties organization (the E.F.F.? the
ACLU?) well aware of this issue NOW, and attempt to secure a commitment
that they would move rapidly to challenge the constitutionality of any
such laws.

Stay with me here.  There's a long history of government agencies
avoiding constitutional tests in cases where they MIGHT lose, and the
loss would affect other activities they are currently involved in, or
would redefine power relations. Thus both the White House and the
Congress have avoided constitutional tests on such issues as
sequestering.

If the Justice Department, or the NSA, or the CIA knew that any
attempt to legislate "universal phone tapping" or crypto key
registration would produce an immediate constitutional test, they
might be deterred from pushing those issues, since a loss might mean
that many activities they currently engage in might also be found
illegal by such a Supreme Court decision.

I'll bet, for example, that there has not been a Court test of NSA's
right to intercept conversations between U.S. citizens and foreign
nationals. I'll bet, for example, that there has not been a Court
test of mail covers. I'll bet, for example, that there has not been a
Court test of the right of Presidents to order assasinations (now
discontinued), in peacetime, in the interest of "national security".

I've been reading a lot about the issue of whether foreigners in the U.S.
are protected by the Constitution. The "immigrant rights" community has
been making a strong case that they are. I don't know if they are right or
not, but if they are, then wouldn't employees of, say, the CIA who bribe
foreign officials on U.S. soil be on questionable ground (if they did such
things)? There is probably a huge area of activity that currently assists
our Government in counter-espionage, and in crime prevention (both
laudable activities) in the gray zone. I don't think, if it were put to
them, that officials would welcome either a Constitutional test or the
attendant publicity.

Something to think about.


-- 
David Sternlight
(pgp 2.0 and ripem public keys available on request)

Xref: sparky sci.crypt:4655 comp.org.eff.talk:6959 alt.privacy:2208 talk.politics.guns:24026
From: bz269@cleveland.Freenet.Edu (James D. Del Vecchio)
Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
Subject: Re: Registering "Assault Keys"
Date: 12 Nov 1992 11:24:11 GMT
Organization: Case Western Reserve University, Cleveland, OH (USA)
Distribution: inet
Reply-To: bz269@cleveland.Freenet.Edu (James D. Del Vecchio)
NNTP-Posting-Host: hela.ins.cwru.edu


In a previous article, gurgle@netcom.com (Pete Gontier) says:

>>...it would hurt.  History has proven this time and time again.
>>New York, Wash. DC, Chicago, all places that have banned guns and have
>>the highest crime rates in the country, with the crime rates rising
>>dramatically after the citizenry was unarmed.
>
>It might be that the U.S. is already too screwed up with weird
>judeo-Xian guilt/hate for a ban on handguns to result in anything but
>pandemonium. See? I'm a reasonable guy. I'm willing to fall back
>to the position: "In any *reasonable* society, this would work..."
>Like, perhaps, the majority of other western societies.

	Give one example of a country where their murder and violent
crime rate dropped as a result of a handgun ban.  I'll make it easy
on you in that you don't have to prove causation, merely show the
murder/violent crime stats for ten years following and preceeding
the ban.

	I don't think you will find one such country:  Perhaps
no "reasonable" societies as you think of them exist.

Jim Del Vecchio

>Remember, we're talking about kids finding Daddy's gun, here. 5%
>sounds to me like a lot less than the present percentage, and in
>the terms to which I'm so valiantly trying to limit the discussion,
>that's a Good Thing.
	
	Provide an example where a ban has solved this limited problem,
same crit as above.
Newsgroups: sci.crypt
From: ritter@cactus.org (Terry Ritter)
Subject: Re: A new encryption problem?
Organization: Capital Area Central Texas UNIX Society, Austin, Tx
Date: Fri, 13 Nov 1992 09:40:29 GMT


 In <1992Nov12.213519.9323@news.cs.indiana.edu>
 Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu> writes:


>If you search my apartment for evidence to use against me and find a
>document written in Chinese, can you force me to translate it into
>English for you?

 I have seen no proposal to change this.


>How about if it's in an obscure dialect, and nobody versed in it can be
>located?

 Nor this.


>In the case above, you can subpoena the plaintext.  Of course, you can't
>subpoena it from the guy himself, since that would be self-incrimination.
>Because such a law would violate Constitutional protection against
>self-incrimination, yes, it would be "somehow not a legitimate law."

 Right.  We are discussing the use of the new technology of
 computers and cryptography, and just what "rights" and "limits"
 apply to the new situation.


>However, personal information which is not obtainable
>without my cooperation (such as facts I have memorized) cannot be
>obtained without my consent for use against me.

 Nonsense.  Clearly you are not required to yield your memories.
 However, *anything* (you) write or "have" *can* be "obtained
 without (your) consent for use against (you)," provided only that
 a specific warrant does issue for probable cause.

 Before computers and modern cryptography, this was an issue which
 was not pervasive, and so did not need to be addressed.  Perhaps
 that is no longer the case.


>If you disagree with
>the Founding Fathers on this one, OK, but don't expect others to like
>that position.

 Apparently you have some direct connection to the Founding Fathers
 which I do not.

 Since I have access only to the document itself, I can only form
 an opinion by reading it, and I believe my position is entirely
 consistent with the Fourth Amendment.

 ---
 Terry Ritter   ritter@cactus.org


Newsgroups: sci.crypt
From: WHMurray@DOCKMASTER.NCSC.MIL
Subject: Shifting the Grounds
Organization: Yale CS Mail/News Gateway
Date: Fri, 13 Nov 1992 19:47:00 GMT


>But, whatever the state of the law actually is, I don't see any
>reason that cryptography requires any _special_ treatment.  It just
>isn't really different than a wall safe.

> The difference is that what was once rare and easily breached by
> the authorities is now on its way to becoming common and
> impenetrable.  Cryptography really is different from a wall safe.
>
cactus.org

It is cheaper and more effective.  It remains to be demonstrated 
whether that difference of degree is sufficient to constitute a
difference in kind.   However, if you want to treat it differently
under the law, then the burden of proof is on you;  the presumption
goes to me.

Likewise, the burden is on you to show that the different treatment
under the law would achieve some justifiable end.  You seem to think
that it is sufficient to demonstrate that such an end exists, while
ignoring the fact that your proposals, no matter how legislatively
and technically elegant, do not achieve that end.  You seem to want us 
to ignore the fact that all of the legislation and regulation
in the world will not put the technological djinn back in the bottle.  

Denying the legitimate use of technology will not prevent its illegitimate
use.  This is probably true in the general case, but is clearly true in this
one.

You have played a rhetorical trick in shifting the grounds
of the argument away from this fact, but you have not changed it.  If you
insist upon ignoring it while pushing your present line of argument, you will
put your motives into question.

William Hugh Murray, Executive Consultant, Information System Security
49 Locust Avenue, Suite 104, New Canaan, Connecticut 06840                
0 700 968 7729, WHMurray at DOCKMASTER.NCSC.MIL
From: lordSnooty@cup.portal.com (Andrew - Palfreyman)
Newsgroups: sci.crypt
Subject: Polynomial Deduction
Date: Sun,  8 Nov 92 19:05:26 PST
Organization: The Portal System (TM)
Distribution: world

On reading a couple of texts on error-correcting codes, the
following question occurred to me:

What is an efficient method for deducing the checksum generating
polynomial, given many examples of a block code with an appended checksum?

Andrew Palfreyman
Newsgroups: sci.crypt
From: pmetzger@snark.shearson.com (Perry E. Metzger)
Subject: Re: Encrypted phones, keys, taps, ...
Organization: /usr/local/lib/news/organization
Date: Tue, 10 Nov 1992 21:36:02 GMT

lcmyu@crypto2.uwaterloo.ca (Luis Ola Toshio Chi-Ming) writes:
>In article <1992Nov9.181433.12025@shearson.com> pmetzger@snark.shearson.com (Perry E. Metzger) writes:
>>Its all really easy. CELP compression can be done with cheap DSPs --
>>you can buy the code if you don't feel like writing it yourself. The
>>encryption can be done an order of magnitude faster than you need even
>>on conventional processors.  V.32bis modem modules are a dime a dozen.
>>You don't need to be AT&T to do this -- any talented EE with a few
>>weeks of work could put a system to do this together.
>
>Can someone tell me how these digitally encrypted phones provide
>reasonable security in light of the following problem.  Phones lines
>can tolerate raw data rates of 9.6 kbps whereas voice requires 
>64 kbps.  Let's say the CELP compression reduces the voice
>requirement down to 9.6 kbps (voice becomes noticibly choppy thereafter).
>Where do they allocate the bandwidth needed for sycronization and error
>correction.

CELP produces very good voice at 4800 bits/second. V.32bis does
14kbits/sec very reliably. Does this answer you questions?

--
Perry Metzger		pmetzger@shearson.com
--
"They can have my RSA key when they pry it from my cold dead fingers."
Libertarian Party info: Phone 1-800-682-1776, E-Mail 345-5647@mcimail.com
Newsgroups: sci.crypt
From: boyd@acsu.buffalo.edu (Daniel F Boyd)
Newsgroups: sci.crypt
Subject: Re: New Encryption System - Challenge!
Summary: You can binhex and _____ __.
Date: 8 Nov 92 00:58:03 GMT
Organization: UB

In article <n0dc8t@ofa123.fidonet.org> Erik.Lindano@ofa123.fidonet.org writes:
>
>        A person has approached me and said he has devised an unusual
>        encryption method.
[...] 
>        One of the challenges he's proposed goes like this:
[...]
>     2. Each of these encrypted files can be quickly and correctly
>        decrypted using the same or another copy of NuCrypt.
[...]
>     4. The NuCrypt program itself, used to perform the encryption and 
>        decryption, is not disclosed.
[...]      
>        My acquaintance likes to think no one can defeat his cipher.

Your acquaintance doesn't know ANYTHING about cryptography.

He is ignorant of the Fundamental Assumption Of Cryptography:

	"The security of a system lies only in the keys."

Given your description, NuCrypt doesn't even use a KEY.

Send the guy to the library.


-- 
Daniel F. Boyd -- boyd@cs.buffalo.edu         -a +X -x -e -m -S -F"> "
----------------------------------------------------------------------
((lambda (x) (list x (list (quote quote) x))) 
 (quote (lambda (x) (list x (list (quote quote) x)))))
Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
From: gardner@convex.com (Steve Gardner)
Subject: Re: Registered Keys - why the need?
Date: Fri, 6 Nov 1992 03:45:29 GMT
Organization: Engineering, CONVEX Computer Corp., Richardson, Tx., USA
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.

In article <1992Nov3.090942.1626@guvax.acc.georgetown.edu> denning@guvax.acc.georgetown.edu writes:
>I apologize for the insult.  What led me to say what I said was that 
>many people had said things that I interpreted as disrespectful of
>all law enforcement.
	When law enforcement starts behaving in a respectable manner
	they will enjoy the *earned* respect of the populace.  
	When they stop such abominations as civil forfeiture and 
	other abuses in the name of the war on some drugs they can hope
	for respect.  In the mean time they deserve nothing but contempt
	from a proud and free people.  You may think like a serf if you
	wish but don't be surprised when others don't follow suit.


>The word "crisis" is probably too strong.  But let me elaborate on the 
>effect of COURT-AUTHORIZED taps.  According to the FBI, they have been
>essential in preventing serious criminal activity including organized 
>crime, drug trafficking, extortion, terrorism, kidnaping, and murder.  
	Law enforcement agencies always say that whatever the latest 
	affront to the constitution it is absolutely necessary to protect
	decent god-fearing burghers from the bad guys.  You are free
	to believe whatever nonsense they tell you but don't expect 
	everyone to be so credulous. 

>If law enforcement loses the ability to conduct court-authorized 
>taps, they will have to use other means if even possible, such as
>breaking and entering.  This is not necessarily better in terms of
>protecting liberties and privacy.
	In some sense it is not worth disputing this point because law
	enforcement has already lost the ability.  As has been pointed
	out before, there is no way to distinguish encrypted data from
	random binary gibberish being shipped about via modem.
	As more and more binary data is shipped about the possibilities
	for burying secrets in a sea of 1s and 0s become limitless.
	There are a lot of very talented computer people in this country
	and the Medellin cartel pays better than the FBI.  Who do you think
	will win? ;-)
	
>Are there other
>approaches that would give you greater assurance against the
>government and still allow for meeting the legitimate needs of
>law enforcement?  If so, I'd love to hear them.
	I challenge the assertion that there is anything legitimate 
	in the current war on some drugs (and on the entire constitution ;-).)
	Government has completely gone haywire and until the drug problem
	is solved by taking it out of the realm of law enforcement and
	putting it in the realm of medicine where it belongs we will
	have a continual erosion of our constitutional freedoms with
	no appreciable reduction in violent crime.  


						smg
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Re: New Encryption Method - a Challenge!
Date: 11 Nov 92 18:53:31 GMT
Organization: Stratus Computer, Software Engineering
NNTP-Posting-Host: ellisun.sw.stratus.com

In article <BxKAL5.LoE@metaflow.com> rschnapp@metaflow.com (Russ Schnapp) writes:
>Nobody has the time to reverse engineer an algorithm starting from
>square one -- it is a long, tedious process, the first time 'round, unless
>the code is ridiculously trivial.


The point which should be made (in the FAQ at least, and probably here) is
that the fact that no one reading this group wants to take this time does
not imply that the method is secure.  This attempt goes under the name
"security by obscurity" and protects only against lazy attackers.  A system
which is secure only against lazy attackers isn't worth anything.

-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488
Xref: sparky sci.crypt:4500 alt.security.pgp:86
From: mather@sees.bangor.ac.uk (Paul Mather)
Newsgroups: sci.crypt,alt.security.pgp
Subject: Re: PGP secret key on multiuser system (again) (was: Risks of keeping...)
Date: 9 Nov 92 16:19:47 GMT
Organization: University of Wales, Bangor
X-Newsreader: Tin 1.1 PL5

Magnus Olsson (magnus@thep.lu.se) asks:
> In short: How secure is the pass phrase mechanism of PGP 2.0?

As far as I'm aware, it's as secure as the algorithm used to actually
encrypt the files one sends using PGP (because it is the same
algorithm).

For efficiency reasons, PGP uses a "quick" but secure secret-key
encryption algorithm (IDEA) to encrypt the actual body of a message sent
using PGP.  The "RSA" portion of PGP is confined to communicating the
random session key used for the IDEA-encrypted body of the message.

As far as I'm aware, IDEA is used to encrypt the pass phrases for secret
keys.  Ergo, if you don't trust IDEA, don't use PGP.

I seem to remember the user manual goes into this in more detail.

Cheers,

Paul.
--
e-mail: p.mather@sees.bangor.ac.uk

If your mailer can't reach me, I'm obviously not worth talking to.
From: caronni@nessie.cs.id.ethz.ch (Germano Caronni)
Newsgroups: sci.crypt
Subject: Re: New Encryption System - Challenge!
Date: 13 Nov 92 02:12:38 GMT
Distribution: na
Organization: Swiss Federal Institute of Technology (ETH), Zurich, CH

In article <760285710DN5.61R@tanda.isis.org> marc@tanda.isis.org writes:
>In article <n0deft@ofa123.fidonet.org> 
>Erik.Lindano@ofa123.fidonet.org writes: 
>
>        Whether he is just being cute, or thinks he has patent
>        possibilities, the sad fact is that the only way Erik's friend
>        will get anyone's attention is by publishing his method.

I am no professional in 'sci.crypt' so what I write here might be pure
nonsense. We are discussing about someone who claims to have
invented a *new* method to encrypt data. We do not know anything about
keys and algorithms. 
But if this man wants to USE his new method, the algorithm to encrypt and
decrypt data has to be distributed in several places. Thus he would
not be able to hinder an opponent to gain access to the algorithm.
As far as I can see _all_ modern crypto-systems assume the algorithm
is known to everybody who cares, the 'secure' parts are keys or 
part of keys. Or am I wrong ? (I am not talking about 'hiding' information
but about encryption.)
So I can understand that this friend wants to keep the algorithm secret, and
let this newsgroup play around with a crypted text, just to protect
his mind's work, but this is not a very realistic approach.
If he would come up with his algorithm, then perhaps a more funded opinion
might come back from this newsgroup, than the stuff I have read until now.
(The word 'idiot' has fallen much too often IMHO.)

	gec
-- 
Instruments register only through things they're designed to register.
Space still contains infinite unknowns.

Germano Caronni    caronni@nessie.cs.id.ethz.ch
Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
From: andy@SAIL.Stanford.EDU (Andy Freeman)
Subject: Re: Registering "Assault Keys"
Organization: Computer Science Department,  Stanford University.
Date: Thu, 12 Nov 1992 23:40:55 GMT

In article <1992Nov12.071135.2216@netcom.com> gurgle@netcom.com (Pete Gontier) writes:
>>Since there is no evidence to support the claim that a ban would work, 
>>there is no reason to support such a ban.
>
>Name just about any country in the EC.

Go for it.  Name a country in the EC that has gotten significant
benefits from gun restrictions.  Show the before-after data.

>Remember, we're talking about kids finding Daddy's gun and shooting
>each other with it out of ignorance. That's *all* I'm talking about.

If that's ALL Gontier is talking about, he can't show a benefit
because that sort of thing is in the noise.  Given that, there's no
way to show a benefit.  Since his proposals are extremely expensive
....

>>If you realize a handgun ban doesn't address the problem, then
>>for what reason do you support a handgun ban?
>
>A band-aid *does* address the problem. Just not very well.

A band-aid addresses some problems.  It doesn't address others.

What problems does a gun ban successfully address?  Gontier seems
to think that crime won't be affected, and there aren't any other
big problems.  Maybe a gun ban will cure baldness....

>I'm too cynical for that. Maybe when I have lots of money I'll
>start thinking about solutions. For now, band-aids'll do fine.

Why is Gontier so sure that the band-aids chosen will leave him alone?

-andy
--
UUCP:    {arpa gateways, sun, decwrl, uunet, rutgers}!cs.stanford.edu!andy
ARPA:    andy@cs.stanford.edu
From: segr@nessie.mcc.ac.uk (Simon Read)
Newsgroups: sci.crypt
Subject: Re: RSA marketing weakness or lack of demand?
Date: 7 Nov 92 21:41:01 GMT
Organization: UMIST

In article <1992Nov4.195416.4015@netcom.com>, strnlght@netcom.com
(David Sternlight) writes:

>It appears that RSA has had patent protection for about 15 years. Yet
>there are no readily available standard RSA systems for use on Macs,
>nor standard electronic mail packages widely available for purchase
>using RSA.

I think perhaps there are two reasons for this:

1. The patent protection frightens potential users away. The fact
   that a license fee needs to be paid to use the system eats into
   profits. Here where RSA is not patented (probably due to the
   prior publication rule for European patents), it is more widely
   used. Though still not incredibly popular.

2. It is slow! A decent private key algorithm can be used to encrypt
   bulk data much quicker. That means PK algorithms are limited to
   message authentication and key exchange.

Simon Read
----------
Simon.Read@umist.ac.uk
Newsgroups: sci.crypt