HDTenEightyP/NetNews huggingface dataset:
From: vince@ghost.dsi.unimi.it (David Vincenzetti)
Subject: Re: Multiple-round DES
Organization: Computer Science Dep. - Milan University
Date: Fri, 18 Dec 1992 18:23:21 GMT

In <1992Dec16.205932.21909@rchland.ibm.com> lwloen@rchland.vnet.ibm.com (Larry Loen) writes:

>In article <6703@tuegate.tue.nl>, bartjan@blade.stack.urc.tue.nl (Bartjan Wattel) writes:
>|> If someone has other interesting info about multiple-round DES, all information
>|> is welcome !!
>
>This is the simplest approach to increasing DES key size I know of and it
>is "off the shelf" with a correct protocol in the implementation of it.
>
>-- 
>   Larry W. Loen        |  My Opinions are decidedly my own, so please
>                        |  do not attribute them to my employer

See ftp@ghost.dsi.unimi.it:/pub/crypt/d3des.tar.Z.

I quote from the README:
--
### d3des.tar.Z
Yet another DES implementation. But this one offers your the possibility
of making double or triple DES encipherment.
Author: Richard Outerbridge (GEnie : OUTER; CIS : [71755,204]),
Graven Imagery, 1992.
--

Regards,
David
-- 
David Vincenzetti, system administrator
Department of Computer Science,         Email: vince@ghost.dsi.unimi.it
via Comelico 41, 20135 Milan, ITALY     Phone: ++39 2 55006 39{1,2}
$PUBLIC KEY available by finger(1)$     Fax  : ++39 2 55006 373
Newsgroups: sci.crypt
From: robert.heuman@rose.com (robert heuman)
Subject: PKP/RSA comments on P
Organization: Rose Media Inc, Toronto, Ontario.
Date: Fri, 18 Dec 1992 07:26:54 GMT
X-Gated-By: Usenet <==> RoseMail Gateway (v1.70)


Date Entered: 12-18-92 02:15
strnlght@netcom.com (David Sternlight) writes:

S(> The way around that, of course, would be for someone in the U.S.
S(> to reprogram it [David, did you mean PGP or RIPEM?) using RSAREF.
S(> I understand a team is working on that.
S(> 
S(> If that is successful, then there'd also be a universal set of PGP
S(> versions. I know it's inconvenient to have two versions, and some
S(> might even think it silly (I do not), but it would be ethical.
S(> 
S(> Ethics is hard, sometimes, but trust me--it's worth it.
S(> 
David, if you mean PGP, then fine, but if you mean RIPEM, with its 
limitations, forget it.  The world will NOT go along with you.

Bob Heuman
---
   RoseReader 1.70 P001886: This Canadian has an Opinion...His Own!
   RM 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285
From: george@minster.york.ac.uk
Newsgroups: sci.crypt
Subject: User Authentication
Date: 18 Dec 92 13:20:46 GMT
Organization: Department of Computer Science, University of York, England

Apologies if you feel this is not the right newsgroup, but
no more specific group seems to exist.

Anyway, how can a device initially be securely connected to an
insecure network? i.e. anyone could attach a device knowing trivial
information. Problem is to only accept messages from a device
if it is known about. One idea I had was to inbuild some
code into a device which is entered into the main system. A match
could then be made between the id of a device and the id known on
the main system. However, someone might be able to extract the
info from a current device and then replace it with their own
device!

I'm sure that this problem must have had lots of work, can anyone
give me any pointers/references?

Thanks - George Bolt

Please email responses to: george@psychmips.york.ac.uk
or george@minster.york.ac.uk if the former address fails.
Newsgroups: sci.crypt,alt.security.pgp
From: nobody@nowhere.mil
Subject: Re: PGP as a World Standard
Date: Thu, 17 Dec 1992 23:59:59 GMT

David Sternlight (strnlght@netcom.com> says:
>Read my lips. PGP1.0 was contraband in the U.S., so much so that the
>author pulled out. It was illegally exported.  PGP2.0 was based on it.
>Thus the Europeans who use it don't have clean hands, regardless of
>the state of the law there.

Which is interesting, considering an entry on a PGP public key ring I
received recently:

Type bits/keyID   Date       User ID
pub  1024/B33E65 1992/09/24  David Sternlight <strnlght@netcom.com>


I guess it's "do as I say, not as I do", eh, Dave?
Newsgroups: sci.crypt
From: robert.heuman@rose.com (robert heuman)
Subject: RSA Data Security Not
Organization: Rose Media Inc, Toronto, Ontario.
Date: Fri, 18 Dec 1992 07:26:42 GMT
X-Gated-By: Usenet <==> RoseMail Gateway (v1.70)


Date Entered: 12-18-92 02:15
tcmay@netcom.com (Timothy C. May) said:

T(> This is exactly a battle being fought by U.S. suppliers of crypto and
T(> security tools. If they cannot export their products, and users of
T(> their products cannot export either, then there are competitive
T(> losses.
T(> 
T(> Ironically, the market for crypto tools may then develop and flourish
T(> outside the U.S., with some products being "allowed in" to an
T(> increasingly backward U.S. market.
T(> 
Remove the MAY from the above paragraph.  The correct statement is the 
the market IS developed and does flourish, and that the US is losing 
out on market share. Of course, until the rules are changed, and the 
nonsense about crypto is ended in the US, this will continue.

Incidently, the export controls also make it illegal to export 
anti-virus shareware, but NOT illegal to export anti-virus 
shrink-wrapped software sold over the counter (read them carefully to 
find the exemption). Another example of silly rules.  F-PROT or the 
McAfee suite of programs cannot be exported under these rules (F-PROT 
originates in Iceland, so the author does not care about these US 
rules) but CPAV, NAV and Untouchable can be exported. This makes about 
as much sense as the rules re export of Crypto.  Anyway, SCAN and 
CLEAN, etc., by McAfee are exported all over the world (or imported 
at the other end), ignoring the rules.  Take the bull by the horns and 
do the same for all of the Crypto material.

Bob Heuman <robert.heuman@rose.com>
---
   RoseReader 1.70 P001886: This Canadian has an Opinion...His Own!
   RM 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285
Newsgroups: sci.crypt
From: oppedahl@panix.com (Carl Oppedahl)
Subject: Comm Week article omits PGP
Date: Wed, 16 Dec 1992 01:36:40 GMT
Organization: PANIX Public Access Unix & Internet, NYC

An article in the December 14, 1992 Communications Week describes 
an encryption arrangement said to be used by "many users", namely
using a public-key method to encrypt a DES key which is then used
to encrypt the message.

The article goes on at length but somehow manages to miss PGP, which 
I suspect is the most widely used software that does this.

The article mentions RSA, of course, and quotes Prof. Hellman.

The article then mentions that RSA's encryption is used in Novell
Netware Release 4, in Lotus Notes, and in Microsoft Windows for
Workgroups.


Carl Oppedahl AA2KW  (intellectual property lawyer)
30 Rockefeller Plaza
New York, NY  10112-0228
voice 212-408-2578     fax 212-765-2519
From: jimkirk@news.uwyo.edu
Newsgroups: sci.crypt
Subject: Crypto side-issues
Date: 11 Dec 92 11:37:30 MST
Distribution: world
Organization: University of Wyoming - Laramie, WY

I haven't seen any serious discussion here or in the literature on
what I would term "side issues" of cryptography, those issues that
are important but not directly related to algorithmic consideration:

  1.  The hardware in use includes several caches such as instruction
      cache, data cache, and/or the disk controller has a cache.
      This seems to be common on 486-based PCs for example.  How
      can one "flush" the caches so there is no possibility of
      sensitive data left in them?  How does one read the cache
      so as to scrounge sensitive information?  Does flushing merely
      mark the contents as invalid (still allowing reading by
      diagnostic mode programs), or is there a way to forcefully
      zero out the cache contents?  I don't accept the power switch
      as an appropriate or fool-proof method.

  2.  Say I'm doing encryption/decryption on a workstation that is a
      "diskless" workstation, and in the process some pages get
      swapped over the ethernet, and a snooper captures the packets.
      How to avoid?  (e.g. use a local disk for swapping; or in 
      the program, lock down sensitive pages so no swapping occurs,
      if the OS will allow this)

  3.  The run-time library for the language in which the crypto program
      was written allocates output disk blocks, and fills them up to a
      point, terminating with (say) control-Z to indicate logical
      end-of-file, but leaving the rest of the last sector "dirty"
      which happens to contain sensitive data because the corresponding
      memory buffer had previously contained such data.

  4.  The program dynamically allocates storage, stores sensitive info,
      and deallocates storage without clearing it.  Or, the same can
      happen with static memory.

Are there any published (or unpublished!) guidelines or papers that address
these issues?  They seem critical to the overall functioning of a crypto
system, yet all I ever see are articles that concentrate merely on the
algorithms.

Jim Kirkpatrick     jimkirk@corral.uwyo.edu
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Not a smoking gun after all.
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Fri, 18 Dec 1992 23:12:40 GMT


Thanks to Phil Zimmerman for correcting me via e-mail about my
assumption that the MD5 code in PGP needed to be licensed. Apparently,
Phil tells me, RSA put it in the public domain.

Since I have no reason to disbelieve Phil, that means that the use
of the MD5 code, at least, is perfectly legal and ethical.

David
Xref: sparky sci.crypt:5646 comp.org.eff.talk:7628 alt.privacy:2605 talk.politics.guns:25165
From: dman@netcom.com (Dallman Ross)
Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
Subject: Re: Risks of Using PGP 2.0
Date: 14 Dec 92 04:05:22 GMT
Distribution: inet
Organization: Netcom - Online Communication Services  (408 241-9760 guest)
X-Newsreader: TIN [version 1.1 PL7]

Randolph Langley (langley@dirac.scri.fsu.edu) wrote:
:    Do you know the country of registry?
: 
: Well, if it is Panama, then I bet that they won't say anything.

As I posted some while back, I did manage to find out the country, or,
rather, the region: the Caribbean.

--
 __D_a l_l m a_n  _ R o_s s _ |dman@netcom.com  /or/  |"You sound like a man|
 l  \\ l\\   /l  /\\  l\\   l |dross@well.sf.ca.us    |with a rubber nose." |
 l   >)l \\ /ll /  \\ l \\  l |vox/fax: 1.510.645.1883| -- One-Lung Bill    |
 l  // l  \X ll/--- \\l  \\ l |350 Perkins St., #108  |     Remmer (deceased)
_l//______________________\\l_|Oakland,_CA__94610-3422|_____________________|_
Newsgroups: sci.crypt
From: bill@texan.rosemount.com (William Hawkins)
Subject: Exporting password protection
Organization: Rosemount, Inc.
Distribution: usa
Date: Thu, 17 Dec 1992 00:15:09 GMT

My company makes a process control system, used to control 
levels, temperatures, and pressures in industrial processes.
Some industries, like pharmaceuticals, require password
protection of access to the control system, so that data
cannot be easily stolen (the data is not encrypted) and
the controlled process cannot be changed.

So far, we have been able to use one version of software for
sales around the world.  Apparently, the addition of password
protection has broken that, as it is necessary to encrypt the
passwords for storage.  As I understand it, the Arms Regulation
law includes cryptographic software, and prohibits its export
without a license - _for each shipment_.

Our site saves News for a week.  I could not find anything in
the 82 articles available specifically on the password subject.
I'm sure you've discussed this problem, but I have no access
to an archive or a FAQ list.

How have other people solved this problem?  Does anyone ship
software containing password encryption outside the US?  Is
it possible to get an exclusion to the ITAR regulations?

Please email replies.  It's much more reliable than News.


bill@texan.rosemount.com  Minneapolis, MN  612 895-2085
Newsgroups: sci.crypt,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PKP/RSA comments on PGP legality
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Sun, 13 Dec 1992 19:21:49 GMT


Thanks to the many who clarified my understanding of the legalities
of this issue, both publicly and privately.

My latest state of understanding (but I'm open to even more) is that
DES was published. More than that, it's that there's a footnoted
exemption in the Export List (Commerce Dept.? State Dept.?) for
technological exports which have been published in scholarly
journals (the explanation I was given has something to do with
the conflict between the Munitions Act and the First Amendment).

It's also been claimed by one correspondent that a)IDEA has been
published and b)the above footnote exemption would mean that
the IDEA component of PGP wouldn't provide a basis for proceeding
against PGP under the Munitions Act.

Whether PGP as a whole could be construed as different from its
ancestral parts (RSA, IDEA) which have been published and are thus
presumably covered under the exemption footnote is as yet unclear
to me.

Finally, the issue of PGP being a violation of RSA/PKP's patents
remains, though the suggestion of an RSAREF version is certainly
an interesting one.

David
Newsgroups: sci.crypt
From: rdippold@cancun.qualcomm.com (Ron Dippold)
Subject: Re: Help cracking a WordPerfect file...
Organization: Qualcomm, Inc., San Diego, CA
Date: Fri, 11 Dec 1992 21:45:15 GMT

Alex.Strasheim@launchpad.unc.edu (Alex Strasheim) writes:
>In article <1992Dec11.192225.919@ee.eng.ohio-state.edu> butzerd@blanc.eng.ohio-state.edu (Dane C. Butzer) writes:
>>I have a friend who forgot his password to a WordPerfect file.  I recall
>>somebody posted a FTP site with a program that could defeat the
>>'encryption' used.  Could somebody please e-mail me the site & filename?

>>Failing that, does anyone have any info on the encryption scheme
>>WordPerfect uses (& I'll try to break it myself...)

>I can't remember the name of it, but I remember seeing a program that was
>floating around the net that could break files encrypted with WordPerfect.
>I'm pretty sure that the version that was available publicly was intended
>more as a demonstration of the weakness of wp's crypt algorithm rather
>than as a tool for breaking into files.  It was limited to files encrypted
>with passwords that were four characters or less in length.  I think that
>there was a more powerful version available for a fee, but I might be
>mistaken about that.

How about one for free?  There's some on several ftp sites (look for
wpcrack.zip) and if someone mails me I'll mail mine to them.
Guaranteed to crack almost any standard password in about 10 seconds -
once we get about 14 characters you start running out of information
to work with.

I also include information on the encryption scheme used (it's really,
really stupid).
-- 
The first rule of gun fighting is - bring a gun.
Newsgroups: sci.crypt,alt.security.pgp,alt.society.civil-liberty,alt.society.civil-disob
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: PKP/RSA comments on PGP legality
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Wed, 16 Dec 1992 00:41:33 GMT

In article <1992Dec14.014118.11612@netcom.com>, strnlght@netcom (David Sternlight) writes:
>If my understanding is now accurate that PGP2.x violates both the
>Munitions Act and PKP's patents, and that this violation is occasioned
>not just by use but also by possession in the U.S., then it would seem
>prudent to get it off one's U.S. computers and any U.S. net
>sites--Internet, Usenet, Fidonet, anynet. Presence on a bulletin board
>system may be just what someone needs to close down that system.

Actually, what comes to my mind is to get PGP 2.X on each and every
U.S. computer, net site, Usenet host, Fidonet, anynet - and then each
and every computer owner, net site, Fidonet, anynet could report
themselves to the Proper Authorities as illegal international arms
traders.

Is anyone familiar with the concept of "civil disobedience"?

Of course it's easy for me to say things like this.

>Finally, given my understanding, the notion that if it's uploaded all
>over the place, what can "they" do seems to betray a lack of both
>realism and ethics. Try the argument that if lots of people take
>cocaine, what can "they" do?  to see this.

If all the people who smoke marijuana would do it openly and not stop
smoking it openly even though put through the system, "they" would
either just have to simply swallow it and repeal the law or start a
civil war.  The problem is that after "they" shoot/put for life in
jail/fine $2M/hang/whatever a couple of those doing it openly the rest
will stop doing it openly.  Divide and conquer.

//Jyrki
Newsgroups: sci.crypt
From: mirage1@gpu.utcs.utoronto.ca (Robert Ames)
Subject: Risks of purchasing Mailsafe
Organization: UTCS Public Access
Date: Mon, 14 Dec 1992 02:30:35 GMT

Carl Ellison quotes RSADSI as writing:

>in the user manual.  The authors of pgp have had a copy of MailSafe
>and the user manual since 1987.

It seems there is a risk to purchasing RSADSI products.  If one does so and
then writes encryption software, the fact of the purchase can be used against
the purchaser.
 
-- 
Robert Ames mirage1@gpu.utcs.utoronto.ca  P.O. Box 724, Station 'A', Toronto

Newsgroups: sci.crypt,alt.security.pgp
From: stevens@vms.macc.wisc.edu (PAul STevens - MACC - 2-9618)
Subject: Re: PKP/RSA comments on PGP legality
Organization:  University of Wisconsin Academic Computing Center
Date: 14 DEC 92 12:49:57    

In article <1galtnINNhn5@transfer.stratus.com>, cme@ellisun.sw.stratus.com (Carl Ellison) writes...

>I went to the horse's mouth and asked some folks at PKP & RSA to comment
>on PGP legality.  Here's their reply.  I have permission to post it.
> 
>Being aware of the RSA patent makes infringement willful and
>deliberate. Under patent law, a patent holder is entitled to seek
>triple damages and legal fees from deliberate infringers.  While the

    Once again.  Talk, talk, talk, talk, talk.  Who is going to do
    something?  For the record I am going to publish a number I
    want to keep secret.  I am going to raise it to the power of
    three modulo 91 which is the product of two primes.  The
    result is 34.  My wife knows the factors of 91 and will be able
    to decode this message.  I believe that according to PKP I have
    willfully infringed their patent.  I await a letter from the
    courts.

    My point is that *someone* has to test this patent claim!  How 
    can we force this to happen?  If someone does get sued are we
    all willing to contribute to the defense or are we all talk, too? 

           PAul


Newsgroups: sci.crypt,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PKP/RSA comments on PGP legality
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Thu, 17 Dec 1992 09:43:54 GMT


In response to Phil Karn, cryptographic software is specifically
defined as matter that's not exportable or importable without a
license. It is NOT the same thing as an algorithm, in the
specific language of the regulations.

David
From: bx017@cleveland.Freenet.Edu (Michel Aubin)
Newsgroups: sci.crypt
Subject: PGP 2.1 version for amiga computer
Date: 13 Dec 1992 20:10:59 GMT
Organization: Case Western Reserve University, Cleveland, Ohio (USA)
NNTP-Posting-Host: hela.ins.cwru.edu


hello
 
i want have a informatin concern PGP 2.1 .. for Amiga Computer
 
Where i can find the PGP 2.1 Version For AMIGA COMPUTER.. On FTP Internet??
 
Bye ..
 
					Michel Aubin
-- 
Address Internet-=>Bx017@po.cwru.edu
Address Internet-=>Maubin@heartland.bradley.edu
Address Fidonet.-=>1:240:507  (My Name is Michel Aubin)  (On Bab-O-Manie)
Newsgroups: sci.crypt
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: alt.security.pgp
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Fri, 18 Dec 1992 11:37:16 GMT

In article <1992Dec16.181305.9124@rna.indiv.nluug.nl>, gerben@rna writes:
>I don't see any group called alt.security.pgp here, nore does the European  
>backbone.
>
>What gives?

It seems to exist and work well here.  Perhaps it would help to
getting an alternate feed to cover for malfunctions or lack of
coverage of groups on the primary feed.

I don't know exactly what "the European backbone" is when talking
about Usenet (perhaps something to do with a company/organization
called EUNET?), but some hosts which might have something to do with
it via which a message in alt.security.pgp has passed are "mcsun",
"fuug" and "Germany.EU.net".

Hmm, also, perhaps your problem might have something to do with the
generic Fear, Uncertainty and Doubt about in some countries with
somewhat more less-than-perfect freedom with regards to cryptography
than most - I don't see the host "uunet" in the Path field of any of
the message which are only in alt.security.pgp.  Then again perhaps
not, it may just be the fact of Usenet that not all sites take alt
groups and thus the propagation is not always good.

//Jyrki
Xref: sparky sci.crypt:5631 alt.society.civil-liberty:6881
Newsgroups: sci.crypt,alt.society.civil-liberty
Subject: Re: Limits on the Use of Cryptography?
From: jim.wenzel@grapevine.lrk.ar.us (Jim Wenzel) 
Date: 12 Dec 92 21:37:00 GMT
Reply-To: jim.wenzel@grapevine.lrk.ar.us (Jim Wenzel) 
Distribution: world
Organization: The GrapeVine BBS *** N. Little Rock, AR *** (501) 753-8121



Iain Mccord *   The  case you  are talking  about is  one where you have
              shown that the investigating officers have already decided
              that  the  defendant  is  guilty.  The  lack  of any other
              evidence  than  some  encrypted  data  on  a computer disc
              indicates,  to  me,  that  they  are  more  interested  in
              harassing him than the possibility  that they may have the
              wrong man.
                                 = = =


    Actually  I  know  very  little  about  the  case  and  only  posted
    originally  as I  thought it  would be  of interest  to this  group.
    Primarily  because   it  presented  some   interesting  'real  life'
    questions.

    These things  I do know (or  have learned from others  who know.)

    The 'suspect' is a repeat offender.
    It is common for pedophiles to keep diaries.

    I  need to  make this  plain, I  do not  agree with  the limits that
    law-enforcement is  able to operate  within. I do  know that if/when
    you encrypt a file with PGP it has *your* signature on it. I do know
    that law-enforcement has extraordinary means at times to bypass some
    of  our basic  freedoms. I  am not  condoning these  methods, merely
    passing them on for comment.

    I am as  interested as anyone on the  conversation that ensues based
    on these actions but, I must make this plain:

    I DO NOT  CONDONE THE CASE NOR AM I  AN ACTIVIST FOR LAW ENFORCEMENT
    OFFICIALS. Merely  a concerned citizen  and sysop who  believes very
    strongly in our  (US) bill of rights and the  travesty that has been
    placed upon it under the "War on Drugs" regime.

---
 * SM 1.06 A0059 * "Hex Dump" - Where Witches put used Curses?
                                                            
Newsgroups: sci.crypt,alt.security.pgp