HDTenEightyP/NetNews huggingface dataset:
From: sysevm@nsrvan.vanc.wa.us
Newsgroups: sci.crypt,alt.privacy,talk.politics.guns
Subject: Re: address, phone # list of congress
Date: 21 Nov 92 18:54:13 GMT
Article-I.D.: nsrvan.1992Nov21.105413.59
Organization: National Systems & Research, Vancouver WA

In article <1992Nov20.014353.3228@netcom.com>, feustel@netcom.com (David Feustel) writes:
> How about an updated list with the names and addresses for the NEXT
> congress so we can get our letters in early?
> -- 
> Dave Feustel N9MYI <feustel@netcom.com>
>  

Send me the Winner and looser for each change in office and I'll update the
list. 

Ethan
Xref: sparky sci.crypt:4881 comp.org.eff.talk:7086 alt.privacy:2301 talk.politics.guns:24194
From: philip@meiko.com (Philip Gladstone)
Subject: Re: Public Key Patents
Organization: Meiko Scientific Corp.
Date: Thu, 19 Nov 1992 03:41:23 GMT

ken@halcyon.com (Ken Pizzini) writes:
: Which makes the the RSA patent even more absurd -- foreign nationals
: get to use RSA for free while US taxpayers, who helped fund the
                                   ^^^^^^^^^
: research, have to pay royalties!

Actually, for RSAREF, you need to be more than a US taxpayer -- you
need to be a US citizen resident in the US. 

Philip

Newsgroups: sci.crypt
From: bgrahame@eris.demon.co.uk (Robert D Grahame)
Subject: PGP and real criminals 
Distribution: world
Organization: Perhaps
Date: Sun, 22 Nov 1992 17:10:35 +0000

In article <1580.517.uupcb@grapevine.lrk.ar.us> john.eichler@grapevine.lrk.ar.us writes:
>In article: <palmer.722276991@news.larc.nasa.gov> (Michael T. Palmer) states:
>
>>Hmmm, an interesting point.  But how do you restrict access to tools that
>>they can construct themselves?  Sure, it is illegal for a convicted felon
and
>>Remember, if they're already convicted criminals, they probably won't
>>pay too much attention to such laws anyway, so you'd have to find some

>That all is true however by making it illegal for them to do this gives
>LE agencies one more useful tool to combat crime.  With the relatively
>Any comments?

I can imagine that LE agencies *on an investigation* would ask for the
secret key, or at least verifiable plaintext, and if refused *and* they had
evidence a charge of obstruction may be in order, but to criminalise the use
of encryption tools would be unenforceable, and would prevent protection of
correspondance from other non-government agencies, such as ex-spouses,
journalists, criminals etc.

It would simply be ignored by felons who intended to continue to break the
law, and would put felons trying to go straight at a disadvantage.

I therefore say that it would be a bad mistake to make this a crime in
itself. That is not to say that using these tools for criminal ends should be
without penalty.


-- Bob Grahame, Streatham, London. LAN Consultant
-- Voice :- +(44)71 406 7795 : PGP 2.0 Key available

Xref: sparky sci.crypt:4857 alt.privacy:2293 comp.org.eff.talk:7080
From: phr@telebit.com (Paul Rubin)
Subject: Re: Public Key Patents
Organization: Telebit Corporation; Sunnyvale, CA, USA
	<1ebjbsINNgfv@iskut.ucs.ubc.ca>
Date: 19 Nov 92 22:57:21

    There is a balance between the recovery of "public money" and not
    removing the incentive to comercialise an invention. Remember that the
    public also gets money back ( thorugh taxes etc) when an invention is
    successfully developed and sold.

Um, remember we are talking about patents *preventing* inventions
from being developed and sold.
Newsgroups: sci.crypt
From: phr@telebit.com (Paul Rubin)
Subject: Re: Public Key Patents
Organization: Telebit Corporation; Sunnyvale, CA, USA
	<PHR.92Nov17033415@napa.telebit.com>
	<PCL.92Nov18102622@black.oxford.ac.uk>
Date: 18 Nov 92 04:24:33

    Oh, I don't know about that.  The European public got rather a lot,
    and don't even have to pay royalties.  Come to that, PKP don't even
    have a monopoly.  A limited monopoly, limited to within the US, yes.

    "The public" != "The population of the US".

Good point.  I meant "the public" to mean the abstract public who in
the justification of patents temporarily give up their right to use
the invention freely, in exchange for getting to see the details of
the invention.  For RSA, this just means people in the US.

Note, however, that even the European public didn't get anything in
exchange for the US RSA patent.  RSA was already published (through
great effort of R+S+A, against opposition from the US spy agencies)
before the US patent was applied for.  Without the US patent,
Europeans would still be able to use RSA, *plus* any number of
RSA-using programs and devices that might have been developed in the
US but were prevented by the patent.  Thus, even for Europeans, the US
patent is a cost with no benefit.

I detect in your article a (justifiable) tone of gloating that
European patent law is presently less stupid than US patent law.  You
might want to take note that the pending international GATT treaty
will impose the stupidity of software patents on all signatories.  If
the US Government gets your country to sign the treaty, then this
idiocy will control your actions as it now does ours :-(.  You might
want to do something about this situation by opposing the treaty in
your country.  For more information, write league@uunet.uu.net as
usual.

Standard disclaimer: opinions mine not Telebit's.
From: edhall@rand.org (Ed Hall)
Newsgroups: sci.crypt
Subject: Re: PGP and real criminals
Date: 20 Nov 92 19:03:55 GMT
Organization: RAND

In article <1992Nov20.092807.13613@ucsu.Colorado.EDU> cuffell@spot.Colorado.EDU (CUFFELL TIMOTHY MICH) writes:
>In this country, the accused is presumed innocent.  If there is not enough
>admissable evidence, then either we cannot assume his guilt, or, in the case
>of inadmissable evidence, a shortcoming in the law or a particular odius
>example of the price we pay to prevent a police state.  One might argue
>that an encrypted diary could prove his guilt.  This is true, in much the
>same way a illegal search or a coerced confession proves guilt.

No.  In the hypothetical case I described, he /was/ guilty--of
possessing an illegal cryptographic program--even though he wouldn't
decrypt what was thought to be a diary recording his evil deads.  This
was my point: in the battle to prevent restrictions on cryptography,
arguments of general unenforceability are of limited value.  Since most
folks don't consider cryptography as much use to themselves (there are,
after all, other ways to keep secrets), banning it to get at the bad
guys probably won't seem too high a price to pay--to "most folks", anyway.

>  The guilty
>going free on occasion is the price we pay for our freedoms.  The claim that
>the innocent have nothing to hide takes us one step from them.

Present a clear and immediate danger, and most people are quite willing
to see some of their freedoms suspended in exchange for removing that
danger.  This is human nature, and centuries of democracy have done only
a little to modify it.  Where is the clear and present danger to the
average citizen in banning private cryptography?  What secrets do average
people have which might require its use?  Remember, the institutions which
really need it, like banks, can be licensed for it, just like institutions
who need explosives, like mining companies, are licensed to use them.

>Here is a practical example.  You are accused of being a child molester.
>There exists on your computer an unidentifyable file, consisting of random
>data.  You now have to turn this data into a diary, or face criminal
>charges.

Who has ever proposed outlawing unindentifiable files?  If you managed
to destroy your encryption program, you're home free.  The program would
be the contraband, not a file which may or may not be its output.

There are, of course, problems with banning encryption programs: just
what /is/ an "encryption program?" I think that this is likely to be a
good avenue of approach for "unenforceability" arguments, but I'm also
not convinced that an enforceable definition is impossible.

Here is my point: until you come up with a way to explain to common
citizens how banning private cryptography will endanger them, you are
likely fighting a losing battle.  Much of what I've read in sci.crypt
has been preaching to the converted.  You'll have to do better by
finding demons as /immediately/ threatening as those of your adversary.

		-Ed Hall
		edhall@rand.org
Xref: sparky sci.crypt:5195 comp.org.eff.talk:7193 alt.privacy:2402 talk.politics.guns:24377
From: aq817@cleveland.Freenet.Edu (Steve Crocker)
Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
Subject: Re: Risks of Using PGP 2.0
Date: 23 Nov 1992 09:49:48 GMT
Organization: Case Western Reserve University, Cleveland, Ohio (USA)
Distribution: inet
NNTP-Posting-Host: hela.ins.cwru.edu


Some on this thread appear to believe that because they live outside
the U.S. and are not U.S. citizens, that their actions need not comply
with U.S. law. Permit me to remind you that the Supreme Court of the 
U.S. has upheld the legality of U.S. agents arresting foreign nationals
on foreign soil for crimes against U.S. law committed on foreign soil.
Unless anyone expects their government to go to war against the U.S. 
to protect them, you had better think twice about violating U.S. law,
whoever you are and wherever you might be.

Welcome to the nineties,
-Steve
From: shirriff@sprite.berkeley.edu (Ken Shirriff)
Newsgroups: sci.crypt
Subject: Re: New Encryption Method - A Challenge!
Date: 17 Nov 1992 21:28:43 GMT
Organization: University of California, Berkeley
NNTP-Posting-Host: hijack.berkeley.edu

In article <n0e49t@ofa123.fidonet.org> Erik.Lindano@ofa123.fidonet.org writes:
> Ok, fair enough. Short of revealing how the program works, what 
> terms would you like?

Well, if I had the time and interest to break your encryption scheme, what I
would do is a chosen ciphertext attack.  That is, I would run the ciphertext
through your decoding program and look at the output text.  Then I would
change a byte in the ciphertext and see how the decoded text changes.  I would
keep doing this to see how much I can figure out about the decoding method.
Does changing a byte in the ciphertext change one byte or a few bytes in the
output, or does it change the whole output?  Can I figure out if some bytes
are the key and some bytes are the data?  Can I figure out how big the key is?
Does the output change in a simple way based on the input change, e.g.
arithmetically or logically?

Ken Shirriff                            shirriff@sprite.Berkeley.EDU
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Another argument for keeping keys private
Date: 16 Nov 92 22:58:37 GMT
Organization: Stratus Computer, Software Engineering
NNTP-Posting-Host: ellisun.sw.stratus.com

In article <Bxs7Gu.9xx@wimsey.bc.ca> sl@wimsey.bc.ca (Stuart Lynne) writes:
>
>On the other hand it seems that other elements of encryption might be of
>interest to the same goverment agencies. Digital signatures are good
>evidence of authorship. If they where required on all electronic
>transactions it becomes easier for them to follow the audit trail. No
>sense in claiming that a record didn't originate from you if it was signed
>with your digital signature.
>
>Secure and protected communications can be a benefit to the government as well
>as the rest of us.



Exactly.

Before anyone can claim that a digital signature is mine, they need to
refute my potential claim that someone else had access to it.

If they have forced me to register my private key in a registry someplace
where some criminal might have broken in and stolen it, then they
can not prove my authorship beyond a reasonable doubt.

-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488
From: rcain@netcom.com (Robert Cain)
Subject: Re: Risks of Using PGP 2.0
Organization: Netcom - Online Communication Services  (408 241-9760 guest) 
Date: Sat, 21 Nov 1992 15:52:00 GMT

boucher@csl.sri.com (Peter K. Boucher) writes:
: 
: What would happen if all the places that want to _buy_ PGP licenses (I assume 
: that there are lots of companies that would pay a reasonable price for a 
: license) would pool their money and give it to Zimmerman, so he could buy the 
: license (and continue giving PGP away for free)?
: 

A license from PKP includes a per copy royalty.  I don't see how this could
be administered with freeware.  In theory I suppose someone could act as
an intermediary and obtain a license from PKP to sell licenses to individual
users who wish a license for PGP and the intermediary would be the only one
directly dealing with PKP and paying it the royalties.  This might be a nice
litle business for someone if PKP were amenable to it and enough users
wanted it.

Bob
-- 
Bob Cain    rcain@netcom.com   408-358-2007

"There are some strings.  They're just not attached."
                                                    Victoria Roberts


               PGP 1.0 or 2.0 public key available on request.
From: Erik.Lindano@ofa123.fidonet.org
Newsgroups: sci.crypt
Subject: New Encryption - a Challenge
X-Sender: newtout 0.02 Nov 17 1992
Date: 18 Nov 92  21:32:24

Writes boucher@csl.sri.com (Peter K. Boucher):
 
 > 1) It's not worth the effort to try to crack it, since...
 
 OK. Don't try, then.
 
 > 3) A person would be foolish to use an encryption product whose 
 >  algorithm is unknown, because the provider might have a way to 
 >  always see cleartext.
 
 Yes, I have heard something like that about the DES and RSA 
 algorithms. Have you?
 

--- Maximus 2.00
From: leichter@zodiac.rutgers.edu
Newsgroups: sci.crypt
Subject: Re: Triple DES
Date: 20 Nov 92 14:43:21 GMT
Organization: Rutgers University Department of Computer Science

In article <1eg516INNrrq@uniwa.uwa.edu.au>, markd@uniwa.uwa.edu.au (Mark
Diamond) writes:
| The question arose in a previous reply to this posting of whether
| triple, double or any other repeated DES encryption was stronger than a
| single encryption.  The previous reply indicated that the question was
| still open.  It is not open ... it has been settled and the results
| presented at CRYPTO 92.
| 
| Essentially the question about the strength of double encryption is the
| same as the question about whether DES is or is not a group.
| 
| If DES were a group then for two keys K1 and K2
| 
|        DES( DES(Plaintext, K1), K2) == DES(Plaintext, K3) for some
| 
| K3 which presumably the eavesdropper is trying to discover ... the point
| being that they would not have to find K1 and K2, but only a kind of
| "combination" K3.
| 
| The recently demonstrated fact that DES is *not* a group indicates that
| a double encryption *is* stronger than single encryption.

Sorry, no.  Repeating a falsehood does not make it true.  All we know is that
it MIGHT be stronger.

Consider TES, the Trivial Encryption Standard - it's just like DES except that
TES(P,k) = k || DES(P,k) (|| is concatenation).  That is, TES "gives away the
store" at the beginning of the ciphertext.  It's clear that if DES isn't a
group, neither is TES.  It's also clear that double TES is exactly as strong
as single TES.

If there were a generic unknown-plaintext attack against DES, it would work
just as well against double DES, requiring double the time.  (Yes, this would
make double DES just a bit stronger - but multiplicative factors - especially
such small ones! - are ignored when we discuss the strength of cryptosystems.

A pure chosen-plaintext attack against DES would not move directly to double
DES.  But that only says something about ONE PARTICULAR ATTACK; it says
nothing about the inherent strength of the cryptosystem.

							-- Jerry
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: NSA recommendations?
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Thu, 19 Nov 1992 19:35:20 GMT


Does anyone know if the NSA is making any current recommendations to
U.S. businesses who wish to transmit economically sensitive
non-defense information to their agents in countries which: a) might
be considered economically hostile (or at least competitive); b) are
well endowed with communications intelligence equipment and
technology.

I have in mind specifically any current NSA recommendations to U.S.
companies making bids on Japanese projects where the U.S. company's
electronic mail might the the object of cryptographic interest to
either the Japanese government or to well-endowed Japanese
competitors.

Same question for bids in the former Soviet Union, Korea, France.

Does NSA feel DES is appropriate today under such circumstances? Is
there something else they recommend? One-time pads? Something more
convenient?

Anyone know?

Does anyone have an address to write to to ask, if the information
isn't known to someone here?

Replies by e-mail if anyone is uncomfortable giving details in
a public newsgroup read internationally.

Thanks;

-- 
David Sternlight
(pgp 2.0 and ripem public keys available on request)

Newsgroups: sci.crypt,sci.math,comp.theory
From: phr@telebit.com (Paul Rubin)
Subject: Re: Cryptography and P=NP
Organization: Telebit Corporation; Sunnyvale, CA, USA
	<PHR.92Nov15203840@napa.telebit.com> <1e7fvdINN87s@iskut.ucs.ubc.ca>
Distribution: inet
Date: 16 Nov 92 00:36:14

    Mathematics would also be placed in a surprising position by P=NP.
    P=NP implies that there is an algorithm which, given a theorem
    expressed formally in ZF, say, and a number n, either gives a formal
    proof of the theorem of length at most n, or shows that there is none,
    and which would take time bounded by some polynomial in n. It wouldn't
    *necessarily* put us all out of the math research business, but....

I don't know that this is really so interesting: the kinds of things
we write down in mathematical proofs ("by symmetry, X, and by
induction on n, Z") often would have very large expansions in formal
proofs.  The kind of thing a mathematician would write down as a proof
of a theorem is less like shorthand for a formal proof than like a
computer program which generates a formal proof.  So we're not so
interested in the length of the formal proof as in the length of the
shortest such program.  But recognizing whether a program P generates
a proof of a theorem T is not in NP---it's not even undecidable
(because we can't even tell if P ever halts).  Thus, my feeling is
that even an NP-oracle wouldn't put mathemeticians out of business.
Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: Re: URNG
Organization: Chinet - Public Access UNIX
Date: Fri, 20 Nov 1992 22:10:44 GMT

In article <books.124.0@fsunuc.physics.fsu.edu> books@fsunuc.physics.fsu.edu (Roger Books) writes:
>I've seen a lot of discussion here about Unpredictable Random Number
>Generators as apposed to statistically reliable random number generators
>and I am interested in seeing a URNG.  Could someone post (or e-mail)
>a formula/code/algorithm/description of an Unpredictable RNG?  I'm not
>asking for all of the above, one would be all I need.
>

The Blum-Blum-Shub generator is discussed in Gilles Brassard's _Modern_
Cryptology_, published by Springer-Verlag.

Bruce
Newsgroups: sci.crypt
Subject: Re: Risks of Using PGP 2.0
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Date: 20 Nov 92 23:46:48 GMT
Organization: Beckman Instruments, Inc.
Keywords: legal, patent, export, ITAR

In <1992Nov19.103737.16070@netcom.com> tenney@netcom.com (Glenn S. Tenney) writes:

>In article <a_rubin.722037007@dn66> a_rubin@dsg4.dse.beckman.com (Arthur Rubin) writes:
>> ...
>>(3) Distributing source code with appropriate disclaimers (possibly as RSA
>>claims) is exactly what patent law was intented to encourage...
>>experimentation with concepts/ideas to create new ideas.

>Au contraire.

>The patent law says that "whoever without authority makes, uses or
>sells any patented invention ... infringes the patent" and "whoever
>actively induces infringement of a patent shall be liable as an
>infringer".

Very well.  Let's look at it.  The patent seems to cover encryption of
messages.  Private encryption of files, even with a "public" key system
seems NOT to be be covered.  Hence, any code which does not include a
mailer is allowable; hence desirable, because it allows further research on
the concepts described in the patent.

>Distributing copies of a patent is aok.

>Writing a book about it, discussing the whys and hows is aok.

>But, once you have a program, things are different -- perhaps unclear,
>but at least different.  Executing the program is clearly using the
>patented invention and potentially an infringement.  Nothing in the
>patent law encourages experimentation by infringing.  It is clear
>that the purpose of distributing such source code is to USE the
>patent.

As I said, executing the program and then transmitting the encrypted file
is covered.  Use of the program itself, is not.  (And it is clear that the
primary purpose of the code is either to use in violation of the patent or
to discredit the patent, but discrediting the patent IS allowable.)

>Again, if you want to understand the ideas, or help others to understand
>them, then go write a book.  There is NO WAY that a book can be
>construed as making or using a patented invention.

>Plus, any site making the code available might also find themselves
>infringers.

That's why no US sites make the code available.  The patent is only valid
in the US.  (It's apparently not valid even in Canada, which normally
recognizes US patents, but "software" or "algorithm" patents are NOT
allowable in Canada.)

--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
From: franl@centerline.com (Fran Litterio)
Newsgroups: sci.crypt
Subject: Need the FAQ.
Date: 21 Nov 92 20:22:14
Organization: CenterLine Software, Inc.
NNTP-Posting-Host: 140.239.3.116

Would someone either email me the FAQ for this group or post it here.
Thanx in advance.
--
franl@centerline.com   || Fran Litterio, CenterLine Software R&D
617-498-3255           || 10 Fawcett St, Cambridge, MA, USA 02138-1110
"So what we've decided to do is set you up in Cicely, situated
 in an area that we Alaskans refer to as The Alaskan Riviera."
Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: Re: why isn't there a sci.crypt.politics?
Organization: Chinet - Public Access UNIX
Date: Thu, 19 Nov 1992 17:23:10 GMT

I second the proposal for the creation of sci.crypt.politics.  Let's get the
politics off of this newsgroup!

Bruce
Xref: sparky sci.crypt:4914 alt.privacy:2315 comp.org.eff.talk:7097
From: davburns@rigel.cs.pdx.edu (David R Burns)
Newsgroups: sci.crypt,alt.privacy,comp.org.eff.talk
Subject: Re: A Silver Bullet to Limit Crypto?
Summary: LE can get around almost any encryption
Date: 17 Nov 92 07:46:44 GMT
Article-I.D.: pdxgate.6314
Organization: /etc/organization

[stuff deleted to conserve BW]

>options and their implications before deciding.  There is also a price
>to be paid for LE losing the ability to wiretap that I don't think is
>well understood.  I have been trying to understand these implications

[...]

>Dorothy Denning,
>denning@cs.georgetown.edu

One might note, it'll still be quite possible for law enforcement agencies to
spy on people... before or after the encrypted channel, when the message is in
human-readable format.  (eg, bugs in a phone handset, or a tap on a monitor 
cable, or even something as simple as making some modifications to a keyboard..)

Certainly, these aren't as easy as listening in on someone's cellular or
climbing a utility pole... but they do allow law enforcement officers to do
their job, while protecting the citizen's privacy.

Entered by:                    David Burns
                            davburns@cs.pdx.edu
Hi!  I'm a .sig virus!  Copy me to your .signature, and spread the fun!