HDTenEightyP/NetNews huggingface dataset:
From: a7657@mindlink.bc.ca (Stephen H. Kawamoto)
Subject: The PGP debate: Is it legal?
Organization: MIND LINK! - British Columbia, Canada
Date: Mon, 28 Dec 1992 17:52:04 GMT

After reading much of the bulk of messages on the legality of using PGP which
uses the author Zimmermann's own implementation of the RSA encryption
techniques, I have a suggestion to make:
    Why not see if PKP's RSA can decode a PGP message?

It cannot due to several reasons:
 1) the RSA algorithm that Zimmermann used is his own interpretation of the
original one in the paper by the people who originally thought it up,
 2) PKP's RSA has not gone thru any refinations - they own the patent of a
specific algorithm,
and, thus
 3) the RSA implemented in PGP cannot be the exact same as in the patented
RSA.

If I am wrong, then this explains why the PGP debate rages on. It seems to me
that it is political in some ways. Since we heard from the PKP representative
through one contributor to this discussion, alot of people decided in favor
of non-PGP software and advocated dropping PGP due to the threat of
litigation.  I agree with the author of the article who stated that PKP is
influencing us with a subtle style not usually seen online these days.  In
any case, the damage is done.

In the past, I was tempted to say something but felt that I needed more
information. The PGP-INFO digests provided much of what I needed to know. (If
the kind mailing list person who passed me on the digests is about, thank
you.)

What I've learned so far:
Threats of lawsuits result in avoidance of dealing with important issues.
As a result, advocation of safer issues are done so.
The Zimmermann PGP software is safe from legal hassles outside the USA.
PGP's RSA algorithm is not covered by the PKP 'bought' RSA patent.

The threats of litigation by PKP was a ruse. PGP could have resulted in
benefits to both sides of this particular 'battle.' Yet PKP was more
interested in a monopoly on RSA and anything related to it, including public
key encryption on the whole.


--
address Email to reach me: <a7657@mindlink.bc.ca>||<an3364@anon.penet.fi>
    "It is the very mind itself
     That leads the mind astray;
     Of the mind,
     Do not be mindless."
     (an old Japanese folk song)
Newsgroups: sci.crypt,alt.security.pgp
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: PGP as a World Standard
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 23 Dec 92 20:31:54 GMT

strnlght@netcom.com (David Sternlight) writes:

> Paul Leyland posts a good suggestion if the existence of my key in
> Bontchev's key file were a crime to be remedied. It is not. It is an
> inconvenience to Vesselin, according to his posts, and he thinks an
> inconvenience to others. What is more, I did not export my key,
> someone took it outside the US.

As usual, David avoids to quote the appropriate message, when he wants
to twist somebody's words. Your key is not of any inconvenience to me.
I will not, however, remove it from my public keyring, until I get a
revokation certificate for it, regardless how this certificate is
produced. I thought that it might be inconvenience for you, not for
the others. More exactly - to your concsience, because you are trying
to convince us that according to you usage of PGP is either illegal,
or unethical, or both. Therefore, I proposed you to use PGP once more
- to revoke your key. Paul even suggested a way to do that, which does
not require that you use PGP yourself. Had you accepted this
suggestion, it would prove that you sincerely believe in what you are
trying to convince us. Now you have removed the last hope to
demonstrate even that and have discreditet yourself completely.

> Using Vesselin's own arguments, there's nothing illegal about my key
> circulating outside the U.S. As I read the section of the Munitions

Right. There's nothing illegal in about that. But because you were
trying to convince us that you believe the usage of PGP to be illegal,
we thought that you would like correct an action which, according to
your words, has been illegal. You refused, which clearly demonstrates
how much you believe in your own words...

> Act I quoted much earlier, there's even nothing illegal about
> exporting keys (though I didn't). It's the software, algorithms,
> flowcharts that are mentioned in the regulation.

Right, nobody has ever claimed that exporting encrypted information is
illegal in the USA.

> Thus for me to use PGP in the U.S. to revoke the key (which I assert
> would be a violation), would be committing a violation in order to
> cure an inconvenience that isn't illegal.

But you were offered the possibility to do this without using PGP
yourself...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: The PGP debate: Is it legal?
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Mon, 28 Dec 1992 19:04:57 GMT


Stephen Kawamoto is inaccurate in one of his assumptions, which makes
his conclusions doubtful.

PKP does not have a patent on the algorithm. As many here have pointed
out, algorithms cannot be patented. What they have is a patent on
a method, process, device. It is general and covers the notion
of public keys using a particular mathematical insight.

PGP uses the same method, process, device of public keys using the
RSA mathematical insight. That the details aren't identical doesn't
affect the validity of the patents in the U.S.

In Japan, were it patented there, it might. The Japanese patent system
is much more specific, which is how Japanese "steal" U.S. inventions
(according to some). They make minor modifications in the patented
device, and under Japanese law (but not U.S.  patent law), they are
entitled to a separate patent. In this way they surround a perfectly
good U.S. patent with Japanese patents that make it impossible for the
U.S. patent holder to use his invention in Japan without Japanese
permission. Naturally, the Japanese patent holders then only give
permission in a way that destroys the market and profits for the U.S.
patent holder--usually by forcing him to cross-license his patent to
the Japanese.  There have been several PBS programs and parts of books
written about this.

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt,news.groups
From: hal@venus.mitre.org (Hal Feinstein)
Subject: Re:  sci.crypt.research
Organization: Mitre Corporation, McLean, VA
Date: Tue, 29 Dec 1992 14:06:48 GMT

In article <1992Dec28.173748.19534@rchland.ibm.com> lwloen@rchland.vnet.ibm.com writes:
>As a relative newcomer to Internet, I post opinions on this topic with 
>caution.
>
>
>Question:  Is this a current fad?  When the latest bills blow through
>  the US Congress or die, will most of this stuff fade?
>
>   Larry W. Loen        |  My Opinions are decidedly my own, so please
>                        |  do not attribute them to my employer

Larry, I'd like to address just one point.  If anything the political 
questions surrounding encryption are going to become more acute rather
then less in the future. Currently, much of the argument is driven by
the FBI wiretap bill. However, as other have pointed  out the
underlying argument is how and what the shape of our society will be
in the new emerging online world. Researcher are starting to become 
interested in this questions and are considering it as a question of
government and ethics  instead of the mechanisms that we focus on.
The same arguments have been with us for centuries: the rights of
the individual vs the requirements  of government. There are thoughful
people on both sides of the issues.

Beyond the sideshow of export laws which I see as a transient issue,
things like the the patenting of algorithms, the balanced role of 
government within a online society and the rights of individuals and 
organizations (such as multinational corporations) all need to 
be "hacked" out. (I use hacking in its original positive sense. 
There is no such thing as political engineering and political science 
isn't  science.) 

In sum, I think the arguments will intensify as people become
better informed on the issues. Sci.crypt seems to be a lightning
rod for internet  discussions. 

So, if my vote counts I vote to split the groups. I have no opnion what
they get called. There seems already to be some protocol on how to 
name groups. But I do hope there will be a group devoted to technology
and research (not just research as some are suggesting). Some of us
implementors are trying to stay up on whats going on in the  field and 
it moves very quickly at times.
From: bz223@cleveland.Freenet.Edu (Danny Guy Frezza)
Newsgroups: sci.crypt
Subject: Encryption/Decryption of Voice signals via normal phone line
Date: 28 Dec 1992 22:02:11 GMT
Organization: Case Western Reserve University, Cleveland, OH (USA)
Reply-To: bz223@cleveland.Freenet.Edu (Danny Guy Frezza)
NNTP-Posting-Host: hela.ins.cwru.edu


	I read about a week or so ago from USA Electronic edition of
"Telecomunication", that phones in Europe (Cellular) were going to have
encrypt/decrypt device in them.  I was wondering what the state of affairs
in US are concerning this possibility for us, and in particular, are there
legal devices to buy to encrypt/decrypt one's voice transmission via a 
normal phone line?  I thought this would be an appropriate place to post this.
Thanks,
-- 

Dan Frezza
Internet: bz223@cleveland.Freenet.Edu

Newsgroups: sci.crypt,alt.security.pgp
From: Robert Jensen <jensen@aplcomm.jhuapl.edu>
Subject: Are Lucas sequences an alternative to RSA?
X-Xxmessage-Id: <A764E3376401940B@jensens-mac.jhuapl.edu>
X-Xxdate: Mon, 28 Dec 92 01:00:39 GMT
Organization: JHU/APL
X-Useragent: Nuntius v1.1.1d9
Date: Mon, 28 Dec 1992 21:58:26 GMT

The January 1993 Dr. Dobb's contains a description of the use of
Lucas sequences as an alternative to RSA for public key encryption.
I seem to recall a previous assertion in this group that the
Lucas sequence system is just a disquised RSA.  I don't recall any
details of the assertion or any follow up discussion.  Does anyone have
an opinion on this alternative?  The advertised advantage is that the
encrypted product of two messages is not the product of the individually
encrypted messages.  This beats at least one attack on RSA.
=====================================================
Robert Jensen
jensen@aplcomm.jhuapl.edu
Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: Re: Anyone know about FEAL-8
Keywords: FEAL-8
Organization: Chinet - Public Access UNIX
Date: Wed, 23 Dec 1992 01:31:42 GMT

In article <1992Dec22.134951.16838@ncsu.edu> jlnance@eos.ncsu.edu (JAMES LEWIS NANCE) writes:
>
>I have been reading a 1988 paper by Miyaguchi, Shiraishi, and Shimizu in which
>they describe an encryption algorithm they call FEAL-8.  I am interested in
>this algorithm because it was designed to run quickly on computers.  I have 
>never heard of it anywhere before and I have the following questions about it.
>Can anyone help me?
>
>1) Is FEAL-8 Secure (as compared to DES)?

FEAL-8 is insecure.  A successful chosen-plaintext attack, using 10,000
plaintext/ciphertext pairs, was reported in the CRYPTO '90 proceedings by
H. Gilbert and G. Chase.  Biham and Shamir, in the EUROCRYPT '91 proceedings,
reported that FEAL with any number of rounds less than 32 can be broken with
differential cryptanalysis more easily than it can with brute force.

>2) Is C source code available for it anywhere?

There is C source code floating around the net.  I have two versions, one of
which will appear in my book.

>3) Is it patented

I don't know, actually.  If anyone does know, I would appreciate them telling
me.

>4) Is it a good choice for a fast, secure private key method?

No.

By the way, neither is a variant called FEAL-NX.  It's better than FEAL-N.
(FEAL-N is the FEAL algorithm with N rounds.)

Bruce
Newsgroups: sci.crypt
From: karn@servo.qualcomm.com (Phil Karn)
Subject: Re: Enigma, ULTRA
Organization: Qualcomm, Inc
Date: Thu, 31 Dec 1992 22:57:05 GMT


And yet another book on Bletchley Park and the Enigma is Kahn's 1991
book "Seizing the Enigma" subtitled "The Race to Break the German
U-Boat Codes, 1939-1943".

As the subtitle implies, this is primarily about the German Navy's use
of the Enigma, which was a much tougher nut to crack than the simpler
Enigma used by the Luftwaffe.

If you haven't seen an Enigma machine in the flesh, I recommend it.
It really drives home the impact that the computer subsequently had on
the entire field of cryptography.

Among other places, you can find an Enigma in the British Science
Museum in London and the Smithsonian Museum of American History in
Washington (formerly the Museum of History and Technology).  I first
saw the one in the British Science Museum. As I stood staring at it,
lost in thought about how the subtle properties of that modest little
box changed the course of human history, an English woman and her
young son came up and also looked at it. "What's that, mommy?" "Our
soldiers used that in the war to keep the Germans from reading our
messages." Argh.

Phil
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP - Legal?
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Sun, 3 Jan 1993 19:36:39 GMT


Jim Lynch says that if jano patokallio has diplomatic immunity he
can do anything.

Not without consequences. Though I make no comment about PGP, in
general he can be declared persona non grata and expelled. This
can have both personal and professional consequences.

As to PGP, it is in the realm of possibility that if the U.S.
Government wished and knew about it, he can be accused of
espionage and expelled. If he is not an intelligence person this
can be quite damaging, and if he is and under cover, this will
"tag" him, making his cover useless in future in the U.S. and
in some other countries (if the U.S. has information sharing
arrangements with those countries).

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt
From: karn@servo.qualcomm.com (Phil Karn)
Subject: DES source code bibliography
Organization: Qualcomm, Inc
Date: Tue, 22 Dec 1992 08:30:38 GMT

As a few people have requested, here's my current bibliography of DES
source code listings found in various widely published books or
magazines. Note that I have explicitly excluded the dozens of books
and publications that merely *describe* the DES algorithm -- even
descriptions complete enough to use as a basis for implementation.
They don't count because, as we all know, only Americans are smart
enough to turn an algorithm description into C code (or so our
government believes.)

Additions or corrections to this list are welcome. Again, I'm only
interested in actual code listings.  --Phil

PS. Mr. Sternlight is welcome to call his local US Attorney and demand
prosecution of any of the authors or publishers listed here for ITAR
violations. Dave, please report back here on the success of your efforts.


"The Standard Data Encryption Algorithm", Harry Katzan Jr, Petrocelli
Books, 1977 ISBN 0-89433-016-0 (APL).

"Computer Networks", Andrew S. Tanenbaum, Prentice Hall (both
editions; second edition is ISBN 0-13-162959-X). (Pascal)

"Numerical Recipes", William H. Press et al, Cambridge University
Press.  (Fortran and Pascal version is ISBN 0-521-30811-9.  Also in
"Numerical Recipes in C").

"UNIX System Security", Wood and Kachan, Hayden. ISBN 0-8104-6267-2.

Byte Magazine, April 1977 (6502 Assembler).

"Cryptography: An Introduction to Computer Security", Seberry and Pieprzyk,
Prentice Hall Australia. (C)

"Mathematical Cryptology for Computer Scientists and Mathematicians",
Wayne Patterson, Rowman and Littlefield, 1987. ISBN 0-8476-7438-X.
From: consensus@aol.com (Christopher Allen)
Newsgroups: sci.crypt
Subject: Opinions on RSA's RC2 and RC4?
Date: 22 Dec 92 20:26:31 GMT
Organization: Consensus Development

Does anyone have an opinion on RSA's announcement that they are
licensing their RC2 and RC4 encryption algorithms? They claim "these
algorithms have recently been singled out by the Department of State
for expedited export approval."

Does anyone have an opinion on the technical merits of RC2 and RC4?

It information also states that it is a "drop-in" replacement for DES,
does that mean it can be used with RIPEM?

I know that some of this information is available by ftp from rsa.com,
but I'm looking for third-party opinions.

| Christopher Allen                     America Online: Consensus |
| Consensus Development               Internet: consensus@aol.com |
| 3182 Campus Drive #501                      Tel: (415) 345-1060 |
| San Mateo, CA 94403-3123                    Fax: (415) 345-1714 |
Newsgroups: sci.crypt
From: osan@cbnewsb.cb.att.com (Mr. X)
Subject: Stupid question time.
Organization: Twilight Zone
Date: Tue, 22 Dec 1992 22:26:39 GMT

I hope this is not a FAQ, but if so, please direct me accordingly, thanks.

Would multiple encryptions add to the level of security of, say, a PK system
like RSA or a knapsack scheme?  What I mean is to encrypt the clear text and
then encrypt the encrypted text, probably with a different key.  If encryption
of binary poses a problem, one could, say, uuencode the encrypted text.  This
could, in theory, provide an arbitrary number of successive encryptions which
would, as far as I can see (which ain't saying much anymore :)) effectively
offer the equivalent of encryption with very large keys (say, >10000 digits).

Would this work?  Would there be any difficulty in decryption?  It seems to 
me you could mutate the clear text with basically no limit, beyond, perhaps
eventually winding up with the clear text again.  Anyone have any thoughts on
this?

	-Andy V.
Newsgroups: sci.crypt
From: lwloen@rchland.vnet.ibm.com (Larry Loen)
Subject: Re: Enigma, ULTRA
Date: Thu, 31 Dec 1992 17:24:57 GMT
Reply-To: lwloen@rchland.vnet.ibm.com
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
Organization: IBM Rochester

In article <1489@eouk23.eoe.co.uk>, ahaley@eoe.co.uk (Andrew Haley) writes:
|> 
|> Does anyone know of any technical description in the open literature
|> of the work done at Bletchley Park during WW2?  There doesn't seem to
|> be much information in Kahn's _Codebreakers_, but as that was
|> published in 1967 I'm not very surprised.
|> 
|> Andrew.

Try and get hold of back issues of the scholarly journal "Cryptologia",
available at many (probably larger) libraries (university libraries, perhaps).

There have been articles on this topic fairly regularly as well as articles
on the Polish contributions to the Enigma decipherment, which is a strongly
related topic.

See also the FAQ for an address.  They may sell back issues; I don't remember.

-- 
   Larry W. Loen        |  My Opinions are decidedly my own, so please
                        |  do not attribute them to my employer
Newsgroups: sci.crypt,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PKP/RSA comments on PGP legality
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Mon, 21 Dec 1992 21:44:15 GMT


Bill O'Hanlon is correct to call attention to my remark about
Jyrki's first name. It was a lapse. Regrets.
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: talk.crypt
Date: 28 Dec 92 22:43:34 GMT
Organization: Stratus Computer, Software Engineering
NNTP-Posting-Host: ellisun.sw.stratus.com


Could someone who knows how to create groups create talk.crypt so that
we can remove this load from sci.crypt?

I just returned from a 1 week vacation and am going through 300+ postings
-- and have seen the same 2 or 3 opinions stated over and over and over
again.

Once is enough per opinion -- unless it's a talk.* group -- at least IMNSHO.

-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488
Newsgroups: sci.crypt,alt.security.pgp
From: ji@cs.columbia.edu (John Ioannidis)
Subject: Re: PKP/RSA comments on PGP legality
Organization: Columbia University Department of Computer Science
Date: Mon, 21 Dec 1992 22:40:30 GMT

In article <1992Dec19.002110.17682@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>I said that government takes cryptographic violations of munitions
>laws much more seriously than the building of airplane models.
>
>Steve Gardner's response that nobody is harmed by cryptography is
>appalling. Consider the lives lost or saved through cryptographic
>activities during wars, anti-terrorism, drug enforcement, etc.
>

You forgot child molesting (or is that covered under "etc."?)

/ji

PS: Close-captioned for the sarcasm-impaired.
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: VTECH's encrypting wireless phone
Date: 29 Dec 1992 06:13:51 GMT
Organization: Stratus Computer, Software Engineering
Distribution: world
NNTP-Posting-Host: ellisun.sw.stratus.com


I looked at Motorola's encrypting wireless phone at the store -- heard
what "encrypted" voice sounds like -- and could recognize the voice,
so it's not nearly secure enough.  I haven't seen, but have a brochure
for, VTECH's encrypting wireless phone -- with digital transmission
between handset and base.  So I called them up and asked what they use
for encryption.  They refused to tell me....wouldn't even tell me the number
of bits of key for the algorithm.

Does anyone out there know details of VTECH's encryption?  At the
price they're asking ($350), they can afford to do at least 1 round of
DES-CBC, but I'm sure they don't.  If they did, they would have told
me.

-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488
From: rja14@cl.cam.ac.uk (Ross Anderson)
Newsgroups: sci.crypt
Subject: sci.crypt.research
Date: 26 Dec 92 13:09:26 GMT
Organization: U of Cambridge Computer Lab, UK

In <Bzru3E.1I4@chinet.chi.il.us> schneier@chinet.chi.il.us (Bruce Schneier) 
writes:
 
>Anyone besides me sick of all the political discussions?  How about splitting
>this into sci.crypt.science and sci.crypt.politics?  Or booting all of the
>political talk to alt.security--and having someone moderate this newsgroup to
>ensure compliance?

I agree.

However, in the interests of naming consistency, we should probably keep 
sci.crypt for the hobbyists and create a new group called sci.crypt.research 
for academic researchers. 

Look at sci.math and sci.math.research; the partition works pretty well.

Ross
Newsgroups: sci.crypt