HDTenEightyP/NetNews huggingface dataset:
From: caronni@nessie.cs.id.ethz.ch (Germano Caronni)
Subject: Re: Simple PGP question
Organization: Swiss Federal Institute of Technology (ETH), Zurich, CH
Date: Sun, 27 Dec 1992 22:54:50 GMT

In article <1992Dec22.210910.29667@rna.indiv.nluug.nl> gerben@rna.indiv.nluug.nl writes:
>If I try to "sign" a message with -s, the original text is encrypted. I want to  
>have a sort of "digital signature" appended after the text. I could use pgp -bs for  
>that, but is that the way to go? And what if I want to use a unix pipe?

excerpt from my local pgpnews-file :-)
pgp2.1:
- may specify Key ID instead of User ID by giving 0x<hex> as Userid.
- may keep the signed file in readable form, just adding an ascii-
  armoured signature:  pgp -ast +clearsig=on  <file> <userid>
  (Clearsig may also be set in config.txt)
- with -kvc you may disply a MD5 - hash of your keys, for key verification
  via phone-line ...

so -ast +clearsig=on does the job. I guess the 't' option is not needed.
using -fast instead of -ast and giving your text as stdin lets it work
as pipe. Or at least it should :-}

Friendly greetings,

	/gec

-- 
Instruments register only through things they're designed to register.
Space still contains infinite unknowns.

Germano Caronni    caronni@nessie.cs.id.ethz.ch
Newsgroups: sci.crypt
From: Owen.Lewis@purplet.demon.co.uk (Owen Lewis)
Subject: Re: [legality of PGP etc.
Organization: FidoNet node 2:252/305 - The Purple Tentacle, Reading
Date: Tue, 29 Dec 1992 01:34:00 +0000

 -=> Quoting Steven Bellovin to All <=-

 SB> Owen.Lewis@purplet.demon.co.uk (Owen Lewis) writes:
 > It is disingenuous to suppose that the *national only* 
 > patenting was just an unfortunate happenstance. What about the 
 > similar lack of international patenting of DES? Has any US 
 > organisation ever chosen to seek worldwide patents on ANY 
 > cryptographic product?

 SB> ...... If you want, I'll supply the U.S. patent numbers; someone with
 SB> access to the appropriate databases can check whether or not non-U.S.
 SB> patents were ever applied for.

 SB> As for your second question -- yes, I know of several instances where
 SB> non-U.S. patents on cryptographic devices have been applied for by
 SB> U.S. companies.  One caveat -- NSA (well, the Department of Defense,
 SB> but NSA in reality) is empowered to file secrecy orders against
 SB> cryptographic patent applications, which would block foreign patent
 SB> applications from being filed.  .......
 
Many thanks for the informative and helpful reply. In fact, I believe the 
issue to be sterile. The paragraph was included in   my original posting to 
elicit from a U.S. source information that, as a European, I felt it
inappropriate to raise myself in a matter of primarily US concern. Namely, 
that what may be patented is, in fields affecting national security, often 
dictated by a govermnent agency in the interests of the State.

Where the element of disclosure associated with a patent application 
is permitted, it seems reasonable to assume that one of the following would 
apply:
                a. The matter is already sufficiently compromised so that a 
patent application will not worsen the situation. If granted, the patent 
may even allow an element of control no longer possible by other and more 
thorough means. However, in particular circumstances, international patenting 
might not be possible or at least seem the greater of two evils.
                b. The matter is not considered sufficiently to affect 
national security and, consequently, a would be patentee may be left to 
pursue his commercial interest as best he sees fit. 
                
I don't wish to state the obvious by further elaboration. The corollaries 
to less than complete commercial or governmental protection of interests are 
- for any party and any nation  - inevitable.

Owen Lewis



.. Facts are stubborn little bastards, be careful with them.
___ Blue Wave/QWK v2.11
From: C51885@TRMETU.BITNET
Newsgroups: sci.crypt
Subject: RSA source code for MSDOS is needed immediately, please
Date: 22 Dec 92 09:48:26 GMT
Organization: Middle East Technical University - Computer Center

I am looking RSA source code (written in C), for MSDOS, Could
you send me, immedialtely, if you have,

              Ismail,

E-mail : c51885 at trmetu.bitnet
Newsgroups: sci.crypt
From: pmetzger@snark.shearson.com (Perry E. Metzger)
Subject: Re: Legal Stuff!
Organization: /usr/local/lib/news/organization
Date: Wed, 23 Dec 1992 03:01:42 GMT

strnlght@netcom.com (David Sternlight) writes:

>You seem not to be listening here. The issue of the legality of PGP is
>not a patent one but a Munitions Act one, since the U.S. copies were
>brought in from outside the U.S. without a Munitions Act import
>license, and since PGP includes IDEA, it requires one.

Do you have evidence of this? How do you know that PGP wasn't produced
inside the US by anonymous people with fake outside authors being used
as fronts? You don't have any real evidence that any of the claimed
authors on the package even exist. Claiming a crime has been committed
without even having conducted the most rudimentary of investigations
seems hasty, especially for one so concerned with ethics and morality
and precision. Furthermore, according to what I have seen, the
criminals would seem to be the importers -- but you have no knowledge
of who actually imported the product, if it was indeed imported. Given
that the alleged criminals are completely unknown, and likely at this
point wholely unidentifiable, it would seem to be extraordinarily
difficult to conduct a prosecution.

--
Perry Metzger		pmetzger@shearson.com
--
Laissez faire, laissez passer. Le monde va de lui meme.
Newsgroups: sci.crypt,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: export rules -- a new wrinkle
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Wed, 23 Dec 1992 06:26:29 GMT

In article <1992Dec23.051714.16866@qualcomm.com> karn@servo.qualcomm.com (Phil Karn) writes:
>In article <1992Dec23.022218.803@ulysses.att.com> smb@research.att.com (Steven Bellovin) writes:
>>     (If your the treaty between your country and the United States did not
>>     require you to respect U.S. export control restrictions, then you would
>>     not have Internet connectivity to this host.  Check with your U.S. embassy
>>     if you want to verify this.)
>
>This is an interesting assertion, since all it takes to get "internet
>connectivity" these days is a PC and a modem on an ordinary telephone
>line that can call into a SLIP or PPP server anywhere in the world..
>
>Phil


Doesn 't SLIP or PPP access require password validation? If so,
it would be the site's responsibilty to assure that the above
rules were complied with, yes?

-- 
David Sternlight
RIPEM key on server
Xref: sparky sci.crypt:6072 alt.security.pgp:375
From: smb@research.att.com (Steven Bellovin)
Newsgroups: sci.crypt,alt.security.pgp
Subject: Re: Legal Stuff!
Date: 22 Dec 92 21:19:13 GMT
Organization: AT&T Bell Laboratories

In article <bontchev.725032635@fbihh>, bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:
> > 1. PGP cannot be imported legally
> > since it violates RSA's patents.
> 
> Could you qote the law that states that importing of patented devices
> is illegal?

I just asked a patent attorney I know.  Importing a patented device
into the U.S. constitutes infringement, as does making, selling, or using
the device.  Lots of other obvious loopholes are covered as well.
Newsgroups: sci.crypt
From: cbbrowne@csi.uottawa.ca (Christopher Browne)
Subject: Re: Are Lucas sequences an alternative to RSA?
Organization: Dept. of Computer Science, University of Ottawa
Date: Tue, 29 Dec 92 00:15:12 GMT

In article <Bzzp1F.MEy@netnews.jhuapl.edu> jensen@aplcomm.jhuapl.edu (Robert Jensen) writes:
>The January 1993 Dr. Dobb's contains a description of the use of
>Lucas sequences as an alternative to RSA for public key encryption.
>I seem to recall a previous assertion in this group that the
>Lucas sequence system is just a disquised RSA.  I don't recall any
>details of the assertion or any follow up discussion.  

I don't remember hearing such an assertion.

>Does anyone have an opinion on this alternative?  

My opinion is divided; it looks like it's SLIGHTLY stronger than RSA,
but not fundamentally so.

>The advertised advantage is that the
>encrypted product of two messages is not the product of the individually
>encrypted messages.  This beats at least one attack on RSA.

It beats ONE attack on a naive implementation of an RSA message
protocol.

However, from what I can tell, only a stupid implementation would be
particularly susceptible to such an attack.

It's been said time and time again here that it's not JUST the
encryption algorithm that's important; the WHOLE messaging system has
got to be strong.  And with even a half-hearted set of messaging
protocols, the attack shouldn't be effective.  All you need do is add
some random salt (or an MD5 signature) to the message before
re-encrypting, and the weakness is covered.

The "problem" with the Lucas system, from what I can tell, is that
it's not evident that it's FUNDAMENTALLY stronger than RSA.  It still
stands or falls based on the assumption that it is very difficult to
factor the product of two enormous prime numbers.

I would have been much more excited if LUC involved some OTHER
hard-to-reverse operation rather than prime factoring.

Supposing some prime-factoring algorithm comes out next week that
kills RSA, LUC would become similarly useless.  I don't foresee such
an algorithm coming, but certainly it WOULD kill 'em both.

I'd like to see other more fundamental advantages to LUC; there was a
claim in the article that it might be faster than RSA, which would
qualify.  There might be other advantages that make it harder to
break.  I'd love to hear about it.

-- 
Christopher Browne                |     PGP 2.0 key available
cbbrowne@csi.uottawa.ca           |======================================
University of Ottawa              | Genius may have its limitations, but
Master of System Science Program  | stupidity is not thus handicapped.
Newsgroups: sci.crypt,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP as a World Standard
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Mon, 21 Dec 1992 18:53:08 GMT


Vesselin Bontchev asks why I don't revoke my key. The reason is because
now that I understand the legal position I won't use PGP. To revoke
my key en clair would be insecure and many have argued about the
dangers of spoofing.

Besides, the key does no harm out there. Those who wish to delete it
are certainly free so to do. I see no reason why someone would
send me a PGP message, and if they were so to do, I could easily
ask them to retransmit it in clear.

I can't help feeling that Vesselin isn't really serious in his request,
but has his tongue in his cheek. If he IS serious, then he's attempting
to induce me to use PGP illegally, and I won't.

By the way, in a previous message, Vesselin argues that he comes from
a country (Bulgaria) without patent (or was it copyright) protections,
as if that is an argument that should carry weight.

Hardly. In the former Soviet Union many crimes were committed which
were not illegal, as, I warrant, in Bulgaria. That doesn't make them
right. I suggest that if present-day Bulgaria wishes to gain the benefits
of membership in the international economic community, or the EEC, it
will have to bring its intellectual property laws in line, and until
then, many of its actions constitute stealing according to international
norms, even if not under the laws of Bulgaria.

David
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP as a World Standard
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Mon, 21 Dec 1992 18:38:01 GMT


John Kreznar posts another of the several recent messages attempting
to deal with my arguments by imputing motives, or claiming they are
invalid without actually addressing them.

If John wants to be taken seriously, he should address the arguments
directly and show why they are in error, if he can. The rest is noise,
and usually a sign of inability to address the issues.

David
Xref: sparky sci.crypt:6259 alt.security.pgp:443
From: strnlght@netcom.com (David Sternlight)
Newsgroups: sci.crypt,alt.security.pgp
Subject: Re: PGP as a World Standard
Date: 29 Dec 92 05:47:04 GMT
Followup-To: alt.security.pgp
Organization: Netcom - Online Communication Services (408 241-9760 guest)


It is incorrect to say that according to PKP it is o.k. to use
PGP for personal use. Please provide a source for this statement.

You came in after the movie ended. PKP has a patent on work done
only partly with public funds. The agreement with the government
provided for free use by the government, and for patentablility,
and for exploitation by the patent holders for non-government
use. This is a very common arrangement that gave us the
digital computer and many other inventions.

Without such arrangements, many of the brightest people would
devote their attentions elsewhere, with concomitant impoverishment
of the invention base, particularly in areas of interest to
the government, such as computers, electronic technology, etc.

This has been discussed at great length in the relevant newsgroups,
over the past month or so.

David

-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail
Newsgroups: sci.crypt,alt.security.pgp
From: brewer@sol.cs.wmich.edu (Steve Brewer)
Subject: Re: PKP/RSA comments on PGP legality
Organization: W M U Fako de Sciencaj Studoj
Date: Tue, 22 Dec 1992 13:09:01 GMT

In article <1992Dec21.075754.14136@netcom.com> strnlght@netcom.com 
(David Sternlight) writes:
>
>Steve Gardner also ignores facts he must know in order to minimize
>the seriousness with which the government takes crypto, by trying
>to compare crypto to good boots (in order to make it appear silly
>to consider crypto as munitions). Thousands of lives have been
>saved by crypto, and several generals have referred to the 
>Enigma and Purple decrypts as worth several divisions. 

Yes, this is undoubtedly true.  However, I would argue that your
nationalistic claims are foolish and short-sighted.  The laws
you support reduce the long-term competetiveness of US cryptography
(as has been pointed out by other posters).

Furthermore, you make light of Mr. Gardner's apt comparison of boots
to cryptography.  Perhaps an even better one, then, is medical knowledge.
Medical knowledge, equipment, and drugs save far more lives than
cryptography, yet I don't see anyone suggesting that they be called
'munitions' and banned.  Immunizing soldiers has probably reduced 
war-related deaths more than any other single advance in human knowledge, 
but yet this is not classified as sensitive data.  By your argument, 
it should be kept secret even from our own citizens and not 
released for public use long after the rest of the world has its 
advantages.

When it comes to real freedom of information and the press the US has 
a long way to go.

-- 
Steven D. Brewer     W M U Fako de Sciencaj Studoj      brewer@cs.wmich.edu
PGP 2.0 Key available.............................99brewer@lab.cc.wmich.edu
"Kiu regalas per ^stonoj, tiun oni dankas per bastonoj." D-ro L.L. Zamenhof
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Re: Real question re DES vs IDEA cipher
Date: 29 Dec 92 00:13:26 GMT
Organization: Stratus Computer, Software Engineering
NNTP-Posting-Host: ellisun.sw.stratus.com

In article <BzsH0G.9yz@chinet.chi.il.us> schneier@chinet.chi.il.us (Bruce Schneier) writes:
>
>I am more confident with triple-DES (112-bit key), but that takes a whole
>lot longer than IDEA.

I, too, am more confident with triple-DES -- but why call it only 112 bits?

If each of the 3 DES stages does its own CBC and has its own IV, then
each stage has (56+64) bits of key -- so the ensemble has 3*120 = 360 bits
of key.

Meanwhile, there's still my favorite:

	compress|des|tran|des|tran|des

(where tran was posted here a week or two ago)

-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488
From: hagopes@works.uucp (Yinco Schmeer)
Newsgroups: sci.crypt
Subject: pgp
Date: Wed, 23 Dec 92 17:40:42 EST
Organization: The Works BBS - Informational Archives - Est. 1985

>>Is there a published description of these algorithms anywhere? If not,
then does anyone know if software incorporating these algorithms has
actually been exported out of the US?<<

The author includes source code to the program with the compiled prodcut. 
He explains this in the documentation, saying that any secure algorithm 
should be able to be distributed freely to enable others to study the 
algorithm. That way there is less of a chance that he is releasing a weak 
algorithm.
-Hagopes
Newsgroups: sci.crypt
From: pmetzger@snark.shearson.com (Perry E. Metzger)
Subject: Re: RIPEM vs. PGP
Organization: /usr/local/lib/news/organization
Distribution: na
Date: Thu, 24 Dec 1992 19:44:17 GMT

smb@research.att.com (Steven Bellovin) writes:
>Well, it's 7 years till the RSA patent expires.  As for IDEA -- it's
>patented, too, which certainly restricts the use of PGP for commercial
>purposes.

Actually, I believe the terms of the license aquired for PGP were such
that so long as PGP itself was publically available that it could be
used for any purpose. The restriction on IDEA is not on the uses of
IDEA or what you are encrypting or for what purpose but on making
money by selling a proprietary product based on it without giving them
a cut.

Someone please correct me if I am wrong.
--
Perry Metzger		pmetzger@shearson.com
--
Laissez faire, laissez passer. Le monde va de lui meme.
Newsgroups: sci.crypt
From: karn@servo.qualcomm.com (Phil Karn)
Subject: Re: Motorola 'Secure-Clear' Cordless Telephones
Organization: Qualcomm, Inc
Distribution: na
Date: Sun, 3 Jan 1993 11:03:38 GMT

In article <1993Jan3.054517.29505@colnet.cmhnet.org> res@colnet.cmhnet.org (Rob Stampfli) writes:
>>Another is that Bell Labs developed a truly remarkable (given the
>>technology of the day) secure speech system that really was secure. It
>How did they keep them in sync?

Good question. I seem to remember that this was a problem. The system
was written up in IEEE Spectrum some years ago, but I don't have a
copy on hand.

I believe it was the same issue that explained how Hedy Lamarr (yes,
the movie actress) invented frequency hopping, one of the fundamental
forms of spread spectrum radio.

Phil

Newsgroups: sci.crypt
From: cyoung@thor.ece.uc.edu (Christopher Young)
Subject: Re: sci.crypt.science
Organization: University of Cincinnati
Date: Wed, 30 Dec 1992 21:16:05 GMT

Ignore the previous post. One should finish reading news before leaping onto the
followup button. 8-)


-- 
-------------------------------------------------------------------------------
Christopher Young    				|	To those who don't
University of Cincinnati       			|	want to bear the cost
Department of Electrical & Computer Engineering |  	of changing society,
mail location 30				|	will bear the brunt
Cincinnati, OH. 45221				|	of the society they
(513)556-0904 					|	will not recognize.
						|
cyoung@thor.ece.uc.edu				|
-------------------------------------------------------------------------------
Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: sci.crypt.science
Organization: Chinet - Public Access UNIX
Date: Thu, 24 Dec 1992 16:06:49 GMT

Anyone besides me sick of all the political discussions?  How about splitting
this into sci.crypt.science and sci.crypt.politics?  Or booting all of the
political talk to alt.security--and having someone moderate this newsgroup to
ensure compliance?  My kill file is bulging.

Bruce
Newsgroups: sci.crypt,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PKP/RSA comments on PGP legality
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Mon, 21 Dec 1992 07:51:52 GMT


Jyrki (apt name) posts another anti-U.S. screed in which he says that
I must have been referring to violence done by the U.S. government
when I talk about lives lost or saved by cryptography during the war.

I was not. I was talking about lives lost at Pearl Harbor, lives
saved at Midway, and lives saved by Enigma and Purple decrypts, among many
others.

This is not the first time Jyrki has ignored the facts in order to flog
his anti-American views, and it will doubtless not be the last.

David
From: rteasdal@polyslo.csc.calpoly.edu (Rusty)
Newsgroups: sci.crypt
Subject: Another well-intentioned novice's question
Date: 4 Jan 93 05:13:00 GMT
Organization: Cal Poly San Luis Obispo, CSc Department



	Hmmmm. I've been pondering this question for some time
now, and making little headway, so I thought I'd better run it
by the net's crypto wizards:

	A few months ago, in the letters section of the 
_Communications of the ACM_, there was published a letter which
commented that, in the opinion of the author, cryptographic	
efficiency would be greatly enhanced by compressing a message
before encrypting it, the better to remove repetitive patterns
from the plaintext.

	I don't see, though, that standard (i.e. LZW) compression
algorithms actually do remove any of the redundancy from the text;
they merely encode and substitute for lengthy repetitive patterns
with smaller ones. Mathematically, the whole of the message is
still there, is it not?

	Admittedly, if one does not know the full details of
the algorithm used in the compression, decompression will be far
from easy, and I can certainly conceive of several simple hacks to
the basic LZW technique which would be tantamount to simple shift
encoding and the like, making it harder yet to unravel.

	Can someone more learned elucidate at greater length on
this question? And is there any merit at all to the original letter 
writer's argument?



	 
-- 
||||||||   Russ Teasdale -- rteasdal@polyslo.CalPoly.EDU  --  (Rusty)  ||||||||
-------------------------------------------------------------------------------
"Gentlemen, if we do not succeed, then we run the risk of failure." - D. Quayle
Newsgroups: sci.crypt,alt.security.pgp,misc.legal
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: Legal Stuff!
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Wed, 23 Dec 1992 01:13:09 GMT

In article <1992Dec22.131928.13715@nntp.hut.fi>, jkp@cs (Jyrki Kuoppala) writes:
>Could you site the law which makes this illegal?
           ^^^^

Damn.  This Usenet reading gets me to make stoopid speling mistakes.
I should of known to wrote it "sight".  How stoopid of me.  Next I'll
probably write "copywrite" as "copywright".
From: lwloen@rchland.vnet.ibm.com (Larry Loen)
Subject: Re: DES, etc
Date: Thu, 31 Dec 1992 19:27:18 GMT
Reply-To: lwloen@rchland.vnet.ibm.com
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
Organization: IBM Rochester

In article <e2oNwB1w165w@west.darkside.com>, sspy@west.darkside.com (mshannon) writes:
|> Another question, gentlemen, if you would:
      (stuff deleted)
|> When one says they "assume the spooks have been able to break the DES" is 
|> that assumed to be in CBC or only in ECB mode?

As far as I recall, this is a theory versus practice issue.  Breaking DES
in ECB mode should also permit, in theory, CBC mode to be broken also. 
But, the attacks against ECB alone are slightly easier than the attacks 
against CBC mode.

|>     
       (rest of stuff deleted)

-- 
   Larry W. Loen        |  My Opinions are decidedly my own, so please
                        |  do not attribute them to my employer
Newsgroups: sci.crypt,alt.security.pgp