HDTenEightyP/NetNews huggingface dataset:
From: rcain@netcom.com (Robert Cain)
Subject: Re: Demons and Ogres
Organization: Netcom - Online Communication Services  (408 241-9760 guest) 
Date: Thu, 19 Nov 1992 19:34:20 GMT

This has probably been covered in this long many threaded discussion
but assume for a moment that a suspected perpetrator is communicating
using strong cryptography on a public carrier, phone line for the
example.  Regradless of whether it is legal or illegal to do so an
interesting side effect is that any attempt to prove its use forces LE
to admit using a wiretap and thus it is incumbent on them to secure
what the courts consider proper permission to do so.  Thus at least the
days of illegal prophylactic wire taps will be over when such devices
are available either legally or illegally.  Anyone who thinks this is
not being done at will during investigations is very naive.  The proper
permissions are only obtained when the wire tap data is to be used as
evidence.  Illicit tapping usually renders it unnecessasary to ever
use the taps as evidence because they lead LE to harder evidence.

Another problem with making it illegal is that convicting a suspect of
using it may incur a penalty but it serves as a door bell to the suspect
that he is under surveilence and will make it a lot less likely that he
will be caught doing whatever he is suspected of doing.  Thus I doubt
LE will press charges just on the basis of using illegal crypto unless
the penalties are very stiff indeed.  Just being an additional charge
will be little deterence to a perpetrator.

It is so easy to make such a device today that if it becomes criminal to
have and use such a device, only the criminals will have them and have
them they will.  The criminal realizes full well that if he is being
tapped, he is under surveilance and in deep shit to begin with so he
has little more to lose by encrypting his communication and probably
considerable to gain.

While I can see the concern of LE and think there are some very valid
considerations, it is a no win situation for them already.  Selling
these devices would become just another high profit criminal activity.
Every drug dealer, drug user, mafiosi, spy, revolutionary, etc. will
have one eventually.

Bob
-- 
Bob Cain    rcain@netcom.com   408-358-2007

"There are some strings.  They're just not attached."
                                                    Victoria Roberts


               PGP 1.0 or 2.0 public key available on request.
Newsgroups: sci.crypt
From: ken@halcyon.com (Ken Pizzini)
Subject: Re: New Encryption - a Challenge
Organization: The 23:00 News and Mail Service
Date: Sun, 22 Nov 1992 09:52:54 GMT

In article <n0eeet@ofa123.fidonet.org> Erik.Lindano@ofa123.fidonet.org writes:
>Writes rschnapp@metaflow.com (Russ Schnapp):
> > To assert a NIH attitude is absurd, given that there is no _here_ 
> > here. 
> 
> Oh yes, there is!  Gosh, we even have a FAQ post and everything...
> We have people who support each other against newcomers.  There is a
> remarkable solidarity among the "in" crowd.  FAQ + solidarity 
> creates a definite "here" place.  Don't you think?  ;-)

Not _Invented_ Here.  Precious few, if any, of the well-regarded
encryption schemes were developed on sci.crypt.  And those with
high regards gained these regards by withstanding the strongest
attack: given everything but the key, devise a way better than
exhaustive keyspace attack to decrypt a message.


> > If your friend is truly interested in having experts assess the 
> > security of this algorithm, s/he must submit the _algorithm_ to 
> > the experts -- not the _output_ of the algorithm.
> We certainly don't want to do that. The output is the challenge,
> not the algorithm. 

Which is fine, as far as it goes, but most on sci.crypt are more
interested in the algolrithm than the puzzle output.  rec.games.misc
might have been a better place for this particular challange.

		--Ken Pizzini
Newsgroups: sci.crypt
From: sl@wimsey.bc.ca (Stuart Lynne)
Subject: Re: the Right of Privacy
Organization: BC News and Mail
Date: Sun, 15 Nov 1992 23:48:30 GMT

In article <1992Nov15.055114.12777@colnet.cmhnet.org> res@colnet.cmhnet.org (Rob Stampfli) writes:
>In article <1992Nov13.193629.14615@watson.ibm.com> uri@watson.ibm.com (Uri Blumenthal,35-016,8621267,) writes:
>>2. Yes, there is a difference between the "things" and "information".

>This is fundamentally different than the proposal of Dr. Denning which
>demands a key be produced for safekeeping before the fact.  I disagree
>with that approach, finding it in violation of several of the precepts
>in the Bill of Rights.  Incidently, I also disagree with the assertion
>of Mr. Ritter that people should be charged with retaining their keys
>indefinitely.  Destroying "evidence" before one has reason to believe
>it is of legal value is hardly a crime, and pitching the key that decrypts
>a casual email message is no more "destroying evidence" than throwing
>out an old letter you have no need for any more.

There are certain records that you must retain and make available on request.
Specifically the government (or more specifically the IRS, Revenue Canada
or whatever your local tax department is called) can demand to see your 
records for some specific period of time. Seven years? I think these records
if kept on a computer system would be suitable candidates for encryption
but if requested you would be foolish not to decrypt and provide them.

On the other hand there are no real crypto issues here. Not providing them
because you have lost the key or just don't want to falls into about the same 
category as loosing the physical records. I.e. you are in bigtime trouble if 
they want to make an issue out of it. It may be less of a problem to take the
rap for not providing the records but don't bet on it.

On the other hand it seems that other elements of encryption might be of
interest to the same goverment agencies. Digital signatures are good evidence
of authorship. If they where required on all electronic transactions it becomes
easier for them to follow the audit trail. No sense in claiming that a record
didn't originate from you if it was signed with your digital signature.

Secure and protected communications can be a benefit to the government as well
as the rest of us.

-- 
Stuart Lynne <sl@wimsey.bc.ca> ....................... UNIX Facsimile Software
Wimsey Information Technologies ................... moderator biz.sco.binaries
uucp login:nuucp passwd:nuucp .................. ftp.wimsey.bc.ca:~ftp/ls-lR.Z
PD Software for SCO UNIX .................. ftp.wimsey.bc.ca:~ftp/pub/wimseypd
Newsgroups: sci.crypt
From: billmcc@seanews.akita.com (Bill McCormick)
Subject: Questions about MD5 and DES
Organization: SEANEWS - Seattle Public Access News & Mail
Date: Mon, 16 Nov 1992 05:59:49 GMT
Summary: Some questions about specific implementation issues
Keywords: DES IDEA MD5

I've been hacking together a little program that does encryption using
one or more of DES, Triple DES, and IDEA.  I've come up with some
questions that I hope can be answered by the net.

1.  My understanding is that "Triple DES" is encryption using one
    key, decryption using another, then re-encryption using the
    first key.  Is this correct?  i.e., E3(P,K) = E(D(E(P,K1),K2),K1)

2.  Has triple DES actually been proven to be stronger than a single
    DES encryption?  I guess this boils down to whether DES has been
    proven to be a group.

3.  I've been using MD5 to hash an arbitary user-entered string into
    a key for the encryption process.  Is MD5 really suitable for the
    task?  It appears to be a particularly good hash for long strings
    of text, but is it suitable for short password-length text?

4.  In order to provide fast user-feedback if an incorrect decryption
    key is entered, I'm storing a "checksum" of the first block of
    plaintext in the encrypted file.  I was originally using a
    simple checksum, but that might give away too much information
    about the first block.  Now I apply MD5 to the block and take
    a byte of the message digest as the check digit.  Is this
    reasonable or would it be better to simply use the first
    8 bytes of the file as a DES/IDEA key to encrypt a constant and store
    a byte of that constant?

5.  Which is stronger, CBC or CFB?  Is one preferred over the other in
    cases where byte-per-byte output isn't important?

Thanks for any help!

Bill
-- 
SEANEWS  []  Seattle News + Mail  []  Public Access  []  +1 206 747 NEWS
E-mail for PGP key.   MD5 (no sigs) is: 8e253e95133365a292261c7d0da58bcb
Xref: sparky sci.crypt:5173 alt.privacy:2397 comp.org.eff.talk:7185
From: ed@titipu.resun.com (Edward Reid)
Newsgroups: sci.crypt,alt.privacy,comp.org.eff.talk
Subject: Re: A Silver Bullet to Limit Crypto?
Date: Sat, 21 Nov 92 13:35:14 EST(-0500)
Organization: Accuracy, Ltd.
Reply-To: ed@titipu.resun.com (Edward Reid)
Distribution: inet
X-Mailer: uAccess - Macintosh Release: 1.6v0

cme@ellisun.sw.stratus.com (Carl Ellison) writes:
> Old LE tools should map into the new space (with new connectivity,
> as if space warps had been invented).  If you disagree, please cite
> some such tools and show how they are defeated.

Suppose I turn it around.  Cite me an old LE tool that maps, with new
connectivity, into the new space.

Uri Blumenthal cited a variety of techniques.  However, they fall into two
categories: 1) unaffected by electronic communication (eg blooded knives), and
2) electronic but still applicable (eg planted microphones).

David Burns similarly cited some tools in the second category.

Jerry Leichter discussed differences in LE between 150 years ago and today,
claiming in particular that criminal investigation is basically a twentieth
century phenomenon with little corollary in the pre-electronic world.  He also
points out that crimes themselves have changed: to extend his statements a bit,
the existence of electronic communication has led to crimes which could not be
committed, possibly not even contemplated, without electronic communication.

The latter views are much closer to my own.  It's not just the physical world
which has changed.  Attitudes, entire philosophies, change in ways which are
far more difficult to track than are physical changes.  Old attitudes and
philosophies are far more difficult to understand than are old physical
conditions.

Carl also says

    there was a time when criminals were free to have private
    conversations and know that the conversation[s were] private

That is undeniably true in the physical sense.  But did anyone actually think
in such terms?  More importantly, are we capable of expunging this concept, and
similar ones, from our vocabulary so that we can "go back to doing what we did
before"?  Is it even meaningful to talk about "going back" unless we roll back
our attitudes and philosophies?

Edward Reid  (8*}>
  eel:   ed@titipu.resun.com  or  nosc.mil!titipu.resun.com!ed
  snail: PO Box 378/Greensboro FL 32330
From: tkacik@hobbes.hobbes.cs.gmr.com (Tom Tkacik)
Newsgroups: sci.crypt
Subject: IDEA, FEAL, and FEE
Date: 23 Nov 92 20:32:31 GMT
Reply-To: tkacik@hobbes.hobbes.cs.gmr.com
Organization: GM Research Labs

Sci.crypt is the first place I have seen mention of the cyphers, IDEA, FEAL,
and FEE (or EE).  Can anybody tell me how they work?  Or, more likely,
references to their workings?

I saw the core code to IDEA posted, and will try to work it out, but
if there are any clear expositions, I would be thankful.
--
Tom Tkacik
GM Research Labs
tkacik@hobbes.cs.gmr.com
tkacik@kyzyl.mi.org

Xref: sparky sci.crypt:5209 comp.org.eff.talk:7201 alt.privacy:2409 talk.politics.guns:24386
From: pc123@cus.cam.ac.uk (Pete Chown)
Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
Subject: Re: Risks of Using PGP 2.0
Date: 23 Nov 92 20:09:38 GMT
Distribution: inet
Organization: U of Cambridge, England

In article <1eq9fsINN2fd@usenet.INS.CWRU.Edu> aq817@cleveland.Freenet.Edu (Steve Crocker) writes:

   Some on this thread appear to believe that because they live outside
   the U.S. and are not U.S. citizens, that their actions need not comply
   with U.S. law. Permit me to remind you that the Supreme Court of the 
   U.S. has upheld the legality of U.S. agents arresting foreign nationals
   on foreign soil for crimes against U.S. law committed on foreign soil.
   Unless anyone expects their government to go to war against the U.S. 
   to protect them, you had better think twice about violating U.S. law,
   whoever you are and wherever you might be.

Okay then.  I intend to download a copy of PGP later, and use it for
something forbidden by the patent owners.  I fully expect the CIA to
knock on my door within a matter of hours.

On a more serious note, if it became necessary for the UK to go to war
to protect its right to self-determination then I would, very
reluctantly, have to support that.  I hope fervently that it doesn't
come to that again - but present events don't make me optimistic.
Countries trying to enforce extra-territorial laws in a small way is a
very bad omen; it is interesting to note that a lot of these laws are
expressly excepted from the normal provisions where the UK courts will
enforce foreign judgements in return for the foreign jurisdiction
doing the same.
--
---------------------------------------------+ "A tight hat can be stretched.
Pete Chown, pc123@phx.cam.ac.uk (Internet)   |  First damp the head with steam
            pc123@uk.ac.cam.phx (Janet :-)  -+  from a boiling kettle."
Xref: sparky sci.crypt:5030 alt.privacy:2358 talk.politics.guns:24308
From: a7657@mindlink.bc.ca (Stephen H. Kawamoto)
Subject: Re: A new encryption problem?
Organization: MIND LINK! - British Columbia, Canada
Date: Mon, 16 Nov 1992 19:23:16 GMT

We could just cause the criminal who uses PGP to forget his key to the vital
information. I mean, if it of any use to the police encrypted, why should the
criminal benefit by knowing the key?

--
Stephen Kawamoto <a7657@mindlink.bc.ca>
    "It is the very mind itself
     That leads the mind astray;
     Of the mind,
     Do not be mindless."
     (an old Japanese folk song)
From: karn@servo.qualcomm.com (Phil Karn)
Newsgroups: sci.crypt
Subject: Re: Finally! We're getting somewhere.
Date: 16 Nov 92 04:13:17 GMT
Article-I.D.: qualcomm.1992Nov16.041317.2307
Organization: Qualcomm, Inc

In article <BxqFx6.Iz@constant.demon.co.uk> slangley@constant.demon.co.uk (Simon Langley) writes:
>What you are describing is Constitutional inertia.  This is a good thing 
>if you have a good Constitution, and I believe that your Constitution is
>largely something to be proud of.  However, if a decision were made
>that reduced civil rights (eg if Roe v. Wade were overturned) it would be
>difficult to change it back, even if a majority of the population thought
>that it was wrong.
It would depend entirely on what the opinion said. In the Anglo-American
system, judges cannot conduct inquisitions; they can only preside over cases
that are brought to them. And by the time the US Supreme Court sees a
case, the issue is usually whether a certain law should be struck down as
unconstitutional. In the case of abortion, the issue has been whether
the states have the right to restrict the right to an abortion, not
whether the states can make abortions legal. If the former question is
answered "yes", then those states that decide not to enact laws against
abortion do not have to do so. But if the court goes much further and says
that the latter statement is true, then the only thing that could overrule
them would be an amendment to the Constitution, which I agree is a slow
and painful process (by design).

In other words, the fine print of a Supreme Court decision can be very
important.

Phil
>: As former Justice Brennan used to say, "The majority already have the
>: other two branches of government. We're here for the minority."
>: 
>What does Justice Rehnquist have to say on this subject :-).

Probably "Let's just rubberstamp the government's cases here and go
home early. After all, the government reflects the will of the
majority, and most of the people who are accused of crimes are guilty
anyway."

Phil
Newsgroups: sci.crypt,alt.privacy,talk.politics.guns
From: lvc@cbnews.cb.att.com (Larry Cipriani)
Subject: Re: address, phone # list of congress
Organization: Ideology Busters, Inc.
Date: Thu, 19 Nov 1992 21:29:49 GMT

In article <1992Nov19.123637.58@nsrvan.vanc.wa.us> sysevm@nsrvan.vanc.wa.us writes:
>
>        I think it was asked where we could get the address of USA government
>persons for letter writing and the like. Below I've included the names of the
>elected officers. I don't have the address for the senate and congress but I'm
>sure someone on the net does and will post it. In any case the list includes a
>telephone number so that you may call and ask for an address.

This is an outdated list.  Several of the listed politicians were not
returned to office.  Do you have a more recent version ?  Thanks,
-- 
Larry Cipriani, att!cbvox1!lvc or lvc@cbvox1.att.com
From: jkreznar@ininx.UUCP (John E. Kreznar)
Newsgroups: sci.crypt
Subject: Re: A new encryption problem?
Date: 17 Nov 92 08:14:49 GMT
Organization: Independence Industries, Los Angeles

In article <1992Nov13.075430.8494@cactus.org>, ritter@cactus.org (Terry Ritter) writes:

>  In <1992Nov13.011516.27463@news.eng.convex.com>
>  gardner@convex.com (Steve Gardner) writes:

> >    What is this "society" you speak so blythely of?

>  The collected body of people who function under The Constitution.

It excludes, for example, any person who does not consent to "function
under The Constitution" and who strives to avoid accepting the
so-called "benefits" of such consent.

>  Well, I'm not really going to get into the semantics of the
>  difference between "society" and "the government".

That may be a serious error.  It may well turn out that the delicate
flower of civilization will survive only because of that part of
society which deliberately and consciously avoids involvement with
government.  Cryptography is an important tool by which these decent,
peace-loving folk can defend themselves from imposition by the
collective.

In <1992Nov13.094243.10343@cactus.org> you say "But what *I* think is
pretty much irrelevant.  The issue is what our legislators think, and
the arguments we can make to support our case."  This suggests that
you are prepared to willfully concede to voters (or their agents)
choices which had previously been yours alone, such as whether to
encrypt your data.  Not all people make this concession.

-- 
        Relations among people to be by mutual consent, or not at all.
         ---John E. Kreznar, jkreznar@ininx.com, uunet!ininx!jkreznar
Xref: sparky sci.crypt:4838 comp.sys.next.misc:22018
From: louie@sayshell.umd.edu (Louis A. Mamakos)
Newsgroups: sci.crypt,comp.sys.next.misc
Subject: Re: UNIX Mail with PubKey Encryption
Date: 15 Nov 1992 22:43:08 GMT
Organization: University of Maryland, College Park
NNTP-Posting-Host: sayshell.umd.edu

In article <1992Nov15.135015.19748@cubetech.com> andrew@cubetech.com writes:

>I just use ForYourEyesOnly that came as a 2.0 Demo app...  It's a
>NeXTSTEP app, you can insert files (but not directories, sigh) and use
>different fonts like NeXTmail, you can mail the ciphertext from the
>services menu, and...... it's legal to use in the US (whereas PGP
>(Pretty Good Privacy) is very ILLEGAL in the US).

If FEE is legal to use in the US, then why did it mysteriously
disappear from 3.0?  Is NeXT afraid of a legal challange from RSA?
I've been very curious about this since the early 3.0 announcements
made a really big deal about this capability.

Also, while you may trust ForYourEyesOnly to not have any trap doors
in it, I don't.  Will NeXT tell you how it works?  Will you believe
them?  For example, the "Secure" application that's on the Educational
Software Sampler CDROM looks rather cool.  Its description claims:

	Description:

	Secure provides private single key encryption to user files.
	It can be used either as a standalone or Services menu
	application.

It in fact does this.  But if you are the paranoid type (and it pays
to be if you're talking cryptography) and you "strings" your way
through the application, you find that is uses the UNIX 'crypt'
command!  While crypt makes your file unreadable to the naked eye, it
certainly has no real degree of security that I'd want to depend on;
certainly not compared to DES, which is what I expected to find.
Search "archie" for cbw, the Crypt-Breakers Workbench.

While I certainly applaud NeXT for the really neat application
interface, the business end of this app falls way short of what you'd
want to depend on.  I want to know what I'm getting and what I'm
depending on.  I really hope that a program like "Secure" becomes
available which uses real cryptography.

The principles behind RSA are pretty well known; the source code to
PGP is also available.  I would be a higher degree of trust in this
software rather then a "black box" with unknown properties.

If you don't believe that you can use PGP legally, perhaps you should
wait for the RIPEM package to become avialable, which is distributed
with the RSAREF software from RSA.  I believe that you will be able to
use this software for non-commercial purposes with RSA's blessing.
RIPEM messages look somewhat like PEM, though it doesn't use
certificates, just "bare" public/private keys.

louie


Newsgroups: sci.crypt
From: cbbrowne@csi.uottawa.ca (Christopher Browne)
Subject: Re: the Right of Privacy
Organization: Dept. of Computer Science, University of Ottawa
Date: Sun, 15 Nov 92 19:40:09 GMT

What all of this ``plain-text'' issue may mean is that there is an
additional incentive for the development of more advanced means of
accessing data, ala hypertext, and the like.

If you start transmitting data around in such a "value-added" form, it
may be that lawyers/judges won't be capable of reading it in its plain
text form.

If the plaintext form is incomprehensible to the average lawyer, and
there is no "simpler representation", then it's no big deal to release
the plain text.

This is also an argument for using non-"standard" spreadsheet
software, or something just incompatible enough with Lotus 123 that
your "plaintext" spreadsheets won't read properly into most peoples'
PCs.

And it doesn't even directly involve any actual encryption...  Wow, I
should consider taking a patent out on "hiding data by using software
features not found in Lotus 123, Excel, or Quattro Pro."

-- 
Christopher Browne                |     PGP 2.0 key available
cbbrowne@csi.uottawa.ca           |===================================
University of Ottawa              |  The Personal Computer:  Colt 45
Master of System Science Program  |  of the Information Frontier