HDTenEightyP/NetNews huggingface dataset:
From: robert.heuman@rose.com (robert heuman)
Subject:  Exporting password p
Organization: Rose Media Inc, Toronto, Ontario.
Date: Tue, 22 Dec 1992 05:26:20 GMT
X-Gated-By: Usenet <==> RoseMail Gateway (v1.70)


Date Entered: 12-22-92 00:22
bill@texan.rosemount.com (William Hawkins) said, in

B > One kind of DOC license requires the recipient of the software
B > to swear that the software will not be exported to anyone on
B > the restricted list.  You can imagine how much trouble it must
B > be to keep up with the list.  Think about it.  The list is made
B > for geographical boundaries.  When is the last time that a piece
B > of geography threatened you?  Iran is on the forbidden list.  Are
B > there any citizens of Iran outside the geographical borders of
B > that country?  Do they have access to encryption techniques?  I
B > do not mean to pick on Iran, but only to show that the borders
B > have nothing to do with access to information.

Even more interesting is the fact that the restricted list is NOT the 
same between COCOM countries, so that while the US forbids trade with 
CUBA, Canada does not, and what can be exported from the US legally to 
Canada can, under Canadian law be exported to Cuba even if it cannot 
be exported directly from the US.  [That is why Cuban cigars are 
available in Toronto, but not NYC, and why flights to Havanna from 
Moscow stop at Gander to refuel.]  Not only is it legal to export to 
Cuba, it is illegal to discriminate against Cuba or a Cuban simply on 
the basic of nationality.  Assume that I import something from the US 
to my computer store in Toronto, under the rules re the US restricted 
list. How would I determine that the cash paying customer is from 
Cuba, and not allowed to buy the product based on US rules, when 
Canadian rules permit him to buy the product? We're back to reality. 
These rules are unenforcable unless ALL of the COCOM countries have an 
identical list, and they do not.... DOC can complain all they like 
over this one.

Bob Heuman
---
   RoseReader 1.70 P001886: This Canadian has an Opinion...His Own!
   RM 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285
Newsgroups: sci.crypt
From: karn@servo.qualcomm.com (Phil Karn)
Subject: Re: Motorola 'Secure-Clear' Cordless Telephones
Organization: Qualcomm, Inc
Distribution: na
Date: Sat, 2 Jan 1993 23:40:49 GMT

In article <1993Jan2.174522.12032@qiclab.scn.rain.com> Leonard.Erickson@f51.n105.z1.fidonet.org writes:
>And according to several histories of cyprtology I've seen, one of the
>reasons the US & Britian *quit* using frequency inversion scramblers
>for calls between Churchill and Roosevelt was that the techs working
>on the system reported that with practice it became possible to understand
>the inverted speech! 

Another is that Bell Labs developed a truly remarkable (given the
technology of the day) secure speech system that really was secure. It
used voice coders (vocoders) and one-time-pads generated by recording
the electrical noise from mercury-vapor rectifier tubes on phonograph
records.  After two pressings were made, the masters were destroyed.
One copy was kept in the US and the other was shipped to London under
the careful watch of a Marine guard. After being used once to protect
a Roosevelt-Churchill conversation, each pair of discs was destroyed.

I believe that the German intelligence experts said after the war that
this was the only Allied secure speech system they were never able to
crack.

Phil
Newsgroups: sci.crypt,alt.security.pgp
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: PGP as a World Standard
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 21 Dec 92 13:45:21 GMT

strnlght@netcom.com (David Sternlight) writes:

> Steven Bellovin calls attention to the anonymous sleaze who posted
> an old key I used for PGP before I found it was illegal in the U.S.
> I don't use it, and haven't except for generating the key. Note
> that the date of the key is September 24, 1992, well before I discovered
> that PGP is illegal here.

Then, maybe you should use PGP 2.x once more - to revoke your key...
Because, I have it in my collection of public keys too, and it has
certainly being distributed to several people who asked me for it...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: sci.crypt,alt.security.pgp
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: PGP as a World Standard
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 23 Dec 92 13:14:26 GMT

pcl@ox.ac.uk (Paul C Leyland) writes:

> Here's what I suggest:

> David does *not* use PGP to issue a revocation certificate.  He
> broadcasts, on this newsgroup, his secret key, pass-phrase, anything
> he wishes, *without* using PGP.  He uses uuencode, for example, as an
> asciifier.  Vesselin likewise posts David's public key and anyone who
> is interested checks it against their own copy.  Once both are
> published, anyone can check that they are indeed a public-private
> pair.  Anyone in possession of both can then issue a revocation
> certificate.

That seems a perfectly reasonable solution to me... If David does not
intend to use PGP, then he shouldn't be concerned about the compromise
of his secret key. As a beginning, here is his public key:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.1

mQCNAirCBpQAAAEEAL9DFGfkb2Z6uDQWIv8+K0nGomgwokOuUjOlm0rP14qY5+Ui
yfk3fPEEjMaApwYNCBQIbQkR7limlP0+PCQwbF/qbFut83JA0D94317ZreR26uKO
GD7w19Ktp9lPVmLH1AiAQVozyrljLLahjPVKELmis62IqxlpIoiFcZa7sz5lAAUR
tCZEYXZpZCBTdGVybmxpZ2h0IDxzdHJubGdodEBuZXRjb20uY29tPg==
=98lY
-----END PGP PUBLIC KEY BLOCK-----

> I'll volunteer, if need be, as I don't believe possession and use of
> pgp *in my environment* is illegal or unethical.  I'd prefer others to
> do it (Vesselin?), as I've only just started to use pgp and I'm not
> fully confident that I know exactly what I'm doing.

I have not tried to use key revoketion sertificates yet, but it
doesn't seem that difficult at all... I just think that David might
prefer an idependent party to do the operation, but I would accept to
do it myself, if he agrees.

> Does this suggestion satisfy the honour of both parties?  Is it
> practical?

No problems from my side - I find the solution perfectly reasonable,
practical, and satisfactory. So, now it depends only on David.

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Legal Stuff!
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Tue, 22 Dec 1992 21:58:15 GMT

Since I don't like to argue for argument's sake, and since a recent
development (see my post on the RSAREF license, and make what
inferences you like about the imminent release of RIPEM) has made
this discussion moot, from my point of view, if Vesselin wants to
be right, he may be so. I think the issues have been clearly spelled
out, and users, being adults, may do what they wish in full knowledge
of the issues and arguments.

As for me, my RIPEM public key is available on the server. Since I
do not expect any cryptographic communications for any particular
reason (though RIPEM users are welcome to send them), much less from
outside the U.S., that RIPEM is not legally available outside the
U.S. and Canada is of little personal moment.

As for the understandable desire of many for universal privacy-
enhanced communications, from my own personal point of view
(WARNING-not "the truth" but just what I believe) there are several
ways to achieve this which I would not have any questions about:

1. For PGP to be written from scratch in the U.S. to incorporate
RSAREF, thus permitting communications between the U.S. version
and any other while honoring what I understand to be RSA's patents
and the Munitions laws. Such a rewrite could be used here, but
not exported. I don't think there's a problem with exporting
messages and keys themselves.

2. For RIPEM's cryptographic components (DES and RSAREF) to somehow
be rewritten de novo outside the U.S. to be consistent with national
crypto and patent laws, thus permitting communications between the
U.S. version of RIPEM and any other.

3. For RIPEM to be upgraded in the U.S. to include IDEA, and PGP format
compatibilty.

4. For the Munitions Act/ITAR regulations to be changed AND PKP's
patents overturned (or expire).

I think 4. is both unlikely and will take some time if it happens.

My understanding of 3. is that if the RIPEM author gets many requests,
he will consider it, but not otherwise. Note that a modification of
RSAREF to handle certificates, etc. (if that's where it has to be
handled in software) is not a performance modification under the terms
of the RSAREF license, and thus requires RSA's permission.  The
license does say they won't deny such permission for "all reasonable
requests."

I suspect 2. is unlikely without some illegal export from the U.S.

I understand some are working on 1., and the RSAREF license should
make their job much easier.

David
Newsgroups: sci.crypt,alt.security.pgp
From: honey@citi.umich.edu (Peter Honeyman)
Newsgroups: sci.crypt,alt.security.pgp
Subject: Re: PKP/RSA comments on PGP legality
Date: 24 Dec 1992 03:39:58 GMT
Organization: Center for Information Technology Integration, Univ of Michigan
Distribution: world
Reply-To: honey@citi.umich.edu
NNTP-Posting-Host: hone.citi.umich.edu

David Sternlight writes:
||> In Europe, where I have never argued RSA's patents apply, and I have
|> never argued the U.S. Munitions laws apply, I argue the ethics of
|> taking an invention without compensation.  

is this an issue of ethics?  beyond a patent's lifetime, is it ethical
to take an invention?  17 years: ethical; a day less: unethical?  

i don't think so.  we're talking about laws here, not ethics.

	peter
Newsgroups: sci.crypt,alt.security.pgp
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: PKP/RSA comments on PGP legality
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 23 Dec 92 12:45:05 GMT

strnlght@netcom.com (David Sternlight) writes:

> In addition to his other erroneous messages, to which I'm not going
> to reply because I'm not repeating old substance--let Metzger read--
> Metzger posts this bit of nastiness. Once more it shows
> that he's not reading but just spewing forth. I acknowledged the
> lapse in making a play on Jyrki's first name and expressed regrets
> about a day ago in a public post, as well as privately to Jyrki.

It only means that either Metzget has missed your message, or his
newsfeeder gets the news with some delay. It is not difficult to miss
a message, having in mind how many of them you have posted - this
flame war covered 3 or 4 newsgroups, if not more...

> But Metzger isn't interested in a serious discussion--just in making
> himself right and others wrong. He can say what he likes-- I won't
> respond further to such as he.

Matzget posted some very reasonable arguments, but you do not bother
to reply to them. Indeed - you are not responding as him...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: sci.crypt,misc.legal
From: bhayden@teal.csn.org (Bruce Hayden)
Subject: Re: PGP use Ethical and Legal Questions
Organization: Colorado SuperNet, Inc.
Date: Thu, 24 Dec 1992 04:21:21 GMT

strnlght@netcom.com (David Sternlight) writes:


>Rick Miller makes a couple of legal arguments, that I, as a fellow
>non-attorney, think incorrect.

>1. He asserts that until a patent is tested in court its status
>is indeterminate. I think this is a misstatement of law. I believe
>the law is that until a patent is overthrown in court it is valid.
>That's a very different matter, and leads to such things as
>retrospective damages from the time of the verdict.

Patents are presumtively valid. However, this presumption can be, 
and often is overcome. In particular, some of the presumption is
lost if you can show lack of candor with the PTO (failure to disclose
material information to them).

However, note that just because you have successfully defended a
patent, doesn't mean that you are off the hook. A finding of validity
usually has no estoppel value against someone who was not a party to
the previous suit. This means that you have to reprove the validity
each time it is challenged. Lose once though, and the patent is 
invalid thereafter. 

Bruce E. Hayden
(303) 758-8400
bhayden@csn.org

Xref: sparky sci.crypt:6277 news.groups:24969
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt,news.groups
Subject: Re: sci.crypt.research
Date: 30 Dec 1992 07:46:37 GMT
Organization: Stratus Computer, Software Engineering
Distribution: world
NNTP-Posting-Host: ellisun.sw.stratus.com

In article <1hr7hpINNcd@crcnis1.unl.edu> vporguen@unlinfo.unl.edu (victor porguen) writes:
>Researchers who are not willing to consider, or are unwilling to 
>discuss, how their research affects the society they live in, are not
>worth being allowed to do research.

There's a huge difference between a willingness to discuss how cryptography
affects society and a willingness to read endless flame wars between people
who have value system conflicts which will never be resolved.

sci.crypt has always suffered from useless drivel on both sides of the
"should RSA be allowed to be patented" question.  That traffic belonged in
the group ONCE -- back in 1978.  In all the megabytes of postings on that
subject recently, I have not seen one new idea.

The reiteration of old ideas -- the eternal conflict between value systems
-- belongs in a talk.* group, not in a sci.* group.


I think that our problem here is that no one is in a position to enforce
sci.crypt's original charter (assuming it had one).  If we could just give
sci.crypt a moderator who would refuse to permit any reiteration of a
position already seen in the group, it would get back to its proper 1
message a day or less.

-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488
Newsgroups: sci.crypt,alt.security.pgp,alt.security.ripem
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Legal Stuff!
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Fri, 25 Dec 1992 20:27:13 GMT


Erik Oliver sends an interesting message, and one with integrity, in
which he says that keeping PGP on his machine is, for him, a form
of protest.

A couple of comments:

1. I hope it is HIS machine and not a machine he's using. He has no
ethical right to bring down disinterested innocent parties with him,
if he's wrong.

2. Protest isn't much good unless those being protested against know
about it. Otherwise it is a self-indulgent, empty gesture. Judging
from the tone of Erik's post, I know he is not such a person. Thus
I suggest he send a copy of his statement to the Director of Public
Affairs at the NSA, to the Attorney General's office, and to
Jim Bidzos of RSA Data Security (jim@rsa.com).

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt
From: injc@helios.rz.tu-clausthal.de (Joerg Czeranski)
Subject: Re: Help
Organization: Techn. Univ. Clausthal
X-Newsreader: Tin 1.1 PL5
Date: Mon, 28 Dec 1992 16:36:28 GMT

Germano Caronni (caronni@nessie.cs.id.ethz.ch) wrote:
: Rivest(I am not sure about the name) has shown in a
: recent paper, that he can reduce the complexity of breaking DES by diffe-
: rential cryptanalysis from 56 bit keyspace to 47 (or was it 41?) bit key-
: space. And I am sure, the NSA has constructed one of these machines, that
: contain _many_ parallel working DES-chips...
: Germano Caronni    caronni@nessie.cs.id.ethz.ch

Shamir held a talk near Brussels (Belgium) in spring 1992, where he
explained, how to break DES using a chosen plaintext attack.  You have to
make your opponent encrypt 2^47 data blocks, while changing his key at most
every 8192 encryptions.  Then you will break one of these keys with
probability very close to 100%, and you will get the key just after
it has been used, so chances are good, that it is still valid.
 The crucial point is that it is a chosen plaintext attack, thus unlikely
being of any practical value.

Joerg

--
Joerg Czeranski                EMail injc@sun.rz.tu-clausthal.de
Osteroeder Strasse 55          SMTP  injc@[139.174.1.3]
W-3392 Clausthal-Zellerfeld    Voice (at work)  +49-5323-72-3896
Germany                        Voice (at home)  +49-5323-78858

To verify PGP public key, finger injc@sun.rz.tu-clausthal.de, or email me.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.1

mQA9Ais98rIAAAEBgJzQ7Bh3LCI0F8bpmnN3/G8Ip6KZrnhgyIr5cnBiuco3l1tk
levnfI+isd6qK5oFKQAFEbQtSm9lcmcgQ3plcmFuc2tpIDxpbmpjQHN1bi5yei50
dS1jbGF1c3RoYWwuZGU+
=dZKc
-----END PGP PUBLIC KEY BLOCK-----
Newsgroups: sci.crypt
From: UC445585@mizzou1.missouri.edu (John M. Kelsey)
Subject: PGP technical question (Not a flame)
Organization: University of Missouri
Date: Mon, 21 Dec 92 22:28:35 CST

   Why did PGP change from bassomatic to IDEA?  Where can I find references
to IDEA?  (It's Swiss?)
 
   --John Kelsey
Newsgroups: sci.crypt,alt.security.pgp
From: nelson@sun.soe.clarkson.edu (Russ Nelson)
Subject: Re: PKP/RSA comments on PGP legality
Organization: Clarkson University, Potsdam NY
	<bontchev.725036591@fbihh> <1992Dec22.203159.23174@netcom.com>
	<1hbbeeINNnp@terminator.rs.itd.umich.edu>
Date: Fri, 25 Dec 1992 05:10:13 GMT

In article <1hbbeeINNnp@terminator.rs.itd.umich.edu> honey@citi.umich.edu (Peter Honeyman) writes:

   David Sternlight writes:
   ||> In Europe, where I have never argued RSA's patents apply, and I have
   |> never argued the U.S. Munitions laws apply, I argue the ethics of
   |> taking an invention without compensation.  

   is this an issue of ethics?  beyond a patent's lifetime, is it ethical
   to take an invention?  17 years: ethical; a day less: unethical?  

   i don't think so.  we're talking about laws here, not ethics.

David seems to be arguing that breaking the law is unethical, as he
disparaged the use of civil disobedience (or else he doesn't
understand his own arguments).  But then why argue that the use of RSA
is unethical in Europe??

--
--russ <nelson@sun.soe.clarkson.edu> Businesses persuade; Governments force.
Newsgroups: sci.crypt,misc.legal
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: PGP use Ethical and Legal Questions
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 23 Dec 92 22:18:37 GMT

strnlght@netcom.com (David Sternlight) writes:

> By the way, has no one noticed that in the license RSA agrees to
> defend any licensee against any lawsuits for patent violation
> (for use of unmodified RSAREF) without limit. That, and much else
> in the license agreement, seems to me to put paid to the various
> nasty inferences made by some (I'm speaking generally, not
> particularly about Miller) here about RSA's motives, particularly
> since the license is free.

How generous from their part, isn't it? Now, who the hell could be
those bad guys who will be going to sue you for usage of RSAREF?...

> I understand from Jim Bidzos that they're going to go even further.
> As soon as they get their administrative act together, those who
> request RSAREF directly from RSA (U.S. and Canadians only, I suppose)
> will also get anything that uses RSAREF as well, such as RIPEM and
> other goodies.

Big deal, indeed. Especially having in mind that anybody in the USA
can easily get RIPEM - and RSAREF comes with it anyway...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: sci.crypt
From: ritter@cactus.org (Terry Ritter)
Subject: Re: Motorola 'Secure-Clear' Cordless Telephones
Organization: Capital Area Central Texas UNIX Society, Austin, Tx
Distribution: na
Date: Sun, 3 Jan 1993 21:42:33 GMT


 In <1993Jan3.110338.25314@qualcomm.com>
 karn@servo.qualcomm.com (Phil Karn) writes:

>In article <1993Jan3.054517.29505@colnet.cmhnet.org> res@colnet.cmhnet.org (Rob  Stampfli) writes:
>>>Another is that Bell Labs developed a truly remarkable (given the
>>>technology of the day) secure speech system that really was secure. It

>>How did they keep them in sync?

>Good question. I seem to remember that this was a problem. The system
>was written up in IEEE Spectrum some years ago, but I don't have a
>copy on hand.

 Kahn, D.  1984.  Cryptology and the origins of spread spectrum.
 IEEE Spectrum.  September.  70-80.  (Also see letters in December.
 10-14.)

    "Both ends agreed when they would start the records.  The agreed-
 upon timing signal from the U.S. naval observatory's radio station
 WWV, which broadcast time signals, caused the turntables to begin
 revolving.  An ingenious clutch ensured that they accelerated so
 smoothly that the stylus did not jump out of the groove.  The
 records, a U-boat-infested ocean apart, would be within half a
 second or so of synchronization.  Chirps filled Smith's telephone.
 Then, watching a counter calibrated in milliseconds, the sergeant
 used a phase shifter to advance or retard turntable speed and bring
 the two units into exact synchronization.  As they came into sync,
 the peeps faded into silence."


>I believe it was the same issue that explained how Hedy Lamarr (yes,
>the movie actress) invented frequency hopping, one of the fundamental
>forms of spread spectrum radio.

 Screen star devises a frequency-hopping scheme.  (sidebar, p. 78)

 Secret Communication System.  H. K. [Hedy] Markey, et. al.
 U.S. Patent 2,292,387, issued Aug. 11, 1942.

 Basically seems to use piano-type-rolls with slots.  Apparently the
 slots allow electrical contact with various capacitors which affect
 a variable-frequency oscillator (VFO) to produce different (radio)
 frequencies at different times.  Identical rolls produce the same
 frequency-hopping sequence.

 ---
 Terry Ritter   ritter@cactus.org

Newsgroups: sci.crypt