HDTenEightyP/NetNews huggingface dataset:
From: wb8foz@skybridge.SCL.CWRU.Edu (David Lesher)
Newsgroups: sci.crypt
Subject: Re: the Right of Privacy
Date: 13 Nov 92 02:39:55 GMT
Reply-To: wb8foz@skybridge.scl.cwru.edu (David Lesher)
Organization: NRK Clinic for habitual NetNews abusers - Beltway Annex
NNTP-Posting-Host: skybridge.scl.cwru.edu

Others said
# A man writes love-letters to his mistress.  He encrypts them so that
# neither his wife nor her husband can read them.  Is he required to
# submit his key and encryption system to the government just in case
# the government ever decides he might be guilty of something?

The obvious extension:
Angry wife starts CIVIL action to get the key.
(After all, we are seeing a vast increase in the use of the civil
category for everything from parking tickets to cash confiscation.)

--
A host is a host from coast to coast..wb8foz@skybridge.scl.cwru.edu
& no one will talk to a host that's close..........................
Unless the host (that isn't close).........................pob 1433
is busy, hung or dead....................................20915-1433
Newsgroups: sci.crypt
From: wcs@anchor.ho.att.com (Bill Stewart +1-908-949-0705)
Subject: Re: A Trial Balloon (to see whether we are sheep)
Organization: A Saucerful of Secrets
Date: Fri, 6 Nov 1992 00:58:04 GMT
Keywords: Steganography

In article <1992Oct29.160103.16928@ariel.ec.usf.edu> drcc@ultrix.csc.usf.edu. (David Cabana (MTH)) writes:
	[various sensible things that would offend Judge Bork...]
   Dear B:
   I know you love to play with simulations of large cellular automata,
   particularly Conway's beautiful game of life.  Here is a file of
   initialization data for an NxN automation.  Enjoy.  Yours, A.

Life is a nice example - I was trying to think of uses like GIFs or music,
but it's pretty obvious when data sounds/looks like white noise.  
But life could work; fractals are another possibility,
especially if your fractal-generator feeds off random input.
"My fractal program produced this ugly random-looking output -- is it a bug?"

   .... illegally encrypted data, since A is presumed innocent.
   To do this they will have to decypher A's message.
   Perhaps they cannot, because they cannot break DES.  Even worse,
   perhaps they can break DES, but they do not want to reveal this in court.

It's relatively easy to get around the latter problem - they can claim
they were doing a brute-force or guessing search, and it guessed right.
Tough to do if your key is largely non-ASCII, but highly plausible for
short ASCII keys.  Or they can say they got an anonymous tip ....
--
#				Pray for peace;      Bill
# Bill Stewart 908-949-0705 wcs@anchor.att.com AT&T Bell Labs 4M312 Holmdel NJ
#
# Two more months!  Ya-Hoo!
From: pfarrell@gmuvax2.gmu.edu (Pat Farrell)
Subject: Re: RSA marketing weakness or lack of demand?
Keywords: RsA, PKP, marketing
Organization: George Mason University, Fairfax, Va.
Date: Tue, 10 Nov 1992 13:05:21 GMT

In article <1992Nov4.195416.4015@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>
>It appears that RSA has had patent protection for about 15 years. Yet
>there are no readily available standard RSA systems for use on Macs,
>nor standard electronic mail packages widely available for purchase
>using RSA (though it is claimed that Apple's OCE will include at
>least message authentication next year).
>
>I'm curious about what people think about why this is. 

I believe that market acceptance of the encryption and
authentication capabilities of RSA have been slow to catch on
because most technology needs to be accepted by the 'early
adopters' well before it can be accepted by the mass market.

I think the authentication market for RSA has the potential to
be far larger than the encryption side. As businesses 
actually roll out client/server application in production use,
the authentication issue will become critical. It is a small
problem when all the clients are on a company-owned and
controlled network. It is a huge problem when the net is the
Internet.

Businesses are conservative. Businesses dealing with money are
even more conservative. They will accept digital signatures
only when there is a proven track record of their use in
general. Not long ago, the idea of a bank offering a credit
card was radical, even though stores had been issuing cards
for years. Business will accept the technology after is
has gained acceptance.

The non-availability of software is seriously hurting
acceptance. PEM is no better than available "real soon now"
and its reliance on "certifying authorities" is bothersome.
And while PGP is available, use in the US, which has the most
personal computers connected to modems, is claimed to be
illegal by the very folks who should be promoting licensed use
of RSA. I expect that it will take a couple of years of use
before the user interface and key management issues of these
packages are resolved will enough to allow mass market use.
It will take longer still for integrated packages that can 
seamlessly handle the various flavors of encryption (IDEA,
DES, RSA, etc.) and delivery mechanisms (SMTP, X.400, MCImail,
CompuServ, Prodigy, etc.) without making the user keep it all
straight. I do not believe that the general public is willing
to care about the conflicts. If they are not resolved, the
public simply won't use it.

Until integrated software is widely available, and the legal
usage issues resolved, RSA will remain at best a niche
product. It is possible that this will not be resolved before
the PKP patents expire.

Pat


Pat Farrell,      40+ year Grad Student                  pfarrell@cs.gmu.edu
Department of Computer Science, George Mason University, Fairfax, VA
PGP Public key available via finger           #include standard.disclaimer
Write PKP. Offer money for a personal use license for RSA. Free PGP in the US.

Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
From: lwloen@rchland.vnet.ibm.com (Larry Loen)
Subject: Re: Registering "Assault Keys"
Date: Wed, 11 Nov 1992 22:34:05 GMT
Reply-To: lwloen@vnet.ibm.com
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
Organization: IBM Rochester

In article<1992Nov11.151529.14633@cci632.cci.com> Steve Owens writes:

> Stiffer penalties and more prisons get the
>criminals off the streets.  This is a proven, working solution that
>can be used as a band-aid until a better solution can be found.

We have about doubled the prison population in this country in the
last ten or so years.  Built a lot of prisons.  Spent billions.
Emptied the mental hospitals to find money to do it (indirectly,
but that's about what happened).

I sure don't feel any safer.  Seems to me that all we did with
stiffer sentences and more prisons was increase the supply of
criminals with darn little effect on violent crime.  Has it been
cut by half?  By even 10%?  Do you feel any safer?  I sure don't.

As for our wonderful handgun culture, I think it very interesting
that I am more likely to be blown away by a 13 year old in 
Minneapolis than I am to be blown up by the IRA in London and
probably even in Belfast.  True, no one can keep the IRA disarmed,
but trying does seem to help a little. . .

-- 
   Larry W. Loen        |  My Opinions are decidedly my own, so please
                        |  do not attribute them to my employer
Newsgroups: sci.crypt,comp.org.eff.talk,alt.conspiracy
From: markbr%radian@natinst.com (markbr)
Subject: Re: A Trial Balloon on Registered Keys
Date: Thu, 12 Nov 1992 19:04:39 GMT
Organization: n.o.y.b

In article <1992Nov8.040757.26340@murdoch.acc.Virginia.EDU> burke@Turing.ORG (John R. Burke) writes:
>I take offense to your article. I love my country, I pay may taxes, and yes
>I am a gun owner.. not all gun owners are rednecks or anarchists.
>But I do defend your right to make stupid statements.
>
>			         John Burke
>
>       			Never underestimate the power
>			     of human stupidity.
>				Lazarus Long.
>
Now wait a minute! I'm an anarchist, and I *don't* own a gun! Where did it
say in the rulebook that I had to? Did you arrange to have my rulebook
*censored*?

	mark

Never underestimate the stupidity and verbosity of Lazarus Long (blow him
away while he's talking, Quick! You've only got three pages more in this
sentence!)
From: deathmaster+@CMU.EDU (Eric Edward Moore)
Newsgroups: sci.crypt
Subject: Re: New Encryption System - Challenge!
Date: 9 Nov 92 19:32:00 GMT
Article-I.D.: andrew.wezoZE_00WCQRPNnYl
Organization: Senior, Chemistry, Carnegie Mellon, Pittsburgh, PA

Erik.Lindano@ofa123.fidonet.org writes:
>  I tend to agree. I told him so myself. However, neither your comment 
>  nor mine seem to deter him.  He insists that neither you nor I can 
>  break his encryption. I know *I* can't. How about you?? Do you feel
>  you could crack such a thing?

What good is an encryption system with no key?

if there's no user added variable why can't I *buy* a copy and decrypt
everyone elses encrypted text?

See if that helps...

	-Love, Kisses, and a Neutron Bomb
		-Eric the Finn
Newsgroups: sci.crypt
From: ritter@cactus.org (Terry Ritter)
Subject: Re: Limits on the Use of Cryptography?
Organization: Capital Area Central Texas UNIX Society, Austin, Tx
Date: Wed, 11 Nov 1992 22:24:13 GMT


 In <1992Nov11.095811.27796@cs.ruu.nl> piet@cs.ruu.nl (Piet van Oostrum)
 writes:

>>>>> ritter@cactus.org (Terry Ritter) (TR) writes:

>TR>     The police bust an alleged child molester, and take possession
>TR>     of his PC.  They believe that the hard drive contains a full
>TR>     database of young kids who have been *or may be* assaulted.
>TR>     That database is enciphered.
>
>Yeah and would you think he would just encipher it with a registered key?

 Well, no, considering that my original post included:

>>criminals
>>would not register keys anyway.

 The point is that a future society might demand that enciphered
 information be made available to proper authorities, after due
 process, and if that was *not* done, this could itself constitute
 a crime.


>Or think of the following scenario: Het isn't so stupid to put the database
>in his computer, but he has it on paper in a vault with a combination lock.
>What is the difference? (by the way, the vault destroys its contents when
>it is forcefully opened).

 First of all, society may well think that an auto-destroy safe is
 sufficiently rare as to not be worth addressing.  However, the same
 law that required cryptography users to retain information and keys
 might well prohibit the use of auto-destroy safes, auto-destruct
 Mission Impossible tape machines, self-melting CD's and various
 other such devices.  Evidence of such use might constitute a crime.
 The use of magnetic tape bulk erasers might be a crime in some
 cases.

 Look, I proposed this issue to help crystalize the opposing point
 of view, so that we could see the strength of those arguments,
 formulate a response, and estimate how effective the response
 would be.  The particular scenario is irrelevant:  I have no doubt
 that many examples could be concocted involving terrorists,
 mass-murder, assassination, etc.

 The issue is *not* what I think, nor what *you* think; the issue
 is the extent to which these arguments would convince ordinary
 people and legislators to pass a law limiting the use of secrecy
 technology.

 A related issue is the extent to which we could live with such
 regulations, but I really fail to see how individual resistance
 could do much about it; secrecy crimes might just replace drug
 crimes in filling our prisons.  Individuals could burn five years
 of their lives on this, only to get out sadder and wiser, and
 unable to get a job anywhere.  Is this a reasonable response?

 Alternately, we could just sit back and expect the courts and
 The Constitution to protect secrecy in the US, and they might,
 but I wouldn't count on it.

 ---
 Terry Ritter   ritter@cactus.org

Xref: sparky sci.crypt:4352 talk.politics.guns:23524 comp.org.eff.talk:6778 alt.privacy:2094
From: spongebo@cithara.UUCP (Gary Seven)
Newsgroups: sci.crypt,talk.politics.guns,comp.org.eff.talk,alt.privacy
Subject: Re: Registering "Assault Keys"
Date: 5 Nov 92 04:16:28 GMT
Organization: Local Testbed for network mail, we trust!

pcl@oxford.ac.uk (Paul Leyland) writes:

> For you conspiracy theory folk, it is of course well known that GCHQ
> does not spy on British communications; neither does NSA on US
> communications.  However, there is nothing to stop the two
> organisations from trading information.
> 
> I am not necessarily suggesting that GCHQ intercepts US comms.
> 
> Paul


Paul, what is the source of your info? I recently saw a documentary 
segment on CBC Newsworld where a former GCHQ worker claimed that GCHQ was 
in fact reading the telexes and faxes of it's citizens. Also that it was 
prone to the abuse of power, particularly in regard to *DICTIONARY*,
their Key-Word data sifter.

Something else which brought them (GCHQ) under fire was a category
of file labelled "Not For Ministerial Eyes". The implication of this was, 
of course, that GCHQ was *not* answerable to the Parliament, and therefor 
not the people.

While Britain is considered by many to be the most paranoid "democracy" 
in the "free-world", this seems to be taking it just a little too far!
If you have information to contradict this, please let me know.

Also, do you have any idea if (and what) a *Dictionary* is being used by 
other "powers", and if so in what varieties -- ie, how capable IS this 
thing!

Thanks for your time,

Owen
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Re: time-release keys
Date: 10 Nov 92 15:59:57 GMT
Organization: Stratus Computer, Software Engineering
NNTP-Posting-Host: ellisun.sw.stratus.com

Sorry for following-up my own message, but:

>We could encrypt millions of times over, using different keys, but the
>computation time preparing the secret might take longer than the
>transmission (or at least a sizeable fraction of it).


If we used straight RSA, we could have the station on the moon always apply
the same transformation:

	y = x^d mod N

Each application would result both in removal of one envelope and in a fixed
time delay, t0.  If we wanted to have a real delay of t, we could compute

	k = ceil(t/t0)

	m = e^k

and encrypt our secret with

	y = x^m mod N

noting in the message packet the value of k.  Each round trip to the moon
would strip one envelope and would decrement the value of k -- so that when
k got to 0, the secret would pop out -- at the promised time.

However, there's still a flaw with this mechanism.  Someone wishing to
prevent disclosure of something embarrassing or criminal could blow up
the station on the moon or subvert the one on the earth into losing
or corrupting traffic.


So -- any better ideas for doing this?



-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488
From: hughes@hermes.agate (Eric Hughes)
Newsgroups: sci.crypt
Subject: Re: A Copper Balloon
Date: 9 Nov 92 08:41:15
Organization: /accounts/hughes/.organization
Distribution: world
NNTP-Posting-Host: hermes.berkeley.edu
In-reply-to: denning@guvax.acc.georgetown.edu's message of 7 Nov 92 14:22:20 -0500

In article <1992Nov7.142220.1683@guvax.acc.georgetown.edu>
denning@guvax.acc.georgetown.edu writes:

>My question is: is this any better?  worse?

In a word, worse.  Much worse.  It requires more invasive monitoring
that any previously proposal, it restricts the use of encryption, and
it creates new bureaucracies.

Re: "3-way Diffie-Hellman public-key exchange protocol"
>The third party would be the service provider ...

This new proposal is now a variant of the digital telephony bill.
Note that the session key is useless unless the digital contents of
the session are also sent.  So now we have required participation in
both line monitoring _and_ key generation.

I would suggest that curious parties get a hold of the list of
corporate opponents of the digital telephony bill.  This list can be
obtained from the EFF.  It includes AT&T and most, if not all, of the
RBOC's.

>Obviously this would not work with PGP or any form of RSA encryption
>which uses permanent keys.  So if such a strategy were used, it would
>constrain what protocols & methods could be used.

Such a new law would also then make certain uses of cryptography
illegal.  All of these uses would pertain to cryptography as used in
communications.  The best use of cryptography is exactly for
communications.  

Let me understate the case to say that this is undesirable.

>... it might be better to just record session keys rather than
>permanent keys.

To summarize, we are going to record session keys and restrict
permanent keys.  Convenient, to say the least.

Re: computer networks
>much harder ... than telephone systems where you could
>require that hardware products meet the basic requirements.

Such a new law would also require a new bureaucracy to ensure that
switches met type specification.

Another market opportunity: Interop for monitoring equipment!

>... no keys would be kept unless a court order were issued.

Thus session key archiving would be another unenforceable crime.

Earlier in her article, Dorothy Denning writes:
>I'd like to suggest another possibility, which for want of a better
>name I'll call the "copper balloon".  It's quite clear that key
>registration goes over like a "lead balloon".

Let's see, copper has a lower density than lead, right?  In that case
this proposal should be named the "uranium balloon."

Allow me now to address Dorothy Denning personally.  It is the opinion
of many here that any kind of prior arrangement for the monitoring of
encrypted communications is inconsistent with the principles of a free
society.  I urge you simply to change your mind on this matter.  To
hold a bad opinion _per se_ is nothing to be ashamed of, and to change
one's opinion away from such an opinion is honorable.  No one will
think less of you for embracing freedom.

Eric

Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
From: starr@genie.slhs.udel.edu (Tim Starr)
Subject: Re: Registered Keys - why the need?
Organization: UDel, School of Life & Health Sciences
Date: Sun, 8 Nov 1992 09:40:14 GMT

In article <1992Nov6.134822.5000@news.yale.edu> watt-alan@net.yale.edu (Alan Watt) writes:
}True.  But no government where cars are registered has (yet) promoted
}a policy to restrict or ban private automobile ownership.  When one
}does, you can bet the registration lists will be used to aid enforcement.

Just give the environmentalists enough rope.  They've already started to try
to pull us down the slippery slope with gas taxes, emissions controls,
"alternative" energy policies...  I can just hear them now: "No one has the
right to endanger the Planet by the anti-environmental act of driving their
own vehicle.  Let them take public transportation."

And it bears repeating: the power to tax is the power to destroy.


Tim Starr - Renaissance Now! - Think Universally, Act Selfishly
starr@genie.slhs.udel.edu

"True greatness consists in the use of a powerful understanding to enlighten
oneself and others." - Voltaire
Xref: sparky sci.crypt:4684 comp.org.eff.talk:6973 alt.privacy:2221 talk.politics.guns:24052
From: unruh@physics.ubc.ca (William Unruh)
Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
Subject: Re: Registering "Assault Keys"
Date: 12 Nov 1992 23:55:42 GMT
Organization: The University of British Columbia
Distribution: world
NNTP-Posting-Host: physics.ubc.ca

williamt@athena.Eng.Sun.COM (Dances with Drums) writes:

>	More to the point -- are citizens free from being beaten at gunpoint
>by officers of the law acting outside the law?  The Rodney King case
>is one example of officers acting outside the law (all white juries
>not withstanding).  Another case was just recently when students at
>UCSC were maced, kicked and beaten while holding a sit-in.  Some of

And you think any of these cases would have been  improved if the people
had guns? King and those students would all be dead.

>	As for registering keys...why do law enforcement officials think
>they have a right to know what I am saying to another person.  It seems
>like this is an infringement on *freedom* of expression -- if my expression
>to another person *must* be subject to monitoring, is it really free?

Certainly when they framed the constution, they did not mean "free
speach" as "You can keep any secret you want to keep". It means that I
can in public say things and not be brought to court for saying them.
From: wcs@anchor.ho.att.com (Bill Stewart +1-908-949-0705)
Subject: Re: Registered Keys - why the need?
Organization: New Jersey Re-Education Facility for the Differently Clued
Date: Fri, 6 Nov 1992 00:04:17 GMT
	<1992Nov3.071335.2838@dartvax.dartmouth.edu>
	<Bx7EtD.21B@mentor.cc.purdue.edu>


One of the major RISKs of requiring key registration is that the
police no longer need probable cause that you've done a REAL crime to
get a warrant for wiretapping - if they suspect you of using unregistered keys, 
based on some probable cause like replying to this news posting :-)
and that's a crime, then they have enough evidence to get a warrant
for wiretapping you and accessing your registered keys -
and if they also read your unencrypted messages, or check out the contents
of your encrypted messages to make sure the keys match, that's gravy for them.
Sure, it wasn't SPECIFICALLY mentioned in the warrant, but it's
covered by the "good faith" exemption to the 4th and 5th Amendments....

Herman Rubin, Joe Francis, and leichter@zodiac.rutgers.edu write about
the similarities between using unregistered keys and keeping two sets
of record books, one for the auditors and one for real.

The difference, except for one-time-pad systems, is that it's possible
to tell whether a given key decrypts the message validly or not -
if the email format identifies the public key, either by inclusion or
by MD-5 checksum, then the Federal Bureau of Intimidation can look
it up in their key registry, and see if either (1) it's not registered, 
or (2) the private key registered for it doesn't decrypt successfully.

With account books, it's tougher to tell if their bogus - sometimes
they just smell bad, but sometimes you need to compare them with lots
of other records before you find the holes.

Unfortunately, it looks like PGP messages do include a Key ID,
which is the lower 64 bits of the key, and is essentially unique.
This means that you can check whether the key is registered by looking it up,
which is quick, instead of decryption, which is slow and hard to automate.
It also means that my plan to register 2**32 keys is less useful,
because they can tell *which* key to decrypt with instead of checking them all.

--
#				Pray for peace;      Bill
#Bill Stewart 908-949-0705 wcs@anchor.ho.att.com AT&T Bell Labs 4M312 Holmdel NJ
# Trickle-Down Economics: Giving money to government bureaucrats 
#	and hoping some will trickle down to the people who need help.
Newsgroups: sci.crypt,alt.privacy,talk.politics.gun