- cypherpunks-legacy@lists.ogf.org

Call for papers
by tribble＠xanadu.com 23 Oct '92

23 Oct '92

Call for Papers "Technological Strategies for Protecting Intellectual Property in the Networked Multimedia Environment" Cambridge, Massachusetts, February 3-5, 1993 sponsored by: Coalition for Networked Information Information Infrastructure Project Science, Technology and Public Policy Program, Harvard University Interactive Multimedia Association Program on Digital Open High Resolution Systems, Massachusetts Institute of Technology This workshop will map the territory between security issues and the need for practical, user-friendly systems for marketing information resources and services. It will survey the technological landscape, evaluate the potential benefits and risks of different mechanisms, define a research agenda, and frame related implementation and policy issues. The workshop will give special attention to how and where within the overall infrastructure different technologies are best implemented. It will present and analyze models for explaining protection systems and strategies. Papers are invited on the foregoing and on the capabilities and relationship of the following technologies and strategies: -- billing servers -- type of service identifiers, header descriptors, and other forms of labeling and tagging -- fingerprinting -- digital signatures -- contracting mechanisms and EDI licensing of intellectual property -- copy protection and serial copy management -- authentication servers and site licensing -- software envelopes -- encryption -- display-only systems -- concurrent use limitations -- structured charging -- technology assessment and risk analysis The workshop will be held at MIT and Harvard on February 3-5, 1993. Participation at the two-day event would be limited to 35- 40 invitees, but the papers will be revised for publication as part of Information Infrastructure Project's publication program. Abstracts of proposed papers should be sent to: Thomas Lee DOHRS/CTPID MIT E40-218 Cambridge, MA 02139 tlee(a)farnsworth.mit.edu 617-253-6828 Fax: 617-253-7326 or 617-253-7140 ________________________________________________________________ The global Internet offers the beginning of a networked, multifunctional, multimedia environment for both resource-sharing and marketing information products and services. Although underlying technologies may change, the applications and practices developed now are shaping the universal broadband infrastructure of the future. However, concern for copyright protection remains a major impediment to private investment in information resources and services. Owners of information resources are fearful of releasing proprietary information to an environment which appears lacking in security and has no accepted means of accounting for use and copying. Complex library systems may be designed and developed around nonproprietary information, but until there are mechanisms to accommodate proprietary information, the utility of the systems will remain limited by the nature of the material made available. Information technology enables the vision of a distributed, interoperating multimedia environment in which information from a universe of different sources can be combined and recombined to meet specific user needs. Ironically, the vision is threatened by the absence of systematic controls. Mindful of this problem, Congress directed that the National Research and Education Network (the follow-on to the federally funded portion of the Internet) -- (1) be developed and deployed with the computer, telecommunications, and information industries.... (5) be designed and operated so as to ensure the continued application of laws that provide network and information resources security measures, including those that protect copyright and other intellectual property rights.... (6) have accounting mechanisms which allow users or groups of users to be charged for their usage of copyrighted materials available over the Network.... [15 USC 5512(c)] The Act also requires the Director of the Office of Science and Technology Policy to report to Congress by the anniversary of the Act (i.e., December 9, 1992) on "how to protect the copyrights of material distributed over the Network...." [15 USC 5512(g)(5)] Despite this statutory language, federal agencies have yet to address these issues. Many believe that the protection of intellectual property on the NREN as on any network is a private sector problem which needs to be addressed at an applications level, not within the design of the network. Indeed, these intellectual property problems are not new; to a large extent, they represent traditional copyright problems which have been exacerbated by electronic technology, digitization of information, personal computers, and less advanced forms of networking. But the prospect of pervasive, high-bandwidth, interconnected wide-area networks presents the problems in the most complete context. There is a tension between the goals of protection, on the one hand, and interoperation and usability, on the other, that has defeated technological solutions in the past. ADAPSO's proposed hardware lock failed to gain industry acceptance, and software copy protection has been abandoned except in certain high-value niche markets. The microcomputer software industry has come to rely on the threat of lawsuits in the vulnerable corporate environment as a means of copyright enforcement. Nonetheless, a hardware-secured environment incorporating serial copy management has been mandated (as an amendment to the Copyright Act) for the next generation of digital audio technology. In the emerging environment, the conventional distinction between products and services breaks down. Products are networked, and network-accessible services are linked to products. Rights must be acquired to cover all forms of delivery, because multiple delivery paths are likely and the dominant technologies and markets cannot be predicted with confidence. On the other hand, the control and security offered by different technologies may also determine the choice of distribution paths. For these reasons, the workshop will look at the networked multimedia environment as a whole, from mass-market products to specialized services.

1 0

re: Keystone
by Tom.Jennings＠f111.n125.z1.FIDONET.ORG 23 Oct '92

23 Oct '92

Hughes: U> But source code is not available. The trouble is that all U> the decent terminal programs for PC's are shareware or U> commercial (or were originally shareware and have become U> commercial). I too would like to know of any U> source-available PC terminal programs, but I suspect there U> are none because of the prevailing shareware culture. U> I'll give you all of my Fido/FidoNet and FidoTerm sources. You can already have ReadMail. U> communications programs use FOSSIL drivers, but many (if U> not most) terminal programs don't support it. Commercial people still sneer at amateur systems like FidoNet. Their loss. FOSSIL is widely supported otherwise. FidoTerm and Fido/FidoNet both support FOSSIL, as do "all" FidoNet programs. U> One incentive would be for the BBS operators to phase in a U> policy that they will accept no e-mail which is _not_ U> encrypted. Comments? SHEESH!@+#)(#$ You oughta see what most sysops think. It's embarrassing. In their defense, NO ONE WILL TELL US what is reasonable. I know, I know how much is presently undefined and without precedent, but the broadest general parameters and guidelines are not that obscure. I'm also part of the BBSLAW mailing list (out of EFF) and it's finally contained some applicable stuff. What you wanna bet the lawscum won't let me repeat in any manner the recent thread on email? (Yes I'm asking.) (Most sysops are terrified that an in-transit, third-party message will contain some illegality and they will all be BUSTED. Hence, it is routine for them to review personally every in-transit message, and kill or bounce them! I am not kidding. (I know this must have been dealt with in the Internet (is kumr/cygnus/etc liable when I tell you that RICHARD NIXONS VISA CARD NUMBER is 4131 34534 456456 456546?) but somehow, no one's ever passed this info on to us.) --- ReadMail * Origin: World Power Systems / FidoNews / San Francisco CA (1:125/111) -- Tom Jennings - via FidoNet node 1:125/555 UUCP: ...!uunet!hoptoad!kumr!fidogate!111!Tom.Jennings INTERNET: Tom.Jennings(a)f111.n125.z1.FIDONET.ORG rom fidogate!f111.n125.z1.FIDONET.ORG!tom.jennings(a)kumr.lns.com Thu Oct 22 11:19:49 1992 Return-Path: <fidogate!f111.n125.z1.FIDONET.ORG!tom.jennings(a)kumr.lns.com> Received: from kumr.lns.com by toad.com id AA22497; Thu, 22 Oct 92 11:19:49 PDT Received: by kumr.lns.com (/\==/\ Smail3.1.25.1 #25.3) id <m0mi78E-0000hbC(a)kumr.lns.com>; Thu, 22 Oct 92 11:19 PDT Received: by fidogate.FIDONET.ORG (mailout1.26); Thu, 22 Oct 92 11:15:22 PDT Date: Thu, 22 Oct 92 11:03:26 PDT Message-Id: <3229.2AE6EFB9(a)fidogate.FIDONET.ORG> From: tom.jennings(a)f111.n125.z1.FIDONET.ORG (tom jennings) Subject: thread (was Re: A To: cypherpunks(a)toad.com X-Mailer: mailout v1.26 released Just a slightly amusing message forwarded from PUBLIC_KEYS... From: Wes Cowley@1:125/180 To: Wes Perkhiser@1:125/111 Subject: Loss of thread (was Re: A ;Status: (read 2 times) ;^AINTL 1:125/111 1:125/180 ;^APID ReadMail ;^AMSGID RM1:125/111=2AE68513 >----------------------- Do not change this line -----------------------------< WP>>"Hi, how are you, and what's your key?" WP>>P.S. Will that be a new pick-up line? It beats "What's your sign?" "Do you want to swap keys, or just come up to my pad, one time?" * OLX 2.1 TD * The computing field is always in need of new cliches. --- DCI/Chauncy 0.7 * Origin: Bird Lake - (813)265-3256 (1:377/14.0) SEEN-BY: 100/520 102/890 105/36 125/111 125 180 185 135/71 340 163/438 170/109 SEEN-BY: 216/21 234/1 253/513 261/1136 285/27 312/2 374/14 26 48 98 377/3 14 15 SEEN-BY: 377/33 37 396/1 2200/101 ;; -- tom jennings - via FidoNet node 1:125/555 UUCP: ...!uunet!hoptoad!kumr!fidogate!111!tom.jennings INTERNET: tom.jennings(a)f111.n125.z1.FIDONET.ORG

4 4

Re: Diffie-Hellman
by wcs＠anchor.ho.att.com 23 Oct '92

23 Oct '92

Unfortunately, Diffie-Hellman *is* patented, and I'm pretty sure Public Key Partners (closely related to RSA) holds the patent, just as they hold RSA's. To quote Steve Bellovin: U.S. Patent Number: 4200770 Title: Cryptographic Apparatus and Method Inventors: Hellman, Diffie, Merkle Assignee: Stanford University Filed: September 6, 1977 Granted: April 29, 1980 [Expires: April 28, 1997] So we're stuck with it being patented until 1997. Too bad - I was starting to think along the same lines about doing a D-H-based mailer. It's non-trivial, if you have to worry about active eavesdroppers swapping mail messages on you, and it's easier to do if there's a trusted Key Distribution Center, and if you think about all the cases carefully you tend to re-create either Needham-Schroeder or the Everhart-Osborn Bell Labs patent (~1980++), but you can certainly do it for the common case that says the Bad Guys are only listening to your mail and not tampering with it. Bill Stewart, wcs(a)anchor.ho.att.com

3 2

Re: BBS E-mail policy
by George A. Gleason 23 Oct '92

23 Oct '92

Eric, count this as another vote for default encryption of all communications links. Omega: the way to tell is to run a frequency count on the text. If it follows the usual distribution for the language it's in, then it's probably plaintext. In which case the BBS rejects it. Voice: yeah, it's a pain in the tail. One thing I thought might be interesting is to use two digitisers: one for the voice input, another for a keystream which is derived from a radio or TV program signal which can be picked up simultaneously by both correspondents. XOR the two streams together and then do whatever you have to do to make the encrypted results transmissable. I actually tried building an analog version of this about ten years ago (might even bring it to one of our meetings, just for fun). Analog voice "encryption" is actually pretty worthless (I didn't know how worthless until I experimented with it) from a security standpoint. Voiceprint modification may have some uses. About five or six years ago I built one of those: based on a pitch shifter with a graphic EQ on the input side and another on the output side. Worked, sort of. Now there is a phone you can buy with something similar built in. -gg

2 1

Removal from distribution list
by Campbell James A 23 Oct '92

23 Oct '92

Please remove my address: ujacampbe(a)memstvx1.memst.edu from your mailing list. Thank you.

1 0

TEMPEST
by jjaloszyns＠bluejay.mich.fred.org 23 Oct '92

23 Oct '92

There has been quite a bit of concern about certain people (agencies) using a TEMPEST machine and invading privacy. Most of the things to defeat this that have been taked about have revolved around shielding. What would be the problem with having another device to emit random signals on the same frequency that your monitor operates on? Has this already been implimented? Legal? jon <jjaloszyns(a)bluejay.mich.fred.org> ------------- 43.31.28N, 84.41.41W Jon Jaloszynski Student 9-12 at Shepherd HS, Shepherd Shepherd, MI

2 1

Re: Keystone
by George A. Gleason 23 Oct '92

23 Oct '92

Re BBSs and encrypted email. Of course it would eliminate liability; well I would expect the Powers That Be to simply outlaw the use of encryption on BBSs or find some legal convolution which has a similar result. The only way we can win on this is to do what we're doing: get this stuff out there far & wide before anyone has a chance to stop it. -gg

1 0

Diffie-Hellman
by Scott Collins 23 Oct '92

23 Oct '92

Subject: Diffie-Hellman >Since there's no perceived value and since all the software would >require license from RSADSI, it won't happen that way. It was not my understanding that RSA held any patents, copyrights or other controls over Diffie-Hellman key exchange. The 'big-number' math required is not difficult and is fully documented in Knuth's "The Art of Computer Programming", vol2: Seminumerical Algorithms; section 4.3: Multiple Precision Arithmetic. Also note that this multiple precision code is available in the PGP source in the file mpilib.c. The exchanged key could easily be a DES (or other fast symmetric cypher) key -- and usually is. Unless you want to perform an authenticated key exchange with Diffie-Hellman as described in "Authentication and Authenticated Key Exchanges" [Diffie, Van Oorschot and Wiener in "Designs, Codes and Cryptography", 2, 107-125 (1992)] using certificates signed with the RSA algorithm, then RSA doesn't have to enter the picture at all. Is my understanding of RSAs controls incorrect?

1 0

Eavesdropping on a printer's signature
by nobody＠soda.berkeley.edu 23 Oct '92

23 Oct '92

While doing a summer (1980?) co-op with Raytheon Submarine Signal division in Newport RI, a milk-truck-sized van pulled up out front and opened a sliding side door. Inside was a line printer that was busy printing out the same text that an internal (in the middle of the building, perhaps 150 feet away) line-printer was printing. There were mistakes, but it was readable. My guess is that with all the electromechanical pulses the printer was emanating this was pretty easy. Probably harder to do with a laser printer...

1 0

temporary request
by DELTORTO＠AppleLink.Apple.COM 22 Oct '92

22 Oct '92

Greetings CypherFolk, I, one of your newest members, am on vacation in Europe (right now I'm in Holland enjoying the "coffee" shops) and am temporarily restricted to using AppleLink as my gateway to Internet. Because it costs $0.50 to $0.80 per piece of email, I asked Eric to _temporarily_ remove me from the general alias until I return to the US in December, saving me major bucks. When I get back, I'll announce that you can send me mail at "ddt(a)well.sf.ca.us". I enjoyed the repartee I sampled and look forward to joining in as I learn more. Offer of the Week: If anyone needs me to physically pick up a PGP key from someone here in Europe, I have a train pass good for another month (maybe longer if I can alter it again) and will consider any request that will take me to interesting locations and connect me with interesting folks. Further Request: If any of you send any interesting stuff to the group alias (e.g. Russ Whitaker's article on "computer cryptography" from the Economist) and think it might be of general interest to someone learning about the whole encryption process (i.e. me), please cc me at "deltorto(a)applelink.apple.com" anytime. This would be appreciated. I also encourage anyone who has helpful learning material to forward it to me so I can get up to speed. I am working on an interesting project I would like to share with the right people, but I am not prepared to discuss it in public. Does anyone have a copy of PGP 2.0 that runs on a Macintosh? If you email it to me, I will cover any costs you incur. Coolness. Until we all meet in person, dave

1 0