cypherpunks coding challenge

A couple of people have complained of the huge efforts put into
breaking keys, and of the small efforts invested in cypherpunks code
writing of late.

Perhaps there is something to this challenge stuff, in terms of
getting contributors, neatly tabulating results, working up
enthusiasm etc.

So... how about a code writing challenge, an award for the best
cypherpunk project every month.  (No monetary prize, just vote on list
to decide most significant project).

Perhaps a list of how many lines of code.  A hall of fame if you like:

% wc -l `find . -name \*.h -print -o -name \*.c -print`

Eric Young		SSL-eay		101,721 lines
PGP Inc			pgp30		    (?) lines
Phil Zimmermann & co	pgp263		 34,891 lines
Peter Gutmann		cryptlib200	 34,845 lines
Tatu Ylonen		ssh-1.2.20	 33,650 lines
Wei Dai			crypto++ 2.1	 32,831 lines
Ian Goldberg		Lucre 0.9.0	 20,283 lines
Colin Plumb		bnlib		 20,148 lines
Matt Blaze & co		cryptolib-1.1	 19,908 lines
Pr0duct Cipher		PGPTools	 13,062 lines
Pr0duct Cipher		Magic Money	 15,026 lines
Ben Laurie		Apache-SSL patch    957 lines
etc.

Adam
-- 
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

At 2:38 AM -0700 6/22/97, Adam Back wrote:
>A couple of people have complained of the huge efforts put into
>breaking keys, and of the small efforts invested in cypherpunks code
>writing of late.
>
>Perhaps there is something to this challenge stuff, in terms of
>getting contributors, neatly tabulating results, working up
>enthusiasm etc.
>
>So... how about a code writing challenge, an award for the best
>cypherpunk project every month.  (No monetary prize, just vote on list
>to decide most significant project).
>
>Perhaps a list of how many lines of code.  A hall of fame if you like:
>
>% wc -l `find . -name \*.h -print -o -name \*.c -print`
>
>Eric Young		SSL-eay		101,721 lines
>PGP Inc			pgp30		    (?) lines
>Phil Zimmermann & co	pgp263		 34,891 lines
....

Not to be tedious about this, but why would "lines of code" be an
interesting metric?

I'm reminded of a cartoon showing a Russian factory winning the "greatest
tonnage of screws produced," with a crane lifting a massive, 100 meter long
screw above the factory. The dangers of the wrong metric.

I think we need a few major innovations more than some number of lines of code.

--Tim May

(No, I'm not a programmer. But I've done a few "hacks" which were
interesting and useful, I think. Taking readily available stuff, "BlackNet"
made the concrete point that data havens and anonymous markets already are
possible. Number of lines of code written: zero. The task is to combine
some of the existing tools into new things. Raw lines of code is not
necessarily useful.)

There's something wrong when I'm a felon under an increasing number of laws.
Only one response to the key grabbers is warranted: "Death to Tyrants!"
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1398269     | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

Tim May <tcmay@got.net> writes:
> At 2:38 AM -0700 6/22/97, Adam Back wrote:
> >So... how about a code writing challenge, an award for the best
> >cypherpunk project every month.  (No monetary prize, just vote on list
> >to decide most significant project).
> >
> >Perhaps a list of how many lines of code.  A hall of fame if you like:
> >
> >% wc -l `find . -name \*.h -print -o -name \*.c -print`
> >
> >Eric Young		SSL-eay		101,721 lines
> >PGP Inc			pgp30		    (?) lines
> >Phil Zimmermann & co	pgp263		 34,891 lines
> ....
> 
> Not to be tedious about this, but why would "lines of code" be an
> interesting metric?
>
> I'm reminded of a cartoon showing a Russian factory winning the "greatest
> tonnage of screws produced," with a crane lifting a massive, 100 meter long
> screw above the factory. The dangers of the wrong metric.
> 
> I think we need a few major innovations more than some number of
> lines of code.

Well, personally I'm not that bothered about line counts (good code
tends to be smaller than sprawling badly written redundant stuff,
anyhow).  But what I am bothered about is that not that much in the
way of cypherpunks apps are getting written, and that PGP Inc, aren't
going to write them for us, because they won't sell to fortune 100
mega-corps.

> (No, I'm not a programmer. But I've done a few "hacks" which were
> interesting and useful, I think. Taking readily available stuff, "BlackNet"
> made the concrete point that data havens and anonymous markets already are
> possible. Number of lines of code written: zero. The task is to combine
> some of the existing tools into new things. Raw lines of code is not
> necessarily useful.)

Indeed.  I was going to include a line count of your cyphernomicon,
but I appear to have mislaid my gzipped copy.

The part about a cypherpunks award for most significant project of the
month was the meat of the post.  I speculate that a web page with
tabulated wish lists (from list discussion), where these are ticked
off as done, etc might be some encouragement.

Adam
-- 
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

-----BEGIN PGP SIGNED MESSAGE-----

In <199706220938.KAA06436@server.test.net>, on 06/22/97 
   at 10:38 AM, Adam Back <aba@dcs.ex.ac.uk> said:

>A couple of people have complained of the huge efforts put into breaking
>keys, and of the small efforts invested in cypherpunks code writing of
>late.

>Perhaps there is something to this challenge stuff, in terms of getting
>contributors, neatly tabulating results, working up enthusiasm etc.

>So... how about a code writing challenge, an award for the best
>cypherpunk project every month.  (No monetary prize, just vote on list to
>decide most significant project).

Well I haven't done alot in the area of writting crypto algoritims I have
done quite a bit of work in the area of crypto implementations (mostly in
the PGP - E-Mail Integration).

I have also been working on improving performance of PGP when working with
large keyrings (primary & secondary indexing, multiple keyring lookups,
public key caching, real time key retreival from BAL servers).

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBM61b+o9Co1n+aLhhAQEaswP/VqevtYSH4/dnNtKwP5KGABp+6MgwUZTF
grnEgYUM8j1QGWCjEUX8FqzoJGD6PCFgFQ36uwzE3K/+/sCHbIY9wYeha47bjDok
DSCTWxdztbclBLldQRzIXpbx4varCZ5xTm5inzrNVAypDdrCWIPNvtlgflq+6+aI
UCxr1QB5cJo=
=duot
-----END PGP SIGNATURE-----

>>Perhaps a list of how many lines of code.  A hall of fame if you like:
>>% wc -l `find . -name \*.h -print -o -name \*.c -print`
>>Eric Young		SSL-eay		101,721 lines
>>PGP Inc			pgp30		    (?) lines
>>Phil Zimmermann & co	pgp263		 34,891 lines

>Not to be tedious about this, but why would "lines of code" be an
>interesting metric?

Yeah - I was thinking of the following entries:
  Adam Back             RSAperl		4 lines
  Adam Back et al.	RSAperl		2 lines

I don't think anybody's made a T-Shirt with SSLeay on it yet :-)

(Though actually SSLeay has been very useful to a lot of the
world's free cryptography, and has prompted the US spooks 
to pressure the Australian spooks into restricting crypto exports,
just as they've pressured the NZs into restricting them for
Peter Gutman, and have been trying to work on the Irish...)


#			Thanks;  Bill
# Bill Stewart, +1-415-442-2215 stewarts@ix.netcom.com
# You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp
#   (If this is a mailing list or news, please Cc: me on replies.  Thanks.)

(cc'd to a couple of people who's name is mentioned in second half)

Bill Stewart <stewarts@ix.netcom.com> writes:
> Tim May <tcmay@got.net> writes:
> >Not to be tedious about this, but why would "lines of code" be an
> >interesting metric?
> 
> Yeah - I was thinking of the following entries:
>   Adam Back           RSAperl		4 lines
>   Adam Back et al.	RSAperl		2 lines
> 
> I don't think anybody's made a T-Shirt with SSLeay on it yet :-)

:-)

> (Though actually SSLeay has been very useful to a lot of the
> world's free cryptography, and has prompted the US spooks 
> to pressure the Australian spooks into restricting crypto exports,
> just as they've pressured the NZs into restricting them for
> Peter Gutman, and have been trying to work on the Irish...)

Could you elaborate on these.  I caught Peter Gutmann's comments on
the hassles a company he did some work for were having with the NZ
spooks.  (The spooks intercepted their mailed disk, plus some other
cloak and dagger spookish stuff).  Is this still going on, was it ever
resolved?  Can the next version of cryptlib be exported legally?  Or
are we relying on Peters bravery?

I remember vaguely some announcments about Australia.  Has Eric said
anything on this, has anything been enforced, is it legal to export
SSLeay from down under?

Ireland is new to me.  What's their problem?  Who's exporting things
to attract spook export attention over there?  (There are quite a lot
of high tech companies over there, it's a sort of Euro silicon valley,
mostly due to tax breaks, 10% corporation tax, etc).

Btw, the UK has it's own problems also.  You can export whatever you
want in `intangible form', but to post something in a tangible form,
such as perhaps a CD (or a perl-rsa T-shirt?) you need permission from
DTI in consultation with GCHQ.  There are several forms of license you
can get depending on what GCHQ think of your product and of you
politically.  These vary between getting a license to export pretty
much anywhere except embargoed countries (Iraq, China, etc) without
further hassle, to having to ask for export permission on a case by
case basis, going down to permission for repeat exports to the same
customer.  The heuristic by which permission is handed out is nearly
impossible to extract from the beaurocrats/spooks.  (Give us
protocols, and a customer, and we'll tell you.)

I have it unofficially from the hosses mouth that if you make use of
the intangible export loophole, that it might "reduce" your chances of
getting permission to export tangibly.

I thought Ireland was similar, being based on European legislation,
though perhaps with less of an axe to grind than GCHQ, being as GCHQ
(CESG) are the authors of the euro GAK, (CASM/Cloud Cover/Royal
Holloway TTP scheme) and the TTP paper which caused a fuss last month.

Adam
-- 
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

There is a tendency I think to be drawn into spooks, civil servants,
and polticians requests for off the record comments on how politics
really works.  (The politics of favours, the politics of spooks
wishing to intimidate people into censoring themselves to operating
according to unwritten laws (laws which don't exist, but which the
spooks wish did, and so pretend do exist)).

I think: if they said it, hold them to it.  Ignore off the cuff
requests, if they have the force of law behind them (it boils down to
a threat to kill you, or imprison you if you disagree), that they
should also get you to behave nicely and keep quiet your experience of
the way they work in practice sucks, there's too much of it in
politics in general, it belongs on a bill-board not in quiet off the
record moments after crypto-conferences.

Of course this might have the effect that spooks don't want to talk to
you, or are more careful what they say, but who cares.

Also... some clarification on the UK export situation, which I talked
about in my last post in this thread:

One concern about some of this stuff, is that often people are
representing some company when interacting with spooks, where they 
would be covered by an NDA with the company.  Well OK.  There are 
still remailers to explain the situation without giving enough detail
to identify yourself.  Sometimes there are no NDAs.

The export situation has slightly conflicting parties, the DTI (civil
servants, Dept. of Trade & Industry) and GCHQ.  DTI say you can export
intangibly, but gave a whole list of reasons why a "responsible" company
surely would not want to do anything disreputable, like have different views
of export controls from the government, here from:

	http://www.dcs.ex.ac.uk/~aba/ukexport/dti-let.txt

: 9.  Hard to see what practical advantage there is to exporters in
: exporting technology by intangible means because they could get
: licences anyway if no concerns about the export itself.
: 
: 10.  And if concerns are sufficient for a licence to be refused, what
: reputable exporter would wish to export it by any means?

CESG/GCHQ seem less keen to admit the intangible export loop hole
exists, preferring to pretend it doesn't exist until pressed.

The DTI at least has contingency plans for this (from same letter):

: 4.  Government is aware of the potential for abuse of the spirit of
: export controls. If it appears HMG's export control policies are being
: undermined, then further action may have to be considered.

As I said in the previous post: the GCHQ off-the-record low down on this is
that if you export stuff intangibly (which the DTI at least will admit
reluctantly that you can do), then they will deny your tangible export
requests.  If you are a business, this might cause you to think carefully
about using the intangible export loop-hole.  Or perhaps about discussing
too much the way this works with journalists or otherwise embarrassing them. 
Which is of course what they want: an unwritten law which they have power to
decide as they wish.

Wouldn't it be fun if people in government/spookdom actually participated in
open discussions such as this?  (People like say Nigel Hickson, who got
roasted at the LSE crypto conference recently on the DTI/GCHQ/government
infamous TTP paper, his boss David Hendon slunk off early to avoid facing
the music during open question time). (David Hendon not to be confused with
David Henson, the ex-spook now in some governmental Euro gakkers group)

But they aren't going to participate because they operate best in
half-light, they hate harsh bright lights of open discourse.

Adam
-- 
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`