8 ms·

Bernstein v. the U.S. Department of State (2014)

121 points by vector_spaces 4y ago

slim 4y ago
since then Daniel Bernstein lives in Germany hi own archive on the case : https://cr.yp.to/export.html https://cr.yp.to/export.html
- Datagenerator 4y ago
  Thank you for keeping records, has this been archived to the Internet Archive as well?
  - pabs3 4y ago
    https://archive.ph/20211125232529/https://cr.yp.to/export.html https://archive.ph/20211125232529/https://cr.yp.to/export.ht... https://web.archive.org/web/20220427223318/https://cr.yp.to/export.html https://web.archive.org/web/20220427223318/https://cr.yp.to/...
    - hericium 4y ago
      web.archive.org is fine. That .ph link is a tracking infected garbage, requiring JS.
      - pabs3 4y ago
        The .ph link doesn't require JS here. The entire purpose of archive.is/.ph etc is to archive the DOM, so you don't require to view even pages that originally required JS.
        hericium 4y ago
        Seeing any content from the original site requires JS to click on a page made to look like Cloudflare's with Google's recaptcha. Later there's mail.ru tracking among others. curl this link and tell me that you see any text from the original website.
        jwilk 4y ago
        With the default curl settings, I get captcha indeed; but when I fake the User-Agent header ("Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0"), it works for me.
        hericium 4y ago
        Shame that Firefox on Linux is treated this way then. And there's still the matter of tracking scripts which aren't present with the original content.
        deleted 4y ago
        [deleted]
        pabs3 4y ago
        I was viewing the archive in Firefox with JS off and saw the text just fine. With curl I get the text of the original website (no CAPTCHA), with the archive.is wrapper layout wrapper stuff, but that is only because I had "-" as the user-agent, with my normal config of not sending the user-agent header, I get a CAPTCHA. Sounds like other user-agents work too.
- krylon 4y ago
  I thought he lived in the Netherlands. Doesn't he work at a Dutch university now?
  - Zamicol 4y ago
    I think you're thinking of Zimmermann: https://philzimmermann.com/EN/contact/index.html https://philzimmermann.com/EN/contact/index.html
    - krylon 4y ago
      No, I was just behind the times. Bernstein used to work at the university of Eindhoven, now he's at the university of Bochum, which is indeed a German city.
josh2600 4y ago
We all owe djb a great deal of gratitude for this hard-won freedom. This is one of the greatest victories in hacker history. I hope to never see this stricken from the law of the land. Code is speech.
- Lukineus 4y ago
  > Code is speech. Not all code. From the linked article: > However, the court cautioned that not all software could be considered expressive, and thus not all source code would necessarily be protected.
- formerkrogemp 4y ago
  No, code will be deemed whatever fits the idealogy of the judiciary. Legal reasoning is secondary except for show nowadays given the partisan majority of the supreme court. Specious and convenient reasoning abound.
  - CameronNemo 4y ago
    The Myth of the Rule of Law - John Hasnas
    - formerkrogemp 4y ago
      Thank for the interesting book suggestion. You made my day.
- JasonFruit 4y ago
  Unfortunately, it's not the law of the land --- it's a judicial opinion, written in water and subject to change without notice. (Which is how judicial opinion should be; this is just a good opinion that ought to be codified by the legislature.)
  - bombcar 4y ago
    Too much of US law is actually judicial opinion - there should be some requirement that if a law is overturned/interpreted, that the legislature has to fix the original law (example: the Affordable Care act still insists it's not a tax even though it was ruled a tax).
john567 4y ago
We should all learn from this and understand that if we don't fight for and uphold our liberties they will be taken away from us. Every fight matters and if it wasn't for the US constitution this might have gone down very differently.
deleted 4y ago
[deleted]
shmde 4y ago
The article feels too technical for a non-technical person. Can anyone please give a brief "Explain me like I am 5". Thanks.
- AceJohnny2 4y ago
  US prevented publication online of encryption code on grounds of "encryption is munitions according to International Arms Treaty (enforced by US gov, natch)". Dan J Bernstein ("djb", a famous figure in encryption circles, later creating (?) Elliptic Curve Cryptography) with help from the EFF sued. In 1999, Judge voted that, no, encryption code was "scientific expression" and thus protected by the freedoms granted by First Amendment. There was a fair bit more back-and-forth including shifting positions by the government under various administrations, but in effect this is the case that opened the gates to better public encryption.
  - gonzo 4y ago
    djb didn’t invent elliptic curve cryptography. Elliptic curve cryptography was introduced in 1985 by Victor Miller and Neal Koblitz who both independently developed the idea of using elliptic curves as the basis of a group for the discrete logarithm problem.
    - dsr_ 4y ago
      https://en.wikipedia.org/wiki/NaCl_%28software%29 https://en.wikipedia.org/wiki/NaCl_%28software%29 An awful lot of things are built on NaCl, which is probably what djb is most famous for.
    - px43 4y ago
      He did basically run the Manhattan Project for searching for ideal curves, brute forcing millions of them and testing their properties, out of which came Curve25519, which is pretty much the curve used by anyone who knows what they're doing. https://en.wikipedia.org/wiki/Curve25519 https://en.wikipedia.org/wiki/Curve25519 I saw him give a really awesome talk about the process of finding Curve25519 around the time he published it, and I think the story is a lot more interesting than people realize.
roastedpeacock 4y ago
This wonders the question, what restrictions on including cryptography in either open-source or commercial products exist in the U.S today? Bit of a different topic but I hope a landmark case tears down the DMCA nonsense in the U.S and other countries at some point.
1970-01-01 4y ago
See https://cryptome.org/bxa-bernstein.htm https://cryptome.org/bxa-bernstein.htm for more pushing and shoving history between the US and Bernstein.
rasengan 4y ago
djb gave us the best encryption cyphers, the most secure email, the best DNS and, as the article notes, free speech. He deserves to be recognized as a gift, a wonder, to the world.
- kzrdude 4y ago
  Yes, he deserves engineering prizes. In one of his talks he shows the OpenSSH 6.5 changelog - a release in which they adopt both "his" 25519 curve and chacha20-poly1305 as new features.
twright 4y ago
The full opinion[1] is a good read to see the full reasoning how source code is free speech. The key conclusion: > Thus, cryptographers use source code to express their scientific ideas in much the same way that mathematicians use equations or economists use graphs. [...] In light of these considerations, we conclude that encryption software, in its source code form and as employed by those in the field of cryptography, must be viewed as expressive for First Amendment purposes, and thus is entitled to the protections of the prior restraint doctrine. [4233-4234] and then they proceed to dismantle the US's understanding on source code. Lot's of material I would never normally think about. [1]: https://archive.epic.org/crypto/export_controls/bernstein_decision_9_cir.html https://archive.epic.org/crypto/export_controls/bernstein_de...
lurquer 4y ago
I could have sworn it was Berenstain v. US… Weird.

121 points by vector_spaces 4y ago

slim 4y ago

since then Daniel Bernstein lives in Germany hi own archive on the case : https://cr.yp.to/export.html https://cr.yp.to/export.html

Datagenerator 4y ago
Thank you for keeping records, has this been archived to the Internet Archive as well?
- pabs3 4y ago
  https://archive.ph/20211125232529/https://cr.yp.to/export.html https://archive.ph/20211125232529/https://cr.yp.to/export.ht... https://web.archive.org/web/20220427223318/https://cr.yp.to/export.html https://web.archive.org/web/20220427223318/https://cr.yp.to/...
  - hericium 4y ago
    web.archive.org is fine. That .ph link is a tracking infected garbage, requiring JS.
    - pabs3 4y ago
      The .ph link doesn't require JS here. The entire purpose of archive.is/.ph etc is to archive the DOM, so you don't require to view even pages that originally required JS.
      - hericium 4y ago
        Seeing any content from the original site requires JS to click on a page made to look like Cloudflare's with Google's recaptcha. Later there's mail.ru tracking among others. curl this link and tell me that you see any text from the original website.
        jwilk 4y ago
        With the default curl settings, I get captcha indeed; but when I fake the User-Agent header ("Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0"), it works for me.
        hericium 4y ago
        Shame that Firefox on Linux is treated this way then. And there's still the matter of tracking scripts which aren't present with the original content.
        deleted 4y ago
        [deleted]
        pabs3 4y ago
        I was viewing the archive in Firefox with JS off and saw the text just fine. With curl I get the text of the original website (no CAPTCHA), with the archive.is wrapper layout wrapper stuff, but that is only because I had "-" as the user-agent, with my normal config of not sending the user-agent header, I get a CAPTCHA. Sounds like other user-agents work too.
krylon 4y ago
I thought he lived in the Netherlands. Doesn't he work at a Dutch university now?
- Zamicol 4y ago
  I think you're thinking of Zimmermann: https://philzimmermann.com/EN/contact/index.html https://philzimmermann.com/EN/contact/index.html
  - krylon 4y ago
    No, I was just behind the times. Bernstein used to work at the university of Eindhoven, now he's at the university of Bochum, which is indeed a German city.

josh2600 4y ago

We all owe djb a great deal of gratitude for this hard-won freedom. This is one of the greatest victories in hacker history. I hope to never see this stricken from the law of the land. Code is speech.

Lukineus 4y ago
> Code is speech. Not all code. From the linked article: > However, the court cautioned that not all software could be considered expressive, and thus not all source code would necessarily be protected.
formerkrogemp 4y ago
No, code will be deemed whatever fits the idealogy of the judiciary. Legal reasoning is secondary except for show nowadays given the partisan majority of the supreme court. Specious and convenient reasoning abound.
- CameronNemo 4y ago
  The Myth of the Rule of Law - John Hasnas
  - formerkrogemp 4y ago
    Thank for the interesting book suggestion. You made my day.
JasonFruit 4y ago
Unfortunately, it's not the law of the land --- it's a judicial opinion, written in water and subject to change without notice. (Which is how judicial opinion should be; this is just a good opinion that ought to be codified by the legislature.)
- bombcar 4y ago
  Too much of US law is actually judicial opinion - there should be some requirement that if a law is overturned/interpreted, that the legislature has to fix the original law (example: the Affordable Care act still insists it's not a tax even though it was ruled a tax).

john567 4y ago

We should all learn from this and understand that if we don't fight for and uphold our liberties they will be taken away from us. Every fight matters and if it wasn't for the US constitution this might have gone down very differently.

deleted 4y ago

[deleted]

shmde 4y ago

The article feels too technical for a non-technical person. Can anyone please give a brief "Explain me like I am 5". Thanks.

AceJohnny2 4y ago
US prevented publication online of encryption code on grounds of "encryption is munitions according to International Arms Treaty (enforced by US gov, natch)". Dan J Bernstein ("djb", a famous figure in encryption circles, later creating (?) Elliptic Curve Cryptography) with help from the EFF sued. In 1999, Judge voted that, no, encryption code was "scientific expression" and thus protected by the freedoms granted by First Amendment. There was a fair bit more back-and-forth including shifting positions by the government under various administrations, but in effect this is the case that opened the gates to better public encryption.
- gonzo 4y ago
  djb didn’t invent elliptic curve cryptography. Elliptic curve cryptography was introduced in 1985 by Victor Miller and Neal Koblitz who both independently developed the idea of using elliptic curves as the basis of a group for the discrete logarithm problem.
  - dsr_ 4y ago
    https://en.wikipedia.org/wiki/NaCl_%28software%29 https://en.wikipedia.org/wiki/NaCl_%28software%29 An awful lot of things are built on NaCl, which is probably what djb is most famous for.
  - px43 4y ago
    He did basically run the Manhattan Project for searching for ideal curves, brute forcing millions of them and testing their properties, out of which came Curve25519, which is pretty much the curve used by anyone who knows what they're doing. https://en.wikipedia.org/wiki/Curve25519 https://en.wikipedia.org/wiki/Curve25519 I saw him give a really awesome talk about the process of finding Curve25519 around the time he published it, and I think the story is a lot more interesting than people realize.

roastedpeacock 4y ago

This wonders the question, what restrictions on including cryptography in either open-source or commercial products exist in the U.S today? Bit of a different topic but I hope a landmark case tears down the DMCA nonsense in the U.S and other countries at some point.

1970-01-01 4y ago

See https://cryptome.org/bxa-bernstein.htm https://cryptome.org/bxa-bernstein.htm for more pushing and shoving history between the US and Bernstein.

rasengan 4y ago

djb gave us the best encryption cyphers, the most secure email, the best DNS and, as the article notes, free speech. He deserves to be recognized as a gift, a wonder, to the world.

kzrdude 4y ago
Yes, he deserves engineering prizes. In one of his talks he shows the OpenSSH 6.5 changelog - a release in which they adopt both "his" 25519 curve and chacha20-poly1305 as new features.

twright 4y ago

The full opinion[1] is a good read to see the full reasoning how source code is free speech. The key conclusion: > Thus, cryptographers use source code to express their scientific ideas in much the same way that mathematicians use equations or economists use graphs. [...] In light of these considerations, we conclude that encryption software, in its source code form and as employed by those in the field of cryptography, must be viewed as expressive for First Amendment purposes, and thus is entitled to the protections of the prior restraint doctrine. [4233-4234] and then they proceed to dismantle the US's understanding on source code. Lot's of material I would never normally think about. [1]: https://archive.epic.org/crypto/export_controls/bernstein_decision_9_cir.html https://archive.epic.org/crypto/export_controls/bernstein_de...

lurquer 4y ago

I could have sworn it was Berenstain v. US… Weird.