December 1992 - cypherpunks-legacy

1st dc-net works!
by yanek＠novavax.nova.edu 17 Dec '92

17 Dec '92

Finally, I got a dc-net working. It is now quite primitive, and useful only as a proof of concept. It does not yet do any key management, I just copied the binaries of several unix utilities to be used as one time pads. The reservation system does not work yet. If there is a message to be sent, it is sent immediately. That means only one of the participants can send a message in one round. The messages are not forwarded anywhere, they are just dropped to "outgoing" directory. It runs on one machine, under three accounts I created just for that purpose. The mail keeps going back and forth constantly between the three accounts, with null files being deposited to the outgoing directories. Temporary files are being created and deleted. As soon as I put a file in one of the incoming directories, within one round it appears in each of the outgoing directories. So the main function works. It is written in perl, because of the ease I can manipulate binary data of any size. As soon as I add the minimal necessary features (PGP based key exchange, and reservation blocks) I will be looking for some people to participate in an experimental dc-net. People who want to participate in this, should have fast, reliable, e-mail connections (preferably round-trip time to any other participant should be less than 10 minutes). If even one participant has a slow link, it will hold everyone up. You also need the ability to pipe incoming mail with a certain subject header through an arbitrary program. You can use any of the various 'slocal' programs, or you could use elm's filter program, or any other means. You also need to have perl working on your system. You need PGP. As someone suggested, an arbitrary group of people might not have much to talk about amongst themselves, so the next feature will be forwarding to a mailing address (or list), a newsgroup, or another dc-net. It is very simple to do the forwarding, it is a little more complicated, and interesting, to decide who will do the forwarding. I would not want to rely on any single site serving as a gateway, since that would introduce a single point of compromise. I would rather have some dynamic system, similar to the reservation blocks, that would let the net randomly decide who will forward a particular message. As soon as this first test network has run for a couple of days, and all the bugs are fixed, I will release the code, so that anybody can work on it. I expect that some people will work on various projects I mentioned in the "FUTURE ENCHANCEMENTS" section of my initial posting on this topic. I hope that people who add features to the system send the mods back to me, so I can incorporate them in a new version. When there is a number of networks running, it will be interesting to experiment with hierarchical nets, or linked networks of networks. -- Yanek Martinson mthvax.cs.miami.edu!safe0!yanek uunet!medexam!yanek this address preferred -->> yanek(a)novavax.nova.edu <<-- this address preferred Phone (305) 765-6300 daytime FAX: (305) 765-6708 1321 N 65 Way/Hollywood (305) 963-1931 evenings (305) 981-9812 Florida, 33024-5819

1 0

TEMPEST not restricted
by norm＠xanadu.com 17 Dec '92

17 Dec '92

While taxpayers paid for TEMPEST and NACSIM 5100A and it would undoubtedly be useful to taxpayers were it declassified, it is not true that compliance with NACSIM 5100A is necessary and sufficient to be secure from eavesdropping. Some of RSA's charm is that it was not promulgated by NSA!

1 0

No Subject
by dclunie＠pax.tpa.com.AU 17 Dec '92

17 Dec '92

> Here is parts of the article I posted regarding the legality of the use > of emf shielding. Read it carefully, and I suggest you also read the > posted document in full as well. This poses many problems to the public > in general, and the private sector in specific. > PERRY, I suggest you read this. > > NACSIM 5100A is classified, as are all details of TEMPEST. The information may be classified, as perhaps it should be. If I were an organization of any kind trying to protect my data I wouldn't run around publicizing the details of the technology required to protect it either. This does not mean though, that it is illegal to reinvent the wheel and apply it yourself. Besides, who is to say what is an "acceptable" level of EM radiation - the government has clearly chosen what it considers acceptable levels to facilitate equipment supply by contractors. If you want more or less protection then you and any other member of the public are free to define, manufacture or purchase whatever you want. And if you can't get it from a local source I am sure there are plenty of governments and manufacturers elsewhere in the world you can deal with, though of course exporting the technology may be another matter, but there is nothing new about that. There are plenty of other government conspiracies to focus on ! This one seems a bit lame. david

2 2

No Subject
by pmetzger＠shearson.com 17 Dec '92

17 Dec '92

Close, but no cigar, Mr. "Treason". Anyone reading your "proof" can see for themselves that there is no law making it illegal to shield your computers, only some regulations on people that sell equipment to the government can't tell other people what their specifications are. Big deal. The line in the article saying Without the right to possess TEMPEST ELINT equipment manufacturers who wish to sell to the public sector cannot determine what a safe level of emanations is. is mostly bull, in the sense that people can probably judge what is safe without knowing the government standards. In any case, you have demonstrated nothing making it illegal to shield your computers, and we've already seen a post containing a dozen purveyors of shielding equipment. Repeating, you don't know what you are talking about. Now go away. Perry Original message included for reference: > From cypherpunks-request(a)toad.com Thu Dec 17 14:13:11 1992 > Date: Thu, 17 Dec 92 12:38:34 -0500 > From: treason(a)gnu.ai.mit.edu > Content-Length: 3194 > > Here is parts of the article I posted regarding the legality of the use > of emf shielding. Read it carefully, and I suggest you also read the > posted document in full as well. This poses many problems to the public > in general, and the private sector in specific. > PERRY, I suggest you read this. > > NACSIM 5100A is classified, as are all details of TEMPEST. > To obtain access to it, contractor must prove that there is > demand within the government for the specific type of equipment > that intend to certify. Since the standard is classified, the > contractors can not sell the equipment to non-secure governmental > agencies or the public. This prevents reverse engineering of the > standard for its physical embodiment, the Certified equipment. > By preventing the private sector from owning this anti- > eavesdropping equipment, the NSA has effectively prevented the > them from protecting the information in their computers. > A number of companies produce devices to measure the > emanations from electrical equipment. Some of these devices > are specifically designed for bench marking TEMPEST > Certified equipment. This does not solve the problem. The > question arises: how much radiation at a particular > frequency is compromising? The current answer is to refer > to NACSIM 5100A. This document specifies the emanations > levels suitable for Certification. The document is only > available to United States contractors having sufficient > security clearance and an ongoing contract to produce > TEMPEST Certified computers for the government. Further, > the correct levels are specified by the NSA and there is no > assurance that, while these levels are sufficient to prevent > eavesdropping by unfriendly operatives, equipment certified > under NACSIM 5100A will have levels low enough to prevent > eavesdropping by the NSA itself. > The accessibility of supposedly correct emanations > levels does not solve the problem of preventing TEMPEST > eavesdropping. Access to NACSIM 5100A limits the > manufacturer to selling the equipment only to United States > governmental agencies with the need to process secret > information.[33] Without the right to possess TEMPEST ELINT > equipment manufacturers who wish to sell to the public > sector cannot determine what a safe level of emanations is. > Further those manufacturers with access to NACSIM 5100A > should want to verify that the levels set out in the > document are, in fact, low enough to prevent interception. > Without an actual eavesdropping device with which to test, > no manufacturer will be able to produce genuinely > uncompromising equipment. > > PERRY, now I put up, now YOU SHUT UP! > > sheesh. > > treason@gnu. >

1 0

SS&S response to TEMPEST inf0 request
by wendtj＠jplpost.Jpl.Nasa.Gov 17 Dec '92

17 Dec '92

About 30 minutes after I got off the phone requesting product information and related materials, I recieved a voice mail message from Ray Helsop of SS&S. When I returned his call, he informed me that the address that I gave looked like a residential address (Hmmm), and that they usually don't send information to private homes, apts, bird-baths, e.t.c. He then informed me that he had called my employer (the Junior Proletarian Laboratory), and varified my name in the directory, and the department that I worked in; and that since I work for a Federal Research Facility (DoD sinkhole) everything was `ok'. He then proceded to tell me about foreigners calling the company requesting TEMPEST information, and other "spooky" callers, and that it was now allright to send the product information to my home. After I told him my interests in the hardware, he ran down a list of avilable equipment, and asked about numbers, requirements, and said he'd send it right out to me. I hate to be presumptuous... but I think an "I'm trying to protect my personal computer from prying eyes" would fall on very deaf ears at SS&S, and I'll leave it at that. ;-) JPW

1 0

Re: New number for Secure Systems & Services
by Richard Childers 17 Dec '92

17 Dec '92

> and they give free samples ;-)) "Great. Now does anyone know of where to get equipment to test how effective it is? " I'd guess that virtually any hardware lab that has to test its equipment to make sure it meets FCC criteria for minimal emissions, would have a test lab onsite. Such a test lab normally consists of the following : - a very wide frequency range analyzer ( HP makes these ) - a set of antennas by which to sample the EMF field(s) - a platform adjacent to the antenna mount, upon which such equipment as is being tested, is rotated, to allow the antenna to sample the entire 360- -degree field at incremented altitudes and var- -iable angles in incidence. Those test labs I've been acquainted with are usually found at a distance from production facilities, usually small outbuildings in fields out back, insulated by distance from the EMF of the surrounding buildings. I can see how this paper might make it possible to move the lab back indoors ... To answer your question specifically, I'd check a HP electronic test products catalog, with an emphasis on signal/frequency/harmonic analyzers. -- richard ===== -- richard childers rchilder(a)us.oracle.com 1 415 506 2411 oracle data center -- unix systems & network administration "If Life is a drama, then, surely, the hardest parts go to the most skillful."

1 0

New number for Secure Systems & Services
by wendtj＠jplpost.Jpl.Nasa.Gov 17 Dec '92

17 Dec '92

The new number for SS&S is (214) 907-9288 Also, Lindgren RF Enclosures informed me that they now have exclusive license to market International Paper Company's SAF'N SHIELDED; and they give free samples ;-)) JPW

2 1

No Subject
by treason＠gnu.ai.mit.edu 17 Dec '92

17 Dec '92

Here is parts of the article I posted regarding the legality of the use of emf shielding. Read it carefully, and I suggest you also read the posted document in full as well. This poses many problems to the public in general, and the private sector in specific. PERRY, I suggest you read this. NACSIM 5100A is classified, as are all details of TEMPEST. To obtain access to it, contractor must prove that there is demand within the government for the specific type of equipment that intend to certify. Since the standard is classified, the contractors can not sell the equipment to non-secure governmental agencies or the public. This prevents reverse engineering of the standard for its physical embodiment, the Certified equipment. By preventing the private sector from owning this anti- eavesdropping equipment, the NSA has effectively prevented the them from protecting the information in their computers. A number of companies produce devices to measure the emanations from electrical equipment. Some of these devices are specifically designed for bench marking TEMPEST Certified equipment. This does not solve the problem. The question arises: how much radiation at a particular frequency is compromising? The current answer is to refer to NACSIM 5100A. This document specifies the emanations levels suitable for Certification. The document is only available to United States contractors having sufficient security clearance and an ongoing contract to produce TEMPEST Certified computers for the government. Further, the correct levels are specified by the NSA and there is no assurance that, while these levels are sufficient to prevent eavesdropping by unfriendly operatives, equipment certified under NACSIM 5100A will have levels low enough to prevent eavesdropping by the NSA itself. The accessibility of supposedly correct emanations levels does not solve the problem of preventing TEMPEST eavesdropping. Access to NACSIM 5100A limits the manufacturer to selling the equipment only to United States governmental agencies with the need to process secret information.[33] Without the right to possess TEMPEST ELINT equipment manufacturers who wish to sell to the public sector cannot determine what a safe level of emanations is. Further those manufacturers with access to NACSIM 5100A should want to verify that the levels set out in the document are, in fact, low enough to prevent interception. Without an actual eavesdropping device with which to test, no manufacturer will be able to produce genuinely uncompromising equipment. PERRY, now I put up, now YOU SHUT UP! sheesh. treason@gnu.

4 3

Re: tempest devices and use
by hkhenson＠cup.portal.com 17 Dec '92

17 Dec '92

Actually the posting is a takeoff on the crypto restrictions. Keith

1 0

Re: tempest devices and use
by hkhenson＠cup.portal.com 17 Dec '92

17 Dec '92

I just sent email the first time, but hey, guys, does this not look almost exactly like some of the restrictive proposals? Someone is pulling your chains. Just because they don't put a :-) on it does not keep a posting from being satirical. Keith

1 0