August 2002 - cypherpunks-legacy

State Crypt Administration Commission Office interest in cryptoS.
by Matthew X 13 Aug '02

13 Aug '02

When they tell me what they salvaged from the EP-3.and RSA.I'll talk...only then. http://www.allconferences.net/conferences/20011019013039/ CONFERENCE A conference will be held alongside the exhibition. Speakers will be the officials from Ministry of Public Security. EVENT DESCRIPTION The only information security event in China with strong Government support. The exhibition is aimed at improving the awareness of the need for security of digital information, facilitating technological exchanges in information security and introducing overseas technologies and products in information security in China. Look forward to the RSA press release peterT.

1 0

Sunnie and Richard are looking out 4U.Just turn your head and cough.
by Matthew X 13 Aug '02

13 Aug '02

My husband and I volunteer with the Red Cross, our local volunteer fire department and emergency management in Hardin and Tyler counties of Texas. We are on the planning committee of the Lamar Institute of Technology's homeland security crisis management team, which is a regional endeavor to coordinate emergency management programs, as well as bring computer emergency response training and other aspects of our president's homeland security/defense programs into our locales. We are, and will continue to be, honored to be a part of these efforts as volunteers. Sunnie and Richard Baldwin

1 0

[aleph1@securityfocus.com: Implementation of Chosen-Ciphertext Attacks against PGP and GnuPG]
by Gabriel Rocha 13 Aug '02

13 Aug '02

Figured this might be of interest to folks here... ----- Forwarded message from aleph1(a)securityfocus.com -----

1 0

October CounteRevolution
by Matthew X 13 Aug '02

13 Aug '02

http://www.infosec-china.com/about.html Organized by : · Public Information Network Security Inspection Bureau, Ministry of Public Security of P.R. China · Science & Technology Information Institute of Ministry of Public Security, P.R. China · Information Security Research and Service Institution of the State Information Centre Whoopty doo.Just as the pathetic Bolshevik so called 'revolution' was really a coup by a minority authoritarian terrorist cult...October and revolution will go together less than October and stock market crash. http://www.computers-today.com/ctoday/20020701/index.html Dumb questions dept. Why isnt David McBride, regional technology director for Microsoft Asia-Pacific, pleased with the researches underway in the field of security? Moores law applies to security concerns: David McBride. Email your résumé directly to a Recruiter at Microsoft Get yer ass hauled into vulture culture me heartie's,Arggh! http://www.microsoft.com/careers/loc/dave.htm Dave's not here man.You can tell by the piccy. "...To me, we're every bit as entrepreneurial as a start up." If that didn't convince ya cynical basta's. "Seattle has wonderful amenities and lots of rain as well! What more could anyone ask?" That explains a lot,now why 'new technology' 5 must die in 10 words or less. APster; who do you want to kill today?

1 0

Operation dark screen.Get your 'research' on.
by Matthew X 13 Aug '02

13 Aug '02

Dark Screen's first phase, scheduled for September, will be a tabletop exercise in which a still-to-be-determined cyberattack will be played out and all participants will respond, said Gregory White, technical director of the Center for Infrastructure Assurance and Security at the University of Texas at San Antonio, which is leading the planning and execution of Dark Screen. AIA has assumed a leadership role in bringing together various stakeholders, including representatives from the city, the county, the Army, the Air Force, the state attorney general's office, the FBI, the private sector and many others. The second phase of Dark Screen will focus on applying the lessons learned from the tabletop exercise, and the third phase, to take place next May, will be a live exercise using actual attempts to penetrate networks, White said. He added that the final phase is "greatly to be defined," but will involve "testing notification and alert chains." "We can do it on paper, but by bringing everybody together at one time, we can see who is prepared to do that," White said. "What we do here is applicable across the nation." John Pike, director of the nonprofit organization GlobalSecurity. org, said the exercise was a welcome break from tradition. The usual all-talk-and-no-action stance on cyberattacks is "rather strange, given the number of emergency response exercises that are conducted to anticipate other problems, such as hazardous materials spills or nuclear accidents," he said. He added that actual exercises are needed to "rehearse response measures." The Defense Department frequently conducts exercises in which it pays companies to penetrate their systems, but Dark Screen will "help identify the interdependencies and linkages between the different sectors," White said. San Antonio officials plan to "review and modify" their infrastructure security measures based on the Dark Screen findings, said Mike Miller, the city's emergency management coordinator. "We hope to identify quick fixes and implement those quickly, as well as look at long-term issues that will take more time and resources to implement," said Miller, who is also assistant chief of the city's fire department. "The most important thing that we hope to get out of the exercise is securing San Antonio's infrastructure to maintain all aspects of the quality of life for our community. We also will share our experiences with other communities to help them be better prepared." http://www.fcw.com/fcw/articles/2002/0722/tec-drill-07-22-02.asp

1 0

MS sprung bad,looks like CJ was right about Gates.
by Matthew X 13 Aug '02

13 Aug '02

Mysterious plague hits Vutures...http://www.theregister.co.uk/content/4/26651.html MS recruits for Palladium microkernel and/or DRM platform By John Lettice Posted: 13/08/2002 at 10:23 GMT Microsoft's efforts to disassociate Palladium from DRM seem to have hit their first speed bump. Some voices within the company (and we currently believe these voices to be right and sensible) hold the view that Palladium has to be about users' security if it's to stand any chance of winning hearts and minds, and that associating it with protecting the music business' IP will be the kiss of death. So they'll probably not be best pleased by the Microsoft job ad that seeks a group program manager "interested in being part of Microsoft's effort to build the Digital Rights Management (DRM) and trusted platforms of the future (Palladium)." Oh dear. It's one of a clutch of Palladium job ads currently up on the site, and is the most blatantly off-message one. While the authors of Microsoft's discussion white paper on Palladium say, "Palladium will not require Digital Rights Management (DRM) technology, and DRM will not require Palladium... They are separate technologies," the author of this ad continues: "Our technology allows content providers, enterprises and consumers to control what others can do with their digital information, such as documents, music, video, ebooks, and software. Become a key leader, providing vision and industry leadership in developing DRM, Palladium and Software Licensing products and Trust Infrastructure Services. If you are looking for an opportunity to get in on the ground floor of a critical new area for MS and a position with autonomy and growth, then this is an ideal position." Content providers controlling their documents, music, video, ebooks, a critical new area for MS, oh dear oh dear. And we quite liked: "Additional responsibilities include defining the industry..." Gosh, the whole industry? That's a responsible job, but we thought Microsoft was supposed to have given this sort of thing up. The post will also "include collaboration and technology sharing across CSBU [Content Security Business Unit, whose bag Palladium is] and with other MS teams, such as Office, STS, Avalon, CLR, Windows Media Foundation, eHome, Pocket PC, Mira, MSXML, GXA, and .Net Framework." There's a handy list of current MS teams for you, people. So Windows Media is a Foundation now, and what's an Avalon when it's at home, anyone? Job two, SDE lead, is much more on message and quite interesting, as it provides some clues about the way Palladium will be built. "What is Palladium? We are a windows team working on new, trust-oriented Windows features, re-architecting and re-developing the Windows PC platform from the hardware up. We will dramatically enhance the level of Security available to any customer who wishes to enhance the Privacy, Security, and Data/Content Protection aspects of their applications. We will offer customers a very high level of data protection, no matter where they live, who they are, or what they are trying to protect." Aside from that Data/Content Protection, it's almost unworrying. Here's the techie bit: "Own lean and mean team of 4 senior developers building the very guts of this new security software. This is one of the very few opportunities to build a micro-kernel from scratch. Were keeping everything thats cool about a micro-kernel and nothing thats not. Responsibilities include: abstraction of hardware from the security modes of the new CPUs to cryptographic input devices, process control, from laying out the image in memory, to providing system services, from providing memory management to interrupt handling, from a debugger to the fundamentals of structured exception handling. No file system, no networking, nothing complicated, only elegant. This is a dream job." Indeed it is. The approach sounds similar to the one the early NT development team took, before marketing started maiming the thing. Also wanted is a secure application architect, who "will be responsible for application strategy and design. The Secure Application Architect will work with development, marketing and internal and external customers to identify trusted application scenarios that will be supported. He/she will then be responsible for executing the strategy: providing support and guidance for application developers, and working with the internal Palladium team to ensure that the necessary system services and infrastructure are in place." So this one could be the nark. Apply here, here or here. ® Great reversed engineered intelligence from the carrion eaters."I wanna bite that hand so badly..."Especially after a night and a day at the Opera. http://www.theregister.co.uk/content/4/26645.html If your using free Opera,you can get rid of the ads with a little hacking...just don't get caught now its a class A felony.

1 0

FOX 24-Cpunks 97.
by Matthew X 13 Aug '02

13 Aug '02

24-research-Encryption,cont. The other side of the debate is typified by privacy advocates and e-commerce interests who feel that the Govt.wants to expand,not just preserve,its ability to eavesdrop.They believe that fledging mediums like the Internet will never become economically viable if the people using it don't feel that their privacy is protected and their data is secure.There are also concerns about the potential for Govt.abuse of any kind of key recovery program,or that the key recovery program would itself be insecure,incomplete and the target of infiltration and hacking.There is an international aspect to encryption as well,for any artificial stricture on the complexity of encryption software,(so that the Govt.can still break it should it want to.)or which reduces its security,(by placing copies of keys in some sort of escrow account.)ultimately devalues the software and leaves other countries without such restrictions to devalop industry standards and much better products.There is also the question as to whether the kind of messages the Govt.wishes to intercept and decode would ever be transmitted on a system which belonged to the key recovery program.If other non-recoverable systems were still available to criminals. http://www.fox.com/24/research.html

1 0

Colin plays dumb, Russians don't want Peace CorpSpies
by Khoder bin Hakkin 13 Aug '02

13 Aug '02

MOSCOW (AP) - Secretary of State Colin Powell made no progress in discussions with his Russian counterpart in overcoming Moscow's unexplained refusal to grant visas to Peace Corps volunteers, a U.S. Embassy official said Tuesday. U.S. officials are negotiating with the Foreign Ministry and the Education Ministry, but the visa problem - which has forced Washington to cancel plans to send a new batch of volunteers to Russia this year - remains unresolved, said an embassy official, speaking on condition of anonymity. http://ap.tbo.com/ap/breaking/MGAI0B8XT4D.html ........ Goodness! You mean the US is stuck with only embassy staff, no "Peace Corp" Spies in the field? -- "Better bombing through chemistry." -John Pike, director of Globalsecurity.org on use of speed by US pilots

1 0

Re: Challenge to David Wagner on TCPA
by lynn.wheeler＠firstdata.com 13 Aug '02

13 Aug '02

actually it is possible to build chips that generate keys as part of manufactoring power-on/test (while still in the wafer, and the private key never, ever exists outside of the chip) ... and be at effectively the same trust level as any other part of the chip (i.e. hard instruction ROM). using such a key pair than can uniquely authenticate a chip .... effectively becomes as much a part of the chip as the ROM or the chip serial number, etc. The public/private key pair .... if appropriately protected (with evaluated, certified and audited process) then can be considered somewhat more trusted than a straight serial number aka a straight serial number can be skimmed and replayed ... where a digital signature on unique data is harder to replay/spoof. the hips come with unique public/private key where the private key is never known. sometimes this is a difficult consept ... the idea of a public/private key pair as a form of a "difficult to spoof" chip serial .... when all uses of public/private key, asymmetric cryptograhy might have always been portrayed as equilanet to x.509 identity certificates (it is possible to show in large percentage of the systems that public/private key digital signatures are sufficient for authentication and any possible certificates are both redundant and superfulous). misc. ref (aads chip strawman): http://www.garlic.com/~lynn/index.html#aads http://www.asuretee.com/ remailer(a)aasg.net on 6/13/2002 11:10 am wrote: This makes a lot of sense, especially for "closed" systems like business LANs and WANs where there is a reasonable centralized authority who can validate the security of the SCP keys. I suggested some time back that since most large businesses receive and configure their computers in the IT department before making them available to employees, that would be a time that they could issue private certs on the embedded SCP keys. The employees' computers could then be configured to use these private certs for their business computing. However the larger vision of trusted computing leverages the global internet and turns it into what is potentially a giant distributed computer. For this to work, for total strangers on the net to have trust in the integrity of applications on each others' machines, will require some kind of centralized trust infrastructure. It may possibly be multi-rooted but you will probably not be able to get away from this requirement. The main problem, it seems to me, is that validating the integrity of the SCP keys cannot be done remotely. You really need physical access to the SCP to be able to know what key is inside it. And even that is not enough, if it is possible that the private key may also exist outside, perhaps because the SCP was initialized by loading an externally generated public/private key pair. You not only need physical access, you have to be there when the SCP is initialized. In practice it seems that only the SCP manufacturer, or at best the OEM who (re) initializes the SCP before installing it on the motherboard, will be in a position to issue certificates. No other central authorities will have physical access to the chips on a near-universal scale at the time of their creation and installation, which is necessary to allow them to issue meaningful certs. At least with the PGP "web of trust" people could in principle validate their keys over the phone, and even then most PGP users never got anyone to sign their keys. An effective web of trust seems much more difficult to achieve with Palladium, except possibly in small groups that already trust each other anyway. If we do end up with only a few trusted root keys, most internet-scale trusted computing software is going to have those roots built in. Those keys will be extremely valuable, potentially even more so than Verisign's root keys, because trusted computing is actually a far more powerful technology than the trivial things done today with PKI. I hope the Palladium designers give serious thought to the issue of how those trusted root keys can be protected appropriately. It's not going to be enough to say "it's not our problem". For trusted computing to reach its potential, security has to be engineered into the system from the beginning - and that security must start at the root! --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Doighty Joisy cops using RSA.Fuck you peter Trei.
by Matthew X 13 Aug '02

13 Aug '02

VINELAND, N.J. The New Jersey State Police are requiring the news media to contact state police headquarters in Ewing for all inquiries into crimes instead of getting reports from troopers in local barracks, according to a published report. "No information is to be released except through this office under the auspices of (N.J. State Police Superintendent Joseph Santiago)," state police spokesman Sgt. Gerald Lewis told The Daily Journal in Vineland. The newspaper reported Aug. 9 that the restriction had stopped the dissemination of local crime information, including the release of weekly reports that documented incidents handled by local barracks. It also said media coordinator positions at the Bridgeton, Buena Vista Township, Bivalve and Port Norris barracks were eliminated. Trooper Steve Jones, a spokesman for the state police, told the Associated Press that a memo was sent throughout the agency about a month ago requiring all press calls to be directed through headquarters. But Jones said the requirement was generally a policy before and the memo simply reaffirmed it. In some cases, such as traffic accidents, he said local barracks may still be able to comment, but it must be cleared through headquarters. As for the weekly crime logs and media coordinators, Jones said both have been eliminated because of a staffing shortage. Gov. James E. McGreevey signed the Open Public Records Act last month, but his administration then angered news organizations by making more than 400 categories of government records exempt from the new law. In response to those concerns, state Attorney General David Samson sent a memo to county and municipal police departments. "Nothing in the order was intended to restrict immediate release of information to the public," the memo said.END. Recently,"clear trust" http://www.rsasecurity.com/news/pr/2002/020225.html Mind you with a record for bringing charges like this http://www.lawbuzz.com/justice/hurricane/hurricane.htm I might want 'the most trusted name in e-security' to bury info for me.They love it in the Chinese gestapo.

1 0