December 2003 - cypherpunks-legacy

Micro$oft and Java
by gorkab＠sanchez.com 17 Dec '03

17 Dec '03

Microsoft announced its Internet plans, and is considering licensing Java from Sun Microsystems. Other parts of the plan: OLE controls that can be transmitted over the Web, acting like applets; Web-related enhancements to Visual Basic; commerce, security, publishing and server software. [WSJ 12/7 p.B8] IBM joined the ranks of companies licensing Java software from Sun Microsystems. The company plans to integrate the technology into all its Internet software and operating systems, including the version of Windows 3.1 it sells. [NYT 12/7 p.D2] [WSJ 12/7 p.B8]

1 0

Re: Is there a lawyer in the house?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:27 PM 12/7/95, cme(a)acm.org wrote: >It could be even worse. I was on a panel last year with Scott Charney (sp?) >(I believe from DoJ) during which he commented that if you give your secret >key to anyone -- e.g., your own company -- then you have given up the >presumption of privacy. That leaves the police open to get that secret >without a warrant. This claim should be checked by a real lawyer. Huh? You mean if you give me your key the police can get it from me without a warrant? What if I don't want to give it up, and you don't? How would the police get it without a warrant? (And "I" could be your employer, so the point is clear.) And even more strikingly, what if you give your private key to your lawyer for safekeeping? Has attorney-client privilege gone away? (Granted, there are ways to break attorney-client privilege, but these are rare exceptions. In any case, the police could not get the private key without a court order, warrant, whatever.) I can believe that some cases of giving up keys wipes out one's arguments based strictly on "privacy," but not that it wipes out other arguments. It seems to me that if one wants to voluntarily escrow private keys, for safekeeping, one's personal lawyer is a safe bet: it is very difficult to break this kind of attorney-client confidentiality, from what I know of such things. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

7 14

CPUSA = CypherPunks USA?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:39 PM 12/7/95, E. ALLEN SMITH wrote: > I suspect I know what organizations they're interested in (CPUSA et >al), but did they ask about any specific organizations? CPUSA? You mean "CypherPunks USA"? I agree that being on the Cypherpunks list is probably a serious threat to one's security clearance. After all, the things we talk about are destabilizing to governments, are conducive to creating open channels for releasing material anyone thinks is useful to be released, and even makes espionage trivial. (We seldom mention this, it being old hat, but the Aldrich Ames' of the world need no longer resort to archaic tradecraft such as leaving messages in Coke cans in the crooks of trees--digital dead drops are as close as your nearest PGP package and remailer. This is a revolution in espionage--not that I am advocating or condoning it, although it is often necessary and even moral.) Given that many of us take an explicitly trans-national approach, with little or no loyalty to local and national governments, and given that many of us advocate a Nietzschean kind of personal choice in deciding which laws to obey and which to ignore, our outlook is probably as dangerous to secret programs as membership in the Communist Party would be (especially these days, where membership in the CP would be seen as either a sign of slow thinking or quaintness). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Still more on the Digicash protocol
by daw＠delhi.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just a clarification about my comments on privacy against eavesdroppers with Digicash. I admit I didn't express myself very well the first time. In article <199512071610.KAA16536(a)admin.starnet.net>, Mark Twain Ecash Support <support(a)marktwain.com> wrote: > > >Worse still, anonymity for the shop is worse with Digicash than with real > >cash. If I pay you real cash on a secluded street, you're fairly anonymous. > >If I pay you Digicash over the Internet, any passive eavesdropper could be > >recording your identy and the whole transaction. Blech. > > This is raising an issue that has nothing to do with Ecash. The complaint is > in fact about the lack of a gereral link encryption on the Internet. I agree > that this is needed, but providing it really isn't Ecash's job. I am eagerly > anticipating the general use of IPSEC. > Hrm, I think you misunderstood what I was trying to say. Assume the attacker is not doing any traffic analysis. The problem is that even then, the shop's identity (and product info, and payment amount, and bank ID, etc.) are still sent *in the clear* in the Digicash payment protocol. Thus all those items can be correlated to the payee's identity: a complete loss of privacy for the shop. There's no need to send that payment info in the clear -- why not encrypt? If it is encrypted, a passive eavesdropper can only learn the payer's & payee's identity if he uses traffic analysis, and even then he doesn't know the payment amount, product description, etc. For all he knows, the transaction could've been a $0.01 cent donation to Sameer for his anonymous remailer, or it could've been a $10,000 transfer to Sameer's machine in (virtual) Anguila-space for a few dozen Apache servers. (So this also has implications for payer anonymity & privacy, not just payee privacy. When payment info is sent in the clear, and the eavesdropper is doing traffic analysis (e.g. by sniffing the link out from a small business), the eavesdropper can correlate payer's identity with the payment amount, product description, and other buying habit information. When Digicash protocol messages are encrypted, this information isn't released, and can't be correlated with payer identity, even when traffic analysis is being done.) That's why I really wish Digicash were encrypting all its messages. And I'm very glad to hear that Digicash will support sending the entire protocol over a SSL-protected link. Great feature! I'll be looking forward to it. > >* continue specifying the protocol at a deeper level, like you promised > > (and throw in source for security-critical modules too, eh? :-) > > Writing all this down takes time. DigiCash may hire a tech writer soon. That > should improve communications between all parties. Excellent! Thanks for all you're doing to improve Digicash's anonymity, privacy, and security features, Lucky. I think it's really important to get this right in the pioneering work... - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMeEBCoZzwIn1bdtAQFzYAF/agJtA7eal+rEP0ki34FY/vyKc/EDqJ0p QR1T+zJZ0tn6i1hwluqlmvigJpWNst41 =/NJW -----END PGP SIGNATURE-----

1 0

Re: Micro$oft and Java
by Joel McNamara 17 Dec '03

17 Dec '03

I was at the Microsoft presentation. Crypto-relevant info: A patch will be published in the next few days to address the weak .PWL encryption. I got a rather lame excuse about how the encryption was first implemented in 1991, and how it was sufficient then. They will supposedly be changing the seed. I asked about what MS was doing in regard to future strong crypto. Got an interesting response in that that "the government was going to let them implement 768 bit keys." I later asked an MS person if these were RSA session keys or what. He said yes, but I really don't think he knew what he was talking about based on some of his other comments. Visual Basic Script will be MS's response to JavaScript. The interesting thing here is a plan to use digital signatures on controls and scripts as a means of authentication. The comment was made "you'd trust something signed by Lotus or some other big name, but you probably wouldn't be that trustful of a piece of shareware." Hmmm... MS will be releasing a "safe" runtime version of Visual Basic that will supposedly prevent nasty virii and trojan horses from being implemented on Web pages. IMHO, Perry's previous comments on the security of Java apply. Servers and some clients will support end-to-end encryption. No details... I didn't ask about GAK. Bill said there was a white paper explaining Microsoft's position on encryption. Maybe I'll test the search capabilities of the MS Web site later tonight. Overall, the presentation was interesting (but obviously lacking in technical details as the audience was mostly press). MS is going to throw a lot of resources at this in order to maintain its industry dominance. Thought for the day. Bill on the relevance of the briefing being held on Pearl Harbor day quoted Admiral Yamamoto after the 1941 attack, "we have awoken a sleeping giant." Draw your own conclusions on that one... Joel

3 2

Strange Unix behavior dealing with utmp - anyone recognize this?
by fc＠all.net 17 Dec '03

17 Dec '03

I was sending out a few hundred 25K emails over a period of a minute or so when my systemn encountered this thrilling sequence: Dec 7 22:11:56 all vmunix: file:<3>zs1: silo overflow Dec 7 22:11:57 all syslogd: /etc/utmp: File table overflow Dec 7 22:11:56 all vmunix: table is ful<3>zs1: silo overflow It appears to be some sort of file table overflow related to the syslog daemon. The message repeats numerous times and I think it has to do with the number of messages sent over a short time, however: I regularly send far more messages without this error It lost the processes that were generating these messages so I had to redo part of the mailing. Does anyone recognize the symptom, and does this open a potential for attack by stress? (e.g., if you can get something to fail in this way can the failure cause something to be missed?) Just thought I'd mention it. -> See: Info-Sec Heaven at URL http://all.net/ Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

(no subject)
by Nicholas Philp 17 Dec '03

17 Dec '03

WE WANT SOME PUSSY PICTURES

2 1

Re: [FYI] FBI Training Eastern European Police
by Dave Del Torto 17 Dec '03

17 Dec '03

At 8:22 PM 12/6/95, anonymous-remailer(a)shell.portal.com wrote: [elided] >I'm certain that the FBI and other law-enforcement officials might >also learn by living in a city where the East truly meets the West. > >Budapest is a beautiful old city of bridges, not just literally but >figuratively. It's where anyone in the world can find comfort. [much elided] Hey "Alice," This is a very persipicatious set of observations about Budapest, a city I lived/worked in for a while (you sound like you know it rather well yourself). The level of technical CS knowledge in Bp is comparable to, or better than, many other cities (except maybe for Moscow and St. Petersburg) in the former Bloc. Your comments also provide good insights into why it's technically and geographically important to cypherpunks: it's the petri disk for many of our cpunk brethren over there. The fact that the FBI has chosen Bp as one of their entry-points into the region impacts our policy discussions here, particularly since our LE types are making contact with the former secret police in that region, and especially so given the stationing of US Troops in Kaposvar as we type (southern Hungary) for easy entry into Bosnia. Anyone who attended CFP 95 may also remember some of Esther Dyson's lunchtime comments about the Russian mafia (which has a strong presence in Bp) and the growth of crypto's use both by the gangsters and LE officers. Some of the most powerful crypto may be emanating from these regions and it would be wise for us to try and track TLA activities in that area. I won't drag this topic out any further, but if anyone comes across similar info about our various TLAs operations over there, I hope they'll at least share it with me, if not the list. dave PS: I hope Perry's paying attention. ;)

1 0

Anyone Remember socket.c?
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Fellow 'Punks, A while back on the list, someone posted a very short C program called socket.c, which, when given a port number and an excutable, would fork off copies of a given application for anyone who connected to the port. I saved the program at the time, but seem to have deleted it. I realize it would be trivial to write, but don't want to have to look at nasty network #include files. If someone could either post it to the list again, or email me a copy, I will be eternally greatful. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Java musings
by Adam Shostack 17 Dec '03

17 Dec '03

Some musings on policies, threats and liabilities of Java, Livescript and other downloadable applets. I. Policies. The recent Livescript problem was predictable. Building an execution environment to safely handle all the myriad of tricks that programmers will throw at it is not a simple or easy task. People will make mistakes in the design and execution of these environments. Right now, many people are chasing the idea of applets; its neat, sexy, and everyone wants in. But, for many users, and many environments, certain capabilities may be inappropriate. There has already been loud complaining in many forums about the lack of site configurable Certification authorities, lack of site control over Java features. A site needs to be able to decide who to trust, and who should be able to make these decisions, in a manner that a user can not easily override. The ease of configuration of trust parameters in Netscape is neat for personal use, but inappropriate for business. When Java gets its ability to check signatures, expect complaints about lack of site configuration of trust hierarchies. (Yes, as opposed to web of trust. As a bank, I want to be able to control what code can run with a very explicit hierarchy.) All applets are not created equal. All user requirements are not equal. Applets are not created equal. Some are created in house to do certain things, like watch the price of two stocks relative to one another. If an applet is created in house, signed off on by the InfoSec people, then there's no reason (assuming strong integrity checking) to deny it access to local disk, arbitrary network access, etc. However, for various reasons (notably compartmentalization, aka defense in depth), it is desirable to restrict disk (and possibly network) access to certain addresses. Something akin to chroot(), tagging of packets outside the applications control to make firewall filtering easy, filtering of available addresses to send to (only talk on local subnet). The ability to assign various levels of privilege to code that runs on a virtual machine will be essential. The ability to limit these privileges must be reserved in some way to those with site security responsibilities. The security people, in turn, will need the ability to delegate. This can perhaps be provided based on a least trusted basis. Code starts out in a small, tight environment, with no access to anything other than the (protected) processor, and a promote() function which does authorization checking before granting new levels of privileges in certain areas. Access to disk, access to local and remote network services, and the ability to pull the browser to a new URL are all privileges that should be orthogonally configurable, by site, by machine, or by applet. All user requirements are not equal. This should be obvious. Not all users need Java or Livescript. If a user is using Netscape to look at man pages, access to Java and livescript is not very important. Access to unsigned Java applets may or may not meet the site security policy. At home, I might happily look at them. In the office, I might have a very different approach. A bank teller might need access to applets developed by the bank for various things, but not need access to anything over the internet. He would need to be able to access the local lan servers. The need of users to get to different resources, and work under different levels of protection calls out for mandatory strong authentication in applets. In other words, a better design might be only execute applets with some (verified) signature attached to them. The language in which the applet was written is important. More important is the ability of users and management to set policies, and see those policies enforced by applications. I could then set my browser only to run Livescripts signed by someone I know (or an agency that vets them for bugs), and only run Java with minimal trust in the absence of signatures. II. Threats and liabilities A malicious applet, running amok on a machine, with the same disk & network access as a user, can send off to the world anything it thinks interesting. However, there are times when letting an applet at certain files, or giving it heavy network access, might be very useful. I'll take as an example Anderson Consulting's demo BargainFinder (http://bf.cstar.ac.com/bf/) BargainFinder is a way to search 9 music stores on the web for an album, with one form. 3 of the stores are blocking the searches. In addition, a cypherpunk might wonder if the searches and their origins are being logged. Thats not very useful for those of us who look forward to perfect marketplace information for consumer goods. Let me sketch BargainFinder2, as powered by Java. Instead of going to Anderson for the page, you download BF to your local machine. It does the searching, same as BF1 did, but with no blocking possible. You find your CD at the best price. Perhaps BF is rental-ware, perhaps its someone advertising their Java coding skills. But its clear that this applet needs to be able to access the network freely. Its also plain that it won't be written for 6 platforms. It might be written for Windows, but the Java market might be larger still, and thus more attractive. (Not to mention that the network interface is mostly taken care of. no Winsock version worries.) Other applets, say a Ecash wallet manager that interfaces with Quicken, needs access to your local disk, and needs to be able to respond to incoming network queries from shops. Granular control of the access that applets have thus seems to be needed. Making Java 'secure' is not enough, because people will 'turn off' all the security to make one applet work. It might also be interesting to consider automatically updating software, that can replace itself from time to time, after verifying that a signature is correct. Although, that does raise the value of stealing a key from some well known, trusted applet vendor. To summarize, 'security' in the vauge sense that Java promises, while useful, needs granularity to allow it to fulfill its potential. Comments are welcome. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

GAK solutions was: Is there a lawyer in the house?
by Pat Farrell 17 Dec '03

17 Dec '03

In message Thu, 7 Dec 95 16:27:23 EST, cme(a)acm.org writes: > It could be even worse. I was on a panel last year with Scott Charney > (sp?) (I believe from DoJ) during which he commented that if you give > your secret key to anyone -- e.g., your own company -- then you have > given up the presumption of privacy. Interesting. At the NIST meeting, criteria #5 deals with decrypting a conversation with only the key from one end. I thought that would be hard to implement. But during the discussion, they called on Miles Smid [sp?] who was obviously a NIST employee/consultant with real knowledge. He suggested that you could encrypt the session key with the public key of both parties, and send it along. This would allow single ended GAK. This is not far from the idea that CME proposed that the NSA/FBI/CIA publish public keys, and we'll hack a voluntary version of PGP that encrypts the session key with the LEA public key -- instant voluntary Key Escrow. Miles Smid's idea seemed reasonable, until you realize that he intends you to escrow your private key... Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: Is there a lawyer in the house?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:27 AM 12/8/95, sameer wrote: >> > You mean if you give me your key the police can get it from me without a >> > warrant? What if I don't want to give it up, and you don't? How would the >> > police get it without a warrant? >> >> Yes. Unless it could be shown there their was an expactation of privacy >> in the transfer, or that there was an understanding that you intended this >> to be a confidential matter. Or in the alternative, that the > > I do not understand. > >Alice has Alice gives Bob her key. Cop wants Alice's key. Cop tells >Bob "I want Alice's key, you need to give it to me. I don't have a >warrant." > >How is this different from >Bob has key. Cop want's Bob's key. Cop tells Bob "I want your key, >you need to give it to me. I don't have a warrant." > > > sheesh, what a fucked up legal system. ^^^^^^^^^ EXON WARNING! This message has just exposed the author, the toad.com system, and all those who pass it on to fines of not less than $10,000! But I share Sameer's confusion. If cops show up at my door, they must, it seems to me, present proper warrants before they can _enter_ my premises, or _search_ my premises. Something given to me, whether a letter, a key, a photo, etc., is essentially *my property* and may not simply be taken away from without due process. I hope Black Unicorn is incorrect in his point. --Tim Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: GAK solutions was: Is there a lawyer in the house?
by Carl Ellison 17 Dec '03

17 Dec '03

[By the way, I know that my sig on that message was bogus. I made the mistake of editing the message after signing it and sent it before I stopped to think.] >Date: Thu, 07 Dec 1995 22:07:00 -0400 (EDT) >From: Pat Farrell <pfarrell(a)netcom.com> >Subject: GAK solutions was: Is there a lawyer in the house? >Interesting. At the NIST meeting, criteria #5 deals with decrypting >a conversation with only the key from one end. > >I thought that would be hard to implement. But during the discussion, >they called on Miles Smid [sp?] who was obviously a NIST employee/consultant >with real knowledge. He suggested that you could encrypt the >session key with the public key of both parties, and send it along. >This would allow single ended GAK. Miles Smid is a NIST employee who is quite knowledgeable about crypto and Clipper. >This is not far from the idea that CME proposed that the NSA/FBI/CIA >publish public keys, and we'll hack a voluntary version of PGP that >encrypts the session key with the LEA public key -- instant >voluntary Key Escrow. I still think that's the only way the gov't will get GAK -- :) - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Re: GAK solutions was: Is there a lawyer in the house?
by Carl Ellison 17 Dec '03

17 Dec '03

>>This is not far from the idea that CME proposed that the NSA/FBI/CIA >>publish public keys, and we'll hack a voluntary version of PGP that >>encrypts the session key with the LEA public key -- instant >>voluntary Key Escrow. > >I still think that's the only way the gov't will get GAK -- :) Actually, the real proposal (http://www.clark.net/pub/cme/html/no-ke.html) is to have them give me their public keys. I would sign and post them. The world's citizens would then add them to their public keyrings and, when they feel like volunteering GAK, would include these agencies as crypto-recipients -- on a per-message basis. No meetings -- no hassle -- nearly 0 cost -- and the gov't could have GAK tomorrow. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Re: PGP
by Adam Hupp 17 Dec '03

17 Dec '03

Sorry...I was always taught that the user should not be mandated to finish the job of the programmer. Please, do not take me wrong, PGP is a remarkable tool...but I was not aware I had iron out the bugs. That part is the easiest to do compared with the genius of the program... but I still should not have to do it. This is not "ironing out bugs". It is configuring the program to run on your version of Unix. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQBtAzCNppQAAAEDALhWZl7IuGZ9zZT5bACo0b/1L0Nv0C72vKHIO3IHh+cwpHHa 2Ozb9aeO0UvXGwkkZIYgUm0EvmzKh7yb1GTLvBp5kXpR3I9w+Yj4LGlBDERpUWw6 x4ED49pwDnz1Hl5FBQAFEbQYYXNoIDxhaHVwcEBwcmltZW5ldC5jb20+ =PtJK -----END PGP PUBLIC KEY BLOCK-----

1 0

Oh Yeah? ipsecure
by Ecafe Mixmaster Remailer 17 Dec '03

17 Dec '03

For Immediate Release Contact: National Semiconductor Lori Sinton (408) 721-2448 lori(a)ipower.nsc.com http://www.ipsecure.com CryptoSampler, from National Semiconductor, Demonstrates Ease of Building Secure Electronic Commerce and Communications Applications Company's iPower(tm) Business Unit Launches Free CryptoSolver to Inaugurate New Web Site SANTA CLARA, Calif., November 27, 1995 --- National Semiconductor Corporation today announced the availability of its CryptoSampler package for applications developers interested in gaining a "hands on" understanding of how cryptography solves modern business problems. Developed by National's iPower Business Unit, the program consists of three demonstration applications and the PersonaCard(tm) 100, a hardware token for personal, portable data security. The package contains both the demonstration applications including "build-it- yourself" tools to integrate security easily into electronic commerce and communications applications. Priced at $129, the CryptoSampler package is available to the first 1,000 U. S. respondents and can be ordered directly from National's iPower Business Unit. In a related move, the company's iPower Business Unit launched its own web site along with CryptoSolver, an interactive game that invites participants to solve encrypted messages based on the concepts of substitution ciphers and the alphabetic frequency table. CryptoSolver, a technology-teaser game rates players' deciphering skills and can be downloaded from iPower's new web site free. "As networks become the lifeblood of corporations and the principal means of commerce, securing electronic transactions and proprietary information over public and private networks is absolutely critical," said Tom Rowley, marketing director for National's iPower Business Unit. "Through this program, we hope to help broaden individual's understanding of how modern security technology can solve real problems on the Internet and in Electronic Commerce business applications," Rowley explained. CryptoSampler Package - Token Plus Three Applications in One ------------------------------------------------------------ The CryptoSampler package consists of a PersonaCard 100 data security token, a floppy disk containing all three demonstration applications, a cryptography primer written by recognized cryptography expert Bruce Schneier, and a questionnaire. Customers who choose to complete and return the questionnaire, will receive a free copy, while supplies last, of Bruce Schneier's newly-released book, Applied Cryptography, second edition. o PersonaScreen(tm) System Lockout Utility is a screen locker that prevents unauthorized entry into a personal computer by locking the keyboard and mouse. The PersonaCard Token, implemented in the PC Card (formerly PCMCIA) Type II format, locks and unlocks the desktop computer. o PersonaSecure(tm) Word Utility enables users to sign, seal (encrypt, decrypt), and verify documents as well as e-mail messages from within Microsoft Word 6.0 for Windows. Installed automatically, PersonaSecure displays a toolbar that corresponds to the functions of National's PersonaCard data security token. The hardware token incorporates RSA's industry-standard digital signature and encryption formats which are now "token aware." In addition to protecting and validating Microsoft Word documents, users can encrypt and decrypt e-mail messages with others who have installed the PersonaSecure Word Utility. o PersonaDLL Library for Visual BASIC 3.0 is a Dynamic Link Library (DLL) of routines that enables developers to quickly and easily develop their own applications incorporating high-level data security features. PersonaDLL includes a Visual BASIC application, Visual BASIC source code, and access to all of the features of the PersonaCard 100 token including digital signatures, RSA key generation, encryption, and verification. System requirements to run the CryptoSampler package are: Microsoft Windows 3.X, Windows for Workgroups 3.X, and a PC Card slot (version 2.1 or later). Microsoft Word 6.0 is required for the PersonaSecure Word Utility. Pricing and Availability ------------------------ The CryptoSampler package is available with or without a PC Card Reader. For those who plan to run CryptoSampler applications on a desktop or portable personal computer already equipped with a PC Card slot, the basic package is offered at a special price of $129 (including handling and shipping). A CryptoSampler package with PC Card reader is available for $199. The total retail value of the basic package and configuration with card reader is $300 and $500, respectively. To order the CryptoSampler package in either configuration, call 1-800-272-9959 Ext# 631 between the hours of 7 AM and 7 PM Central Standard Time. To play CryptoSolver and for more information about the CryptoSampler program, see the iPower web site at http://www.ipsecure.com . iPower Security Solutions ------------------------- Introduced a year ago, iPower technology provides the highest-level of commercially available security in a personal, portable hardware token. iPower solutions are already being incorporated by OEMs, ISVs, and VARs into a variety of applications and hardware platforms including e-mail and messaging, electronic commerce, network security, and secure access to on-line services including the Internet. National Semiconductor Corporation provides technologies for moving and shaping information. The company focuses on four key areas - communications, consumer, industrial, and personal systems. National Semiconductor is headquartered in Santa Clara, California, and has 22,300 employees worldwide. -30- Note to Editors: To receive a CryptoSampler package for review, call or e-mail Lori Sinton, 408 721-2448 or sampler(a)ipower.nsc.com iPower and PersonaCard are trademarks of National Semiconductor Corporation. All other trademarks are held by their respective companies.

1 0

Re: [NOISE] Re: FW: websurfer 4.6
by Ed Carp 17 Dec '03

17 Dec '03

> Date: Thu, 7 Dec 1995 15:49:09 -0600 (CST) > From: Aleph One <aleph1(a)dfw.net> > To: Rich Graves <llurch(a)networking.stanford.edu> > Cc: cypherpunks(a)toad.com > Subject: Re: [NOISE] Re: FW: websurfer 4.6 > On Thu, 7 Dec 1995, Rich Graves wrote: > > [snip] > > Microsoft's strategy is to support VB. > [snip] > > -rich > > > > Its interesting to note that all the people that were raving mad about Java > seem to be quiet now that MS is proposing to use VB. At least Java was > designed from the ground up with security in mind. But VB? Actual binary Well, at least it's easy and fun to program in (if you can call drag-'n-drop "coding"). Of course, until 4.0, their setup utility didn't check what version of DLL you were installing, so it's easy to get your DLLs out of sync on your system and blow your applications all to hell, and 4.0 throws all thos OLE crap in, even if you don't need/want/use OLE in your code and makes a 300K application into a 3M one, and they won't tell you what really goes on underneath the hood (I guess they're paranoid about getting ripped off), and never mind that it's almost trivial to write a VB decompiler (the .EXE is just a big jump table into offsets into VBRUN300.DLL), etc., etc., etc... And all this from a software company that took over 10 years to make their "operating system" do preemptive *anything*. But I guess I shouldn't complain. After all, VB has made me a pretty decent living for the past year or so...

1 0

the X.9 Electronic Payments ANSI standard
by sameer 17 Dec '03

17 Dec '03

My inquiries regarding Rich's post of the X.9 informal notes were rather fruitful. The chair of the working group seems interesting in including anonymous token-based payment systems in the standard, "I see no reason, other than interest, for the group to avoid non-account-based payment systems, to complement the account-based payment systems that we are now in the process of standardizing." Someone from Citicorp pointed me to http://www.llnl.gov/fstc and asked for my feedback. These people do seem interested in anonymous systems, they just don't have anyone who knows the stuff to work on it. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

2 1

Re: FW: websurfer 4.6
by Ed Carp 17 Dec '03

17 Dec '03

> Date: Thu, 7 Dec 1995 15:12:07 -0500 > Subject: Re: FW: websurfer 4.6 > To: cypherpunks(a)toad.com > From: Rich Graves <llurch(a)networking.stanford.edu> > -----BEGIN PGP SIGNED MESSAGE----- > > On Thu, 7 Dec 1995, Anonymous wrote: > > > Not surprising. They confuse random doodling with software, too. > > > > The real problem with NetManage is a severe case of brain death. > > My, thanks for your opinion. > > It may interest you to know that Microsoft recently licensed a bunch of > stuff from NetManage (San Jose Merc, no real details given). Yeah, and they also think that Windoze is a real opearting system, too...

1 0

Re: Micro$oft and Java
by leefi＠microsoft.com 17 Dec '03

17 Dec '03

| The interesting thing here is a plan to use digital signatures on | controls and scripts as a means of authentication. There was a press release on this. The PR index on http://www.microsoft.com/corpinfo/pr.htm points to a few Internet-related announcements that were made on 12/7. A brief quote on these signatures: "Microsoft plans to propose the Internet digital signature specifications to the W3C and the IETF as an open Internet standard. The technology will be an open, proposed specification available to the entire Internet community. In addition, as part of the Open Process Design Review, Microsoft will host a digital signature design preview in January to solicit feedback from the Internet community." This week there was also another workshop for ~150 ISVs, and these signatures were one of the topics. The event was not under any NDA, so you should start seeing feedback once folks get home and they catch up with mail (at least two were on Cypherpunks). The folks putting on the event have put lots of docs on the "Sweeper" SDK, on the below-referenced web site. Honestly, I'm not sure if all the stuff from the event this week is up there; if not now, most of it will get added in the next week or so. | Servers and some clients will support end-to-end encryption. No details... I believe SSL in current versions of the web browser and server, PCT around the corner (perhaps PCT is earlier than I'm thinking). | Maybe I'll test the search capabilities of the MS Web site later tonight. The clearinghouse for internet developer info (opened 12/7): http://www.microsoft.com/intdev/ It contains info on various VB Script, OLE Control, etc, as they refer to some of our Internet solutions. A page related to this press briefing (I presume also opened 12/7): http://www.microsoft.com/internet/ Hope this helps, Lee Fisher (wondering if I really should've de-lurked)

1 0

Re: Solution for US/Foreign Software?
by Oliver Huf 17 Dec '03

17 Dec '03

> or rational here.) The issue is that, unless written very carefully, > the crypto-less software is a "component of a cryptosystem", > and therefore still requires permission to export. Thanks for the hint. Oli.

1 0

Secrets (was:Is there a lawyer in the house?)
by Adam philipp 17 Dec '03

17 Dec '03

There seems to be some confusion about what the law of the land considers a "secret." Secrets according to our laws are knowledge one doesn not share without a BINDING legal obligation to keep the secret. Remember R4.C? That was a secret until it was shared, and hence lost its privileged position as a "Trade secret." Your secret key is just as safe, so long as it is always kept out of anyone else's hands. However if you are going to provide it to someone else it should be only through some form of contract. Even this might not be sufficient in some circumstances. The only truly safe possibility would be giving it to your lawyer in the course of your lawyers representation of you. NOTE: NOT YOUR COMPANY'S LAWYER. In house council have their obligation to the company, not to you. As such if they felt your key was unrelated to company business interests and possibly adverse to the company's interest...kiss that secret good bye. Sure, the police still need a warrant to go into your house and get the key, but they do NOT need a warrant to ask anyone else for your key, if you revealed your secret to someone who does not have an obligation of confidentiality to you, then they can reveal it with impunity. The danger of revealing it to a nonlawyer who has a contract with you is that they can be forced to reveal it, and still be liable to you for breech of contract... I am sure you see the dangers...just say no to key escrow...much safer. -Adam [NOTE: I am not an attorney, this is not legal advice, you get what you pay for] --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ |PGP key available on my home page|Unauthorized interception violates | | http://XXXXXXXXXXXXXXXXX/adam |federal law (18 USC Section 2700 et| |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|seq.). In any case, PGP encrypted | |SUB ROSA... |communications are preferred for | | (see home page for definition) |sensitive materials. | \-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/

1 0

Re: Cyberia-L Archive [was Re: ERA_sur]
by The user formerly known as Leslie Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.ULT.3.91.951206142028.4575V-100000(a)Networking.Stanford.EDU> you write: >As somebody pointed out to me, Cyberia-L, like cypherpunks, is archived >on http://www.hks.net/ and the public news server nntp.hks.net. !!! As far as I know, Cyberia-L isn't accessable via http from us. Please let me know if it is...if so something's very misconfigured. The nntp part is correct, though. And a bunch of the lists might soon be added to the http archives: cypherpunks is the test message base for it. >Now send them some of the money you're going to make from the stock market. That'd be way nice... Small unmarked bills are preferred. - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMgBryoZzwIn1bdtAQGB3gGA15WO7RLcosT3hrjEJN9d0H6Fk0fMu4lG E/cw+h9YZcB6Nk0jiURfceCkBSz4+JSC =TnoU -----END PGP SIGNATURE-----

1 0

Re: PGP
by john.ellis＠wmcmail.wmc.ac.uk 17 Dec '03

17 Dec '03

Does anyone have the source code for PGP (DOS) not Unix, ______________________________ Reply Separator _________________________________ Subject: PGP Author: Daniel 'genius' Charpentier <drcharpe(a)hamlet.uncg.edu> at internet Date: 06/12/95 18:29 -----BEGIN PGP SIGNED MESSAGE----- I've tried to find out the answers to my questions myself but I haven't been very successful. Actually, I haven't been successful at all. First of all, I've been using PGP on my computer but when I tried to port it over to my unix account it didn't work. I took the source code and tried to compile it using the unix g++ compiler but it gave me all of these errors. Where can I find PGP that is already compiled for unix or at the very least will compile for unix? Secondly, if I create a program that makes using PGP more user friendly can I let other people have it ( for FREE )? Lastly, what is considered overkill with cryptography? I don't believe anything is. My programs accept what the user inputs for how large prime numbers should be ( my public key programs ) but I make them able to accept values that go up to 30720 bits ( I don't believe a number can ever be large enough ). You can never be to safe...never. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMMXVhDMGe42brZbVAQEo/Qf7BSshqKJAmxVzyGSyAp2Qkj+/dqh1Zon1 xDqMnvU6ihLimHZ/uXGiQE2jM6N8FRbYu7psQ/iPJ+gX5/VKfrxlxjCfDM0Jx2s9 vucgMQz1KYbELA8Fo1QUEsDuTMzJ80VoTicXfZZmILhr7cBJH4pHa5RgkgrS2Lun iodQ+F7BXdio86TnctQgoKJ+78qOYDuV4Vfha/a290ZoZmPRcqArYv7tU6X3KMjf DGxqgugiwpHnkTO1B9wypoePbbJZSNzFYYvZKMI8Ntg7yFkMl/lSxcLh6oYq0ACe R9NfZR9x11H/fIrn8HZlq0Q86OptWhZz53p77VNN+sVZJOktHJIWqg== =WK6x -----END PGP SIGNATURE-----

2 1

Re: Is there a lawyer in the house?
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Timothy C. May wrote: > Sameer Parekh writes: > >How is this different from > >Bob has key. Cop want's Bob's key. Cop tells Bob "I want your key, > >you need to give it to me. I don't have a warrant." > > > But I share Sameer's confusion. If cops show up at my door, they must, it > seems to me, present proper warrants before they can _enter_ my premises, > or _search_ my premises. Something given to me, whether a letter, a key, a > photo, etc., is essentially *my property* and may not simply be taken away > from without due process. What's important here is the difference between things and information - if the cops want to get *things* in your possession, they need a warrant or consent or exigent circumstances or whatever. If they want to get *information* in your possession, they can subpoena you and make you talk (or show them the papers/records/whatever, modulo the Fifth amendment, modulo immunity). Either way, the standard for due process (essentially nothing for a subpoena - "more likely than not will lead to the discovery of fruits of/evidence of a crime" for a warrant) is pretty minimal. But, it's worse than that: as a matter of federal law, if I write "I, Greg Broiles, killed Jimmy Hoffa and hid his body in one of the concrete columns used to construct Giants Stadium", and give that piece of paper to you, and cops search your house illegally and find that scrap of paper, the information on the paper (if not the paper itself) can be used against me, even though it was found in an illegal search. I wouldn't have "standing" (e.g., a legal basis to contest the search) because federal law doesn't think I have a privacy interest in the stuff in your house. I think that's the tricky bit behind the idea that there's no (personal) expectation of privacy where a key is given to an escrow agent - the standing requirement. State constitutions and statutes may provide a higher level of protection - Oregon's constitution, for example, is interpreted to be more generous re who's got standing to contest the legality of a search. It occurs to me that the owner of the key might have a good argument that they've got "third party standing", where they can essentially adopt the position of the key's owner, because the key's owner is in a position such that they can't do a good job of representing their own interests, and the third party will. (e.g., the doctor(?) in _Eisenstadt v. Baird_) The owner of the key (at least if they're anonymous, and the key server is served with a subpoena to "disclose the 'true name' of the owner of key 0x58ddf30d") may wish to avoid revealing hirself. Hmm. That, of course, assumes that the escrow holder feels like fighting the subpoena - perhaps that's something to look for when you go escrow shopping. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMgNC33YhjZY3fMNAQGPPQP+M7IFM/DgfEf6z5f8YUoBHo+aXPfTzwtf xee1SPkJOxfH7dYaUIKs7JDAKxOGTaNdrlJjrMno7yHVFVHq6R7wRw8jOPUXhJ3C VZ94LpTqNF6OPPoD+pr2MFG+SaFLl7JyS16Kbe9ilUE5cG6N2hToUibSjwyz3BKc R95RR9TkRzs= =4jN1 -----END PGP SIGNATURE-----

1 0