December 2003 - cypherpunks-legacy

Re: VCRPLUS Huffman code
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 20:06 9/4/95, Stephen D. Williams wrote: >It was broken, and I might have the reference in my archives... > >If I get time I'll find it. Why not just do the simple thing and look at Gemstar Development Corporation's Patent for the details <g>.

1 0

maximizing cryptographic return
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

VZ> this list are aware of the idea that good encryption is often used VZ> to send a low-bandwidth session key, which is then used to encrypt VZ> that session using a less sophisticated but less computationally-demanding VZ> algorithm. hence you seem to have good security at a computational VZ> price that is less than encrypting everything with the secure protocol. Why must this process be limited to two levels? VZ> I wonder if some very cheap algorithms, in terms of computation time, VZ> could be used for the "on the fly" encryption of the voice using those VZ> bit. would XOR with the pad be totally out of line? The RSA could be used by the caller to precompute the session key to send to the reciever. The session key (IDEA or whatever) could be used to send "subsession keys" which are actually parameters for the PRNGs (use at least two, with different periodic characteristics, and XOR them together) that create the pad for your XOR. The subsession size should be chosen so that very little "clearvoice" is transmitted in each subsession. Perhaps a bit of randomness is in order here, as well. Along with the PRNG parms, a length field, within certain absolute limits. Now the spook doesn't even know where one subsession ends, and the next begins. Add to this the use of a (lossy?) compression engine that can run with little power, and a simple microcontroller (or several cheaper ones in parallel-I can see one master for the session and subsession key management and several slaves to handle the on-the-fly (en)(de)cryption itself) should be able to do the job, fitting the subsession key exchange in right along with the cyphervoice. Ideallly, we could have a box that could pull its power from the phone line, and take touch-tone control inputs. * Long, long ago, in a tagline far far away... --- * Monster(a)FAmend.Com *

2 1

Re: Reproductive Rights and State Benefits (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: "William H. Geiger III" <whgiii(a)amaranth.com> > Date: Sat, 23 Aug 97 22:37:02 -0400 > Subject: Re: Reproductive Rights and State Benefits (fwd) > >Would you be so kind as to explain exactly what the 14th brings to the > >table that was not already covered in the original document? We didn't > >need the 14th and still don't. It was, and still is, a political ploy to > >get people to willingly (through ignorance) comply with a bunch of > >schills. > > Nice try but it was you who brought up the 14th in your original reply to > my message. An intresting debating technique present and argument then > blame your opponent for brining up that argument. You're the one trying a straw-man, I was simply asking a question based upon several comments you have made both in this exchange and in others as well. It had nothing to do with your original question but rather an attempt on my part to expand the discussion to include the 14th which it must to be whole. Or is your view that you are the only party who may bring other issues into this discussion? Because, my personal opinion is that I don't need your permission to include other issues in the argument as long as I feel they are relevant and can justify them. > Clause 2: This Constitution, and the Laws of the United States which > shall be made in Pursuance thereof; and all Treaties made, or which shall > be made, under the Authority of the United States, shall be the supreme > Law of the Land; and the Judges in every State shall be bound thereby, any > Thing in the Constitution or Laws of any State to the Contrary > notwithstanding. > This trumps any argument you have made on this issue so far. Not really as it clearly states in the first clauses where that authority comes from and the 10th clearly puts limits on what expansions the courts and legislature can do with the Constitution. The last clause also clearly states that the constitutions and laws of any state are not superior (but does not deny equality as granted in the 10th) to the laws and treaties of the federal government. The last clause also provides even less reason for the 14th. Face it bud, you ain't got a foot to stand on. ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: SUMMARY: Not-so-volatile volatile memory Re: SUMMARY: Not-so-volatile volatile memory
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

> -- Summary: Data retention in semiconductor memory -- > > Contrary to conventional wisdom, "volatile" semiconductor memory > does not entirely lose its contents when power is removed. Both > static (SRAM) and dynamic (DRAM) memory retain some information on > the data stored in it while power was still applied. SRAM is > particularly susceptible to this problem, as storing the same data > in it over a long period of time has the effect of altering the > preferred power-up state to the state which was stored when power > was removed. Older SRAM chips could often "remember" the previously > held state for several days. In fact, it is possible to manufacture > SRAM's which always have a certain state on power-up, but which can > be overwritten later on - a kind of "writeable ROM". Is this a new discovery? When I used to work with DOD classified data, not so long ago, disk drives had to be declassified using an approved program, such as Norton Utilities' "WIPEINFO". (That was approved up through the SECRET/SAR level, anyway. I don't know about TS/SCI/SI.) But those same regulations said that RAM was considered declassified within a certain time (30 seconds, I think) after power was removed. (That time figure was UNclassified, BTW.) I think it was just to allow time for the voltage to bleed off of the power supply's filter capacitors, and not related to the relative volatility of DRAM.

1 0

Re: VCRPLUS Huffman code
by Peter Trei 17 Dec '03

17 Dec '03

> Has anyone worked out the VCRPLUS code? It was partially broken a few years ago, and the results published in Cryptologia. I have a xerox in a carton somewhere. The break was for codes up to 4or 5 digits long, if I recall - this covers most of the major timeslots on the main stations. Longer codes cover odd timeslots on less popular stations. Code which implemented this partial crack was published on the net, and the VCR+ people got very upset about it - apparently they make money selling the codes to TV Guide and newspapers. It's protected as a trade secret, not a patent. It used a combination of lookup tables and Huffman codes, and included a certain amount of obfuscation to resist cracking. Peter Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

2 1

Mailing list
by PyroDaft＠aol.com 17 Dec '03

17 Dec '03

I want to be on your mailing list

1 0

Re: Non-US SSL128 site
by Peter Trei 17 Dec '03

17 Dec '03

> > a) Use 128 bit SSL if the client allows it. > > b) Tell users which cipher is being used on a secure session. > Netscape's press release on the RC4-40 crack seems to have disappeared from > their home page, but I don't remember any specific mention of 128-bit > U.S.-only clients, just servers. > So what's up? Netscape sells a 128-bit US-only client for $39 Peter Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

4 3

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Only for the moment we are saying nothing. - A'Tak A'Tdorn

1 0

Re: Forgery, bills, and the Four Horsemen (Articles and Comment)
by Mats Bergstrom 17 Dec '03

17 Dec '03

Black Unicorn posted a very interesting info summary on the subject of foreign state US$$ forgery. This is a story I heard, long ago, from a Brit, Mr Waterlow, about something that happened to his grandfather, chairman of the Waterlow bank: Early in this century Portugal didn't print it's own money but contracted this job to the Waterlow Bank in England. Some skilled conmen succeeded in making the bank beleive they were representatives of the Portugeese National Bank. Then they ordered a huge amount of new bills and got away (at least for some time) with it. Now, the point is that this was acually GOOD for the Portugeese ecomomy, the real National Bankers having underestimated the optimal size of their cash stock. So, I wonder, perhaps the world economy might benefit from some Iranian addings to the number of $$ araound? A Keynesian boost? Just drifting (I know very little about economy...). Mats

1 0

Re: Reproductive Rights and State Benefits (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 24 Aug 1997 00:04:51 -0500 (CDT) > From: Mac Norton <mnorton(a)cavern.uark.edu> > Subject: Re: Reproductive Rights and State Benefits > Perhaps so, but that says nothing about the federal gov't > enforcing the First Amendment to the US Constitution against > the states, irrespective of the provisions of their constitutions > or other laws. It is a difficult thing to get from "Congress > shall make no law" to "No gov't anywhere in this country > shall make any law," but we've managed to do it, probably to > our credit on the whole. If that was what he had it would truly be great, unfortunately we don't have that. What we DO have is the feds and the state governments doing everything they can to get around limitations such as this. In effect we have exactly the opposite of your supposition. The fed's are currently deciding on just exactly how federal employees can express their religous beliefs. Do you really think the founding fathers were so stupid that they wouldn't have thought of this if their intent was to truly prevent any government from enacting such laws? ARTICLE I. Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. If you really believe what you state above I have a few of questions: [well actualy I have a lot of questions, but it would be pressing the point I suspect] * How does the federal government justify their limitations on the Native American Church or the Coptic Church when federal laws relating to religion are clearly prohibited? * If we truly have freedom of speech and the fed's respect that, just exactly who passed the CDA? * If we truly have freedom of speech and the fed's respect that, why is the fight for strong encryption being fought so hard? * If we truly have freedom of press AND the feds are the only agency per the Constitutio to regulate inter-state commerce then how can one state arrest citizens of another state when the 'crime' in state of the accussed isn't a crime? * Why has the federal government NEVER passed a law detailing the process we may use to petition the government for greivences? It clearly is not meant as a reference to the courts. ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Emergency File Wipe Algorithim
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Peter Gutmann writes in an article quoted by Christian Wettergren > The greater the amount of time that new data has existed in the > cell, the more the old stress is "diluted", and the less reliable > the information extraction will be. Generally, the rates of change > due to stress and relaxation are in the same order of magnitude. > Thus, a few microseconds of storing the opposite data to the ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ > currently stored value will have little effect on the oxide. ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Phill Hallam writes: > If the power is cycled as opposed to turned off only then a memory > self test program will probably erase the data. Assuming Peter Gutmann is correct, a memory test program "probably" won't do much. Of course, you data must be worth quite a pretty penny for an attacker to attempt to recover data from the oxides on the cells in your RAM. andrew

1 0

Re: Reproductive Rights and State Benefits (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 24 Aug 1997 00:11:52 -0500 (CDT) > From: Mac Norton <mnorton(a)cavern.uark.edu> > Subject: Re: Reproductive Rights and State Benefits (fwd) > On Sat, 23 Aug 1997, Jim Choate wrote: > > If accepted as fact this provides even less reason for the 14th. As it > > clearly does not prevent federal rights over-riding state rights. > > Jeez, it's too late to conduct Con Law Seminar 701, but focus > on "liberty" in the 14th Amendment as transfering the Bill Of > Rights, or most of it, to govern the states as well. OK? > Cause that's the SCt's view of it, and as I've said, it seems > to work reasonably well, reagardless of the chinks in the logic. Unfortunately neither does the 14th respect any right, only immunities and privileges (which clearly are not rights since they can both be revoked by the granting agency) but it doesn't work because it allows the feds to intrude in areas they were not meant to be involved in. The original Constitution already had a clause applying the Constitution and all laws derived from it to the states and preventing judges or other agencies from bypassing them. So, given that such extensions were already in place just what does the 14th do? ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: SUMMARY: Not-so-volatile volatile memory
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:54 AM 9/5/95, Anonymous wrote: >> -- Summary: Data retention in semiconductor memory -- >> >> Contrary to conventional wisdom, "volatile" semiconductor memory >> does not entirely lose its contents when power is removed. Both >> static (SRAM) and dynamic (DRAM) memory retain some information on >> the data stored in it while power was still applied. SRAM is >> particularly susceptible to this problem, as storing the same data >> in it over a long period of time has the effect of altering the >> preferred power-up state to the state which was stored when power >> was removed. Older SRAM chips could often "remember" the previously >> held state for several days. In fact, it is possible to manufacture >> SRAM's which always have a certain state on power-up, but which can >> be overwritten later on - a kind of "writeable ROM". > >Is this a new discovery? When I used to work with DOD classified >data, not so long ago, disk drives had to be declassified using an >approved program, such as Norton Utilities' "WIPEINFO". (That was >approved up through the SECRET/SAR level, anyway. I don't know >about TS/SCI/SI.) But those same regulations said that RAM was >considered declassified within a certain time (30 seconds, I think) >after power was removed. (That time figure was UNclassified, BTW.) >I think it was just to allow time for the voltage to bleed off of >the power supply's filter capacitors, and not related to the >relative volatility of DRAM. The Gutman article was discussing residual/remnant storage a lot more subtle than the usual "bleed-off" charateristics. One interesting twist is using radiation sources to "snapshot" or "freeze" the internal contents of dynamic RAM. I worked with DRAMs for more than a decade at Intel, though never on this particular issue. But I read a lot of the public papers on radiation effects on DRAMS, including the "freezing" of data patterns into DRAMs by exposure. (I recall thinking at the time, circa 1980, that someday raids on computers could involve bringing in flash radiation sources to "snapshot" the contents of DRAM.) Sandia Labs did a lot of the work on this, and results are reported at the annual Nuclear and Space Radiation Effects Conference. The December issue of "IEEE Transactions on Nuclear Science" every year includes the proceedings of this conference. Any large university library should have it. It's also possible to literally freeze a DRAM--with "Arctic Freeze" spray, for example--and stop the self-discharge of DRAM cells. I doubt any of these efforts are being used, though. Looking at how raided computers are simply carted off in the backs of pickup trucks, with disk drives thrown in with monitors, I suspect nothing this sophisticated has ever been tried. Quantico might have some more sophisticated approaches, but they're not publically discussing them. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Slightly faster checking for encrypted messages to me
by cman＠communities.com 17 Dec '03

17 Dec '03

Hal -- I've actually given this some thought in the past, and the most practical solution IMHO is much lower tech, although it only works on non-initial messages in a correspondence. If two entities want to communicate via a message pool, without worrying about traffic analysis, but don't want the overhead of trying to decrypt every headerless message to the pool, then they can do the following: 1) In a "headered" message, one of the entities (A) sends a collection of large random numbers to be used as return markers, encrypted with the public key of the desired correspondent (B). 2) B can then respond to A with an essentially headerless message prefixed with one of the numbers send by A. This initial message should contain a list of similar numbers for B, that A can use to send messages to B. 3) Numbers are only used once; entities can now quickly scan the message pool by hashing the initial N bits of each message into a lookup table seeded with all the remaining random return markers they've distributed. 4) As an extension, you can divide your message pools into "initial contact" pools, which would begin with headerless public key encrypted blocks, and "conversation" pools that would begin with return markers. (Of course this is trivially open to denial of service attacks.) This is the basic principal behind the TA-resistant streams over UDP stuff I wrote up for cypherpunks last spring, except in that case a given server does the lookup first, and only then tries to treat the header as a public key encrypted block instead of a MAC. The Rabin stuff is a step in the right direction for the long term, however.

1 0

Re: Reproductive Rights and State Benefits (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 24 Aug 1997 00:58:55 -0500 (CDT) > From: Mac Norton <mnorton(a)cavern.uark.edu> > Subject: Re: Reproductive Rights and State Benefits (fwd) > Well, quite a bit actually, as interpreted by the SCt. It makes > many, perhaps all, of the Bill of Rights prohibitions on Congress > applicable to state gov'ts as well. Art. VI, to which I think > you refer, does not do so of its own accord. * From the original Constitution: Section 1. Full Faith and Credit shall be given in each State to the public Acts, Records, and judicial Proceedings of every other State. And the Congress may by general Laws prescribe the Manner in which such Acts, Records and Proceedings shall be proved, and the Effect thereof. Section 2. The Citizens of each State shall be entitled to all Privileges and Immunities of Citizens in the several States. Section 4. The United States shall guarantee to every State in this Union a Republican Form of Government, and shall protect each of them against Invasion; and on Application of the Legislature, or of the Executive (when the Legislature cannot be convened) against domestic violence. This Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding. * The 14th: ARTICLE XIV. Section 1. All persons born or naturalized in the United States, and subject to the jurisdiction thereof, are citizens of the United States and of the State wherein they reside. No State shall make or enforce any law which shall abridge the privileges or immunities of citizens of the United States; nor shall any State deprive any person of life, liberty, or property, without due process of law; nor deny to any person within its jurisdiction the equal protection of the laws. Sections 2-5 deleted * Now please be so kind as to explain the following: - Where in the 14th does it mention the Bill of Rights or apply them to the states in such a manner that is not done in the original Constitution? - Why does the last section of the last item prior to my quote of the 14th not apply said Bill of Rights since it is clearly a part of the Constitution and worded much stronger than the 14th? - Why does section 2 above not apply considering it is copied practicaly word for word in the 14th and clearly equates the states under federal law? Especialy since the wording of section 2 is much stronger than the wording of the 14th? - Section 4 above clearly equates the states and a citizens expectation of equal protection under the law, how does the 14th extend this? - Section 1 does something even stronger than 'equal protection' as it forces recognition and support of each states laws by the other states even if a given state makes a law that makes an action in one state a crime in another, how does the 14th add anything to this? - Is your claim that the rulings of the SCt apply to citizens instead of being the final arbiter for government agencies? If so, how can this be considering that the SCt can't instigate any legal actions on its own but must act in a reactive manner? - And finaly, why should we as citizens accept the rulings of the SCt as the final word since we and not the federal government are the ones granting the power to govern? Add to this that Constitutionaly the role of the SCt is to limit Congress and not the citizenry. ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

A recent article on Electronic Commerce
by David Neal 17 Dec '03

17 Dec '03

In the August 28, 1995 issue of Communications Week, the editor Mitch Irsfield briefly discusses electronic checking, and the joint venture between Sun, BBN, IBM, et al. He also references an article explaining the venture on Page 5 of the same issue. I dropped him a quick note thanking him for writing a non-hysterical article on cryptography, and also briefly mentioned that some of us would prefer electronic cash to electronic checking. Since part of being a cypherpunk is political, I'd like to encourage everyone to write a quick e-mail which expresses your own views to Mr. Irsfield (678-7017(a)mcimail.com) Speaking of talking to the 'public' about crypto-cash, we really need a meme of our own. Just as The Other Side invokes the specters of terrorism and child pornography, we need something like 'traceable transactions', 'government approved checking', 'uncle sam's clearing house', or 'irs approved bill payments.' Obviously the creative types on the list can come up with much better. But, I digress. The Page 5 article doesn't go into much detail, but says in essence that the system is an api layer and a smart card. In the cases of larger corporations, they may require a seperate processor. This says 'encryption in hardware' to me. Gee, wonder if someone found a use for all those useless tessera cards after all? :-) David Neal <dneal(a)usis.com> - GNU Planet Aerospace 1-800-PLN-8-GNU Unix, Sybase and Networking consultant. "...you have a personal responsibility to be pro-active in the defense of your own civil liberties." - S. McCandlish

1 0

Re: VCRPLUS Huffman code
by bplib＠nic.wat.hookup.net 17 Dec '03

17 Dec '03

I too would be interested in the VCRPlus code. Has anyone broken it? Tim Philp

4 3

[trei@process.com: Re: VCRPLUS Huffman code]
by dr261＠cleveland.Freenet.Edu 17 Dec '03

17 Dec '03

================= Begin forwarded message ================= From: trei(a)process.com (Peter Trei) To: miniters(a)citadel.edu, cypherpunks(a)toad.com Subject: Re: VCRPLUS Huffman code Date: Tue, 05 Sep > Has anyone worked out the VCRPLUS code? It was partially broken a few years ago, and the results published in Cryptologia. I have a xerox in a carton somewhere. The break was for codes up to 4or 5 digits long, if I recall - this covers most of the major timeslots on the main stations. Longer codes cover odd timeslots on less popular stations. Code which implemented this partial crack was published on the net, and the VCR+ people got very upset about it - apparently they make money selling the codes to TV Guide and newspapers. It's protected as a trade secret, not a patent. It used a combination of lookup tables and Huffman codes, and included a certain amount of obfuscation to resist cracking. Peter Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com -- Tobin Fricke (aka LightRay) The Digital Forest BBS (714)586-6142 dr261(a)kanga.ins.cwru.edu KE6WHF Amateur Radio, 1:103/925 fido

1 0

Re: SSL trouble
by Peter Trei 17 Dec '03

17 Dec '03

> >I did a distributed scheme for something else that had two levels, a master > >and a group of slaves. Only the slaves talked to the master. For this > >effort I think a variation of the idea would be better. Have all of the > >brutes contact the master, who will, in the first transaction assign them > >to the next slave in a round-robin fashion. > Why not just have the brutes pick a slave at random? Of course, you need > to give them a complete list of slaves to choose from. But then the only > difference between the master and the slaves will be that the master > doesn't get any keyspace (it's got it all to begin with) and doesn't > report any results upward. This is starting to sound like alt.sex.bondage.... Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Re: response (fwd)
by Fred Sammet 17 Dec '03

17 Dec '03

[The following text is in the "iso-8859-1" character set] [Your display is set for the "US-ASCII" character set] [Some characters may be displayed incorrectly] >> What we need is for Fred to send to you a copy of the >> program in electronic form (I'm waiting for the too -- then I can >> highlight the important sessions for you. ANNOUNCING: The Second Annual . . . WORLDWIDE ELECTRONIC COMMERCE Law, Policy, Security & Controls Conference October 18-20, 1995 At the Hyatt Regency Bethesda Phone: (214) 516-4900 The Second Annual WorldWide Electronic Commerce; Law, Policy, Security and Controls conference is fast approaching. This important event will feature the world's foremost experts addressing the most important issues of implementation and control related to secure electronic commerce. It will focus on current problems and provide a foundation for dealing with the emerging problems that promise to make the future more complex. We have been fortunate in securing a faculty that is unusually qualified and internationally recognized who will share their experience, knowledge and theories on the wide range of issues being addressed by this program. We are equally pleased to have obtained affiliation for this conference of a number of prestigious and influentual organizations. Please join us and your colleagues at this unique event! Michael S. Baum, J.D., M.B.A. Conference Chair Provided in Affiliation with: ============================================= * American Bar Association Section of Science and Technology Information Security Committee * University of London Queen Mary & Westfield College Centre for Commercial Law Studies * EDI Association of the United Kingdom * Harvard Law School * Internation Union of Latin Notaries * International Chamber of Commerce, Paris * National Institute of Standards and Technology (NIST) * Software Publishers Association * United Nations Commission on International Trade Law (UNCITRAL) * U.S. Council of International Business ============================================= Keynote Speaker: ---------------- Dr. Vinton G. Cerf, Ph.D. Senior Vice President MCI Telecommunications Corp. CONFERENCE PROGRAM ...at a glance GENERAL SCHEDULE ------------------------------------------------- Wednesday, October 19, 1995 6:00pm - 7:30pm SECURE ELECTRONIC COMMERCE FOR THE BEGINNER Thursday, October 20, 1995 8:00am - 9:00am Welcome & Keynote Speech 9:00am - 5:50pm Sessions 1 - 5 Friday, October 21, 1995 8:00am - 4:50pm Sessions 6 - 10 ---------------------------------------------- TRACK - A AGREEMENTS, LEGISLATION, POLICY AND REGULATION ---------------------------------------------- Session 1 So Who's in Charge, Anyway? The Impact of National & Int'l Leadership & Initiatives in Secure EC SPEAKERS: Harold S Burman, Esq., Office of the Legal Advisor Sally Katzen, Office of Management and Budget Bruce McConnell, Office of Management & Budget Renaud Sorieul, Esq., UNCITRAL Session 2 Drafting Agreements for Secure Electronic Commerce SPEAKERS: Michael S Baum, Esq., Independent Monitoring Thomas J Smedinghoff, Esq., McBride Baker & Coles Joe Wackerman, Esq., United States Postal Service Session 3 Are Privacy Requirements Inhibiting Electronic Commerce? SPEAKERS: Kenneth C Bass III, Esq., Venable, Baetjer, Howard & Civiletti Prof. George Trubow, The John Marshall Law School Ian Walden, Ph.D., Commission of the European Communities Session 4 Alternative Methods of Signing: Legal Aspects of the IRS's July 1995 Regulation SPEAKERS: Tom Baker, Esq.,Internal Revenue Service Lynn Casimir, Esq., Internal Revenue Service Celia Gabrysh, Esq., Internal Revenue Service Session 5 Digital Signature Legislation and Electronic Commerce SPEAKERS: Alan Asay, Esq., Utah Department of Commerce Kirk W Dillard, Esq., State Senator, State of Illinois Dean Sutherland, State Senator, Washinton State William E. Wyrough, Jr., J.D., M.B.A., Florida Legislature Session 6 The Legal Status and Effect of Digital Signatures - Perspectives SPEAKERS: Prof. Mads Andersen, University of Copenhagen Mario Miccoli, International Union of Latin Notaries Session 7 On-Line Registration vs. In-Person Registration: What Satisfies Business and Legal Requirements? SPEAKERS: Phillip Hallam-Baker, Massachusetts Institute of Technology Jeff Treuhaft, Netscape Communications Corporation Peter Williams, Verisign Session 8 Antitrust in Electronic Commerce: Shopping, Payments & Certification Authorities SPEAKERS: Prof. Mads Andersen, University of Copenhagen John Greanley, Esq., US Department of Justice, Antitrust Division Session 9 Proving Secure Computer-Based Transactions: Evidence Revisited SPEAKERS: Margaret A Berger, Brooklyn Law School Charles Nesson, Harvard Law School Ian Walden, Ph.D., Commission of the European Communities Session 10 Third Party Service Providers & Certification Authorities-Can They Successfully Limit their Liabilty SPEAKERS: Bruce Hunter, Esq., General Electric Information Services Ellen Kirsh, Esq., America On Line Renaud Sorieul, Esq., UNCITRAL -------------------- TRACK - B INFORMATION SECURITY -------------------- Session 1 Requirements for Implementing Reasonable Security Procedures SPEAKERS: Robert Daniels, Esq., U.S. Social Security Administation Dain Gary, Morgan Stanley Allan M Shiffman, Terisa Systems, Inc. Session 2 Information Security Standards: Policy, Coordination & Interoperability SPEAKERS: Marty Ferris, US Department of Treasury Hoyt Kesterson II, Bull Worldwide Information Systems Peter Landrock, Ph.D., CRYPTOMATHIC David Solo, Bolt, Beranek and Newman Session 3 Who's Really on the Other End: Identification Technologies and Nonrepudiation SPEAKERS: Benjamin Miller, Personal Identification News John E Siedlarz, IriScan, Inc. William Sweet, National Semiconductor Session 4 Security and Security Policy in Internet-based Payments Systems SPEAKERS: Marty Ferris, US Department of Treasury Tim Jones, Mondex Anne Wallace, US Department of Treasury Session 5 When You Forget Your PIN or Die: Key Escrow in Secure Electronic Commerce SPEAKERS: Prof. Michael Froomkin, University of Miami School of Law Jeff Greiveldinger, US Department of Justice, Criminal Div. Frank W Sudia, Bankers Trust Company Session 6 Comparing Critical Cryptographic Algorithms, Protocols, and Standards to Enable Secure Electronic Commerce SPEAKERS: Peter Landrock, Ph.D., CRYPTOMATHIC Ron Rivest, Massachusetts Institute of Technology Miles E Smid, National Institute of Standards & Tech. Session 7 Export Controls & Transborder Data Flows: Is Secure Electronic Commerce in Jeopardy? SPEAKERS: James Bidzos, RSA Data Security Renee H Danckwerth, Export Consultant Session 8 'Certificates-R-US': Trust Models and the Developing Secure Information Infrastructure SPEAKERS: Warwick Ford, Bell-Northern Research Sead Muftic, COST Computer Security Technologies Peter Williams, Verisign Session 9 Professional Accreditation and Certification - The New Frontier in 'Remote Trust' SPEAKERS: Richard C Koenig, Int'l Info. Sys. Security Cert. Consort. Alan M Schwartz, Esq., American Bar Association Session 10 Looking into the Crystal Ball: Certificates Revisited SPEAKERS: Web Augustine, VeriSign, Inc. Warwick Ford, Bell-Northern Research Hoyt Kesterson II, Bull Worldwide Information Systems ------------------------------------------- TRACK - C LEGAL ASPECTS OF SECURE ELECTRONIC COMMERCE ------------------------------------------- Session 1 Do Criminal Laws Really Protect Electronic Commerce? SPEAKERS: Scott Charney, Esq., US Department of Justice William J Cook, Brinks, et al. Richard A Ress, Federal Bureau of Investigation Session 2 Who Owns the Information, Standards, Certificates and Cryptographic Keys? SPEAKERS: Peter Harter, National Public Telecomputing Network David W Maher, Esq., Sonnenschein Nath & Rosenthal James Powers, Esq., Shulman, Rogers et. al Session 3 Consumers on the Net - Fairness, Conspicuousness, Notice, and Reliance SPEAKERS: Nessa Eileen Feddis, Esq., Government Relations/Retail Banking Ray Nimmer, Esq., Weil, Gotshal & Manges Session 4 Electronic Licensing and Distribution of Digital Content: Downloading for Liability? SPEAKERS: James C McKay, Jr., Office of the Corporation Counsel, D.C. Thomas J Smedinghoff, Esq., McBride Baker & Coles Mark Traphagen, Software Publishers Association. Session 5 Insuring Electronic Commerce Transactions and Infrastructure SPEAKERS: Andrew Cockrane, Alexander & Alexander Norman R Nelson, New York Clearing House Association Session 6 Auditing a Third Party/Value Added Network or Certification Authority (and Its Implications) SPEAKERS: Charles H LeGrand, CIA, Institute of Internal Auditors John Stelzer, COMMERCE:Institute Session 7 Electronic Recordkeeping - What to Save, When and How to Save It, and for How Long SPEAKERS: Lynn Casimir, Esq., Internal Revenue Service Celia Gabrysh, Esq., Internal Revenue Service Claude Perreault, Chambre des notaires du Quebec Session 8 Disaster and Contingency Planning Services: What is Needed for EC and Certification Authorities SPEAKERS: Dain Gary, Morgan Stanley Ake Nilson, Marinade Limited Helena Roine-Taylor, The Finnish Data Communication Assoc. FINPRO David Solo, Bolt, Beranek and Newman Session 9 General Counsel's Forum on Computer-Based Trade SPEAKERS: Robert W Barger, Esq., AT&T Bruce Hunter, Esq., General Electric Information Services Ellen Kirsh, Esq., America On Line Session 10 An Audit Model for Your Electronic Commerce Infrastructure SPEAKERS: Gerald R Bielfeldt, NationsBank Phillip Oddo, Ciba-Geigy Horton Sorkin, Ph.D., Howard University ------------------------------ TRACK - D INFRASTRUCTURAL CONSIDERATIONS ------------------------------ Session 1 Securely Shopping on the Web: New Paradigms, Protocols and Opportunities SPEAKERS: Jeff Hilt, VISA International Todd Ostrander, Egghead Software Session 2 What can Trusted Third Parties and Certification Authorities Learn from the Financial Clearinghouses SPEAKERS: Carol Barrett, Federal Reserve Bank of New York Bill Nelson, National Automated Clearinghouse Associa Norman R Nelson, New York Clearing House Association Session 3 Electronically 'Gluing' Computer-based Records SPEAKERS: Phillip Hallam-Baker, Massachusetts Institute of Technology Allan M Shiffman, Terisa Systems, Inc. Session 4 Global Registries for Secure Electronic Commerce SPEAKERS: Jonathan Allen, Barum Computer Consultants Michel Peereman, Federation Nationale des Chambres Peter Robinson, US Council for International Business Session 5 Computer-based Negotiability: What is Needed to Make it Work SPEAKERS: Harold S Burman, Esq., Office of the Legal Advisor James E Byrne, James Mason University Law School Ake Nilson, Marinade Limited Session 6 Time/Date Stamping of Digital Information: Necessities & Options SPEAKERS: Richard Rothwell, United States Postal Service Scott Stornetta, Surety Technologies, Inc. Session 7 Will Healthcare-related Electronic Commerce Require Special Controls and Secure Infrastructures? SPEAKERS: Kathleen Frawley, J.D., M.S., R.R.A, AHIMA Daniel J O'Shea, National Computer Claims Service Session 8 The Role of Notaries in Securing Computer-Based Commerce: the CyberNotary(sm) SPEAKERS: Theodore S Barassi, Esq., US Council for International Business Mario Miccoli, International Union of Latin Notaries Session 9 Electronic Cash and Novel Electronic Commerce Payments Systems SPEAKERS: Nessa Eileen Feddis, Esq., Government Relations/Retail Banking Ron Rivest, Massachusetts Institute of Technology Marvin Sirbu, Carnegie-Mellon University Session 10 Why does Everyone Want to be a Trusted Third Party/Certification Authority (at Least Initially)? SPEAKERS: Sead Muftic, COST Computer Security Technologies Stratton D Sclavos, VeriSign, Inc. ----------------------------------------------------------------- TO REGISTER: ------------- Price: $550.00 (U.S.) Name: Title: First Name for Badge: Company/Organization: Address: City/State/Prov/Zip/Postal code: Country: Telephone: Fax: E-Mail: Check One: ========== [ ] I am Mailing a check in the amount of $______ [ ] I wish to charge this to a credit card (fax or mail only) [ ] American Express [ ] Visa [ ] MasterCard Card Number: Expiration Date: Name on Card: Signature (fax or mail): ----------------------------------------------------------------- HOTEL RESERVATIONS: A special conference rate of $129 has been arranged for our attendees. To make arrangements, please call the Hyatt Regency Bethesda at (301) 657-1234 Hyatt Regency Bethesda One Bethesda Metro Center Bethesda, MD 20814 ----------------------------------------------------------------- For more information or a complete program brochure and schedule, contact the conference coordinators as shown below: HOW TO CONTACT US ================= E-Mail: wec(a)multicorp.com Phone: (214) 516-4900 Fax: (214) 424-0562 Mail: Worldwide Electronic Commerce PO Box 743485 Dallas, TX 75374 ===============================================

1 0

Re: lack of evolutionary pressures
by Blanc 17 Dec '03

17 Dec '03

Tim May wrote: >(And not even the infamous "But what if _all_ smart and educated people >thought this way?" applies. First, what Adam or Tim or Blanc does about >having children will not affect the decisions of others. [...] ........................................................... I look up, startled - what; me, worry? <g> There are actually quite a lot of "determining factors" which do not affect the decisions of others. For instance, the Constitution of the U.S., or good genes from one's ancestors. A lot of people read, but do not appreciate the meaning of, the Constitution. Too many depend upon it to determine the choices on what is right or wrong about government activity, without considering the reasoning behind the document or without applying their own reasoning to its meaning. Humans are pretty complicated, fragile creatures and there are many things which will affect our success or lifespan; unforseen elements can overwhelm ones's biological system (like an AID virus) or one's circumstance, (like encounters with Nature - unexpected floods, forest fires, tornadoes, etc.). Many things which we do to ourselves will weaken us - taking drugs, malnourishment, incorrect responses to events which challenge our psychological makeup, etc. These discussions on evolutionary pressures, genomes, the intelligence passed on through genes, all reference things which have been given to one, given in the past, given to a passive creature at a time when they exercise no influence in their own existence (i.e., at the time of conception). There is a factor being left out of these discussions as if it didn't exist or had no influence, and that is the particular individual who is in the act of living their given Life. That person must maintain a rightful state of mind which can understand the requirements of their own existence. Although people may receive benefits of all kinds, they may yet fail to live a successful life: some people grow up in rich families and end up drug addicts living in the street. Many people are super intelligent (at least in school) but seem to have no wisdom of judgement, making very unwise decisions which affect their success (the latest big-name killer Cunnanan comes to mind. He was credited for being brilliant; he took drugs and this influenced his mental state, but that in itself was an unwise, self-defeating thing to do). A person's decisions, their self-advancing or self-defeating responses to life's exigencies, also determine the direction & quality of a their life, not only what they have been given by others. One thing which can't be passed on very well (yet) is the *desire* to live on a certain plane of "intelligent" life, once one has it. (And who appreciates so well the struggle to stay on such a high level plane? Sometimes there's a lot of "pressure" to evolve in the future, but not much empathy with efforts in the present.) .. Blanc

1 0

Re: Acceptable NIS&T restrictions
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 17:20 9/4/95, Bill Stewart wrote: [...] >For Commercial Key Escrow, or commercial key-backup services, the criteria are >"whoever can be trusted to provide the services the customers want". >In this case, of course, the service most customers want is to be left alone, >or, failing that, to have the government's Master Key system provide minimal >risk >to the security of the actual transactions - 64 bit keys are not enough >security >for any high-valued financial transactions, though they may suffice for >credit cards. >One required characteristic would appear to be either sufficiently deep pockets >to collect judgements for violations of trust or a sufficiently high >reputation that >violations of trust are not expected. I seems obvious to me that prospective key escrow agents would be exempt from all liability for damages caused by releasing a key, exept in cases of gross negligence. Gross negligence being defined as giving a key to a person who explicitly states that they intend to use it for illegal purposes. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Forgery, bills, and the Four Horsemen (Articles and Comment)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:44 9/4/95, Black Unicorn wrote: [...] >3. The corruption of e-cash to further the above. > >If the government is disturbed by the laundering of money enough >to actually print, or even propose printing, two kinds of >currency, how will they respond to untraceable, unaccountable and >infinitely liquid e-cash? I think the answer is in past behavior: >e-cash will be linked to the four horsemen and subjected to >rigorous reporting requirements- systems which are true e-cash >will be banned. This is unnecessary, since there is no "true" ecash. DigiCash's ecash in its current form, the only version David Chaum is willing to licenese, is fully traceable. Popular Cypherpunk's myths nonwithstanding. First, the recipient of funds is non-anonymous by design. Second, any payer can trivialy make the recipient of a ecash note known by revealing the blinding factor. For purposed of lawenforcement, DigiCash's ecash in no more secure than if the (insert horseman here) billed his fees to a credit card. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2

Stealth Helicopters
by Anonymous 17 Dec '03

17 Dec '03

Anonymous wrote: > > There is no conspiracy by a secret government to destroy > > the Constitution, enslave the people, and rule the world. > > "Like them new Stealth Helicopters, equipped with devices to drown out > the sound." I was watching a 'crop' in Humbold County, CA, in the early 80's and was standing near the top of a hill one day when I heard a slight "whoosh, whoosh" for about three seconds before a helicopter came over the hill, scaring the living shit out of me. I imagine that in the 15 or so years since then, the govt has managed to make them invisible, as well. The Campaign Against Marijuana Production (CAMP) was interesting, with the Federal government supplying the toys, and the heavily armed troops consisting of 'volunteers' from various agencies and LEA's. At the time, I wondered if one of the purposes of CAMP was to enable local law enforcement personnel from around the nation to do 'male bonding' with Big Brother. Now I believe that history has proven me correct. A varitey of other Federal policies, laws and regulations also seem aimed at drawing local and regional LEA's into Big Brother's spreading web. The confiscation of drug-related assets, for instance, allows the LEA's in Louisianna to confiscate the vehicles of a multitude of out-of-state visitors under the slimmest of pretexes. The Feds have basically put local LEA's in their back pocket by letting them play with their hi-tech toys and sharing the spoils of the War Against the Citizens. One of the people who have had their vehicle wrongfully seized under the drug-related confiscations laws received the car as a gift. Now the IRS is still demanding that he pay a 'gift tax' on the vehicle, even though he only had it for a few days. The increasing cooperation between Federal, State and local LEA's has brought a whole new meaning to the words, "The line forms to the rear." DisgustedMonger

1 0

Re: Wearing RSA shirt to school
by Ian Goldberg 17 Dec '03

17 Dec '03

OK, I'm confused. Is it or is it not legal to disclose cryptology to a foreigner? T.C.May (I think it was; sorry if I misremember this) posted a couple of days ago that it _was_ legal (citing that textbooks are not stopped from being published internationally). Perhaps this is just because the publishers of these texts never applied for an export license (maybe)? I was reading Bernstein vs. US Dept. of State, et al. (http://pgp.ai.mit.edu/~bal/legal/complaint-950221.html) and found this: G. RESULT OF DEFENDANTS' REJECTION OF PLAINTIFF'S CJ REQUEST 71. Plaintiff's scientific paper, algorithm and computer program are speech protected by the First Amendment to the United States Constitution. Thus, by rejecting Plaintiff's CJ Request, Defendants have determined that these items are "defense articles or defense services" which may not be exported without submitting to the above-described prior restraints. Since Defendants define "export" to include disclosing or transferring cryptology to a foreign person anywhere in the world, including within the United States, Plaintiff is informed and believes and therefore alleges that he is required by law to obtain a license to publish or publicly discuss any of the Items whether within or outside the United States. 72. Plaintiff is presently unable to publish his scientific paper, algorithm or computer program within or outside the United States. The only reason preventing publication is the threat of prosecution for an illegal export if he does so without a license. 73. To this date, Plaintiff has not received a response to his appeal or a license to publish his paper, algorithm, or computer program and as a result, he has not published the Items. So it seems to me (at least according to the Plaintiff (EFF, I guess)), that the ITAR regulations _do_ restrict publication and public discussion of cryptology. - Ian "and why is Canada considered part of the US for this?"

1 0