December 2003 - cypherpunks-legacy

Re: Simple Hardware RNG Idea
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 8:20 PM 10/5/95, Simon Spero wrote: >On Thu, 5 Oct 1995, Norman Hardy wrote: .... >> You presumably use the oddness of the count for your random bit in some >> predetermined time interval. External radiation can change, but not bias >> the parity. If the counter saturates, the counter may be biased towards one > >Hmmm. But isn't this method slightly biased? If the probability of N >events < the probability of N+1 events, wouldn't you need a large number >of events per bit to make the bias insignificant? .... What you really need is entropy (information). I propose concatenating several counts and sending them thru MD5. The counts are distributed the same way but are independent so that the entropy of the concatenation is the sum of the entropies. Each count has a Poisson distribution. That tells you how many bits of entropy there are in the input to the MD5. Take that many bits, rounded down, as your random bits. If there are an average of x bits in a time interval then the probability that the count will be exactly K is (x^K/(K!))exp(-x). That is the Poisson distribution. The entropy is then: - sum[i=0 to infinity] (x^K/(K!))exp(-x)log( (x^K/(K!))exp(-x)) = - sum[i=0 to infinity] (x^K/(K!))exp(-x)(log(x^K/(K!)) - x) = - sum[i=0 to infinity] (x^K/(K!))exp(-x)(K*log(x) - log(K!) - x) Here is a klutzy Scheme program to evaluate these: (define (sum g)(letrec ((ss (lambda (n) (if (= n 0) (g 0) (+ (g n) (ss (- n 1))))))) (ss 30))) (define (log2 x)(/ (log x)(log 2))) (define (fact n)(if (= n 0) 1 (* n (fact (- n 1))))) (define (p x k) (* (/ (expt x k)(fact k))(exp (- x)))) (define (en n)(sum (lambda(x) (let ((c (p x n))) (if (= c 0) 0 (* c (log2 c))))))) (en 1) => 2.07 (en 3) => 2.92 (en 10) => 3.73 (en 15) => 4.0 I.e. if 1 count is expected on average there are two bits of entropy in the count (supprising!) and if the count averages 10 then there are 3.7 bits worth. It goes up as the log. Before you bet your enterprise on this scheme consider that the math was done at 03:30 AM.

1 0

Re: subjective names and MITM
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:24 PM 10/5/95 -0400, Adam Shostack <adam(a)homeport.org> wrote: > The key does indeed have a high likelihood of being unique, >but dealing with 1024 bit identifiers could strain database systems, >especially when 100 well chosen bits would be than enough. If everybody in the world has a 1024-bit key, that's 750 GB; that's not bad at all by the time everybody in the world would have one, and you could do MD5s in about 100 GB, which is a little more convenient. Today, for 750 GB, you'd probably have tape in your system, or optical jukebox. But not everybody has one; on the other hand, I suppose individuals in well-heeled countries might end up with dozens of their own. On the other hand, the number of 1024-bit primes is something like 2^1023/log(2^1024) (if I remember right), or roughly 2^1013. The probability of two independent uniformly distributed primes matching is about 2^1023/2^32, which is still an astoundingly mindbogglingly LARGE number. If you've got 1024 bits of entropy in your input process, there will not _be_ any matches. (If people insist on using sources of randomness like clocks or user names, the chances are a lot higher....) Now, for 128-bit hashes, whether it's MD5 or just the near-bottom 128 key bits, by the time you get 2^64 of them together, you've got a 50% chance of a match. Not a problem, since you'll not likely need that many, even for the 2^33 people in the world. Still not a problem. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: FORGED CANCELS of posts on n.a.n-a.m
by Erik E. Fair 17 Dec '03

17 Dec '03

An NNTP v2 protocol specification effort is underway in the IETF now. Strictly to clean up existing extended practice - not to do new things. Erik Fair

1 0

PCMCIA Crypto
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

PCMCIA Establishes Security Card Working Group The dream of a standardized encryption interface may soon be realized! San Jose, Calif., Oct. 5 /PRNewswire/ -- PCMCIA has formed a new Working Group dedicated to standardizing and promoting the PC Card as an interface for data encryption and digital signature applications. The Working Group was formed to work within the PCMCIA Technical Committee to help the Association define and standardize the capabilities and requirements for PC Card Security Card devices. The Group's immediate goals are to define the necessary extensions to the PC Card Standard that will allow easy identification of Security Card devices, and to proactively identify other vendors in the market and solicit their support for standardizing PC Cards as a security device. The formation of this Group represents the formalization of an industry trend. A standardized form factor and interface for security devices is finally an attainable goal thanks to the widespread acceptance of PC Card technology," said Gary Visser, a senior software engineer with Spyrus Communications and Co-Chairperson of the Working Group. "It is this high level of host support that will promote PC Cards as a solution for electronic banking and commerce." PC Cards are seen by many experts as an ideal solution for digital signature and data encryption applications due to the established base of PC Card slots, and because most security applications are math intensive and require the processing power and storage of computers. The proposal to form the Group was presented to PCMCIA by Spyrus, Inc. of San Jose, California. The group will be co-chaired by Edward Tuggle of IBM Corporation and Visser of Spyrus, Inc. Visit PCMCIA's World Wide Web site at <http://www.pc-card.com>. Contact: Greg Barr, Public Relations Coordinator, of PCMCIA, 408-433-2273, ext. 114, or <gbarr(a)pcmcia.org>.

2 1

FON_tap
by John Young 17 Dec '03

17 Dec '03

10-6-95. WSJaper has a report on the global rise of unions between banks and telcos for exploiting electronic marketecture. Quotes: "Being in partnership with these phone people is like shooting adrenalin into your veins," gushes one banker who recently invested in the national phone company. "Bricks and mortar won't do it," says another banker, "you have to drive down the transaction cost." FON_tap

1 0

Trust company banks on Internet
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 6 Oct 95 08:10:41 -0400 From: "GORD JENKINS" <jenkins(a)fox.nstn.ca> X-Minuet-Version: Minuet1.0_Beta_14.1 Reply-To: <JENKINS(a)fox.nstn.ca> X-Popmail-Charset: English To: www-buyinfo(a)allegra.att.com Subject: Trust company banks on Internet First Internet Banker ?? !! Check out http://www.bayshore.com >From the Toronto Globe and Mail page B 1 Fri 6 Oct 95 "Bayshore set to become first Internet banker - Trust promises approval in as little as two minutes" >From the Ottawa Citizen Page B7 Fri 6 Oct 95 " Trust company banks on Internet -Financial shopping in cyberspace arrives in Canada next week with the first intractive banking sevice on the Internet. Analysts say there is a lot more coming soon. Bayshore Trust Co.plans to take applcations for loans up to $15,000 and orders for guaranteed investment certificates directly from customers on the World Wide Web" Gordon Jenkins jenkins(a)fox.nstn.ca http://www.infop.com/karoma -- GORD JENKINS e maik JENKINS(a)fox.nstn.ca tel 613 794 6735 fax 613 723 8938 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re:Trust company banks on Internet
by schampeo＠imonics.com 17 Dec '03

17 Dec '03

Robert Hettinga forwards: >First Internet Banker ?? !! > >Check out >http://www.bayshore.com > >>From the Toronto Globe and Mail page B 1 > Fri 6 Oct 95 >"Bayshore set to become first Internet banker - >Trust promises approval in as little as two minutes" This is fairly common. A certain Internet Consultant in this area claimed to have solved "the problem of banking on the Internet". Of course, a large green bank paid him a lot of money to say it, but there you are. I closed my account with that large green bank because of this appalling turn of events. I should tell everyone here and now that I also intend to become the first Internet bank. I would also like to announce my upcoming trip to the moons of Mars, where I intend to pick collards in the name of Abbie Hoffman. What an extended crock of shit we can hope to expect... Steve -- Steven Champeon (919) 469-7833 Technical Lead, schampeo(a)imonics.com Imonics Web Services webmaster(a)imonics.com

1 0

Re: NSA Realists v. Nuts (Was: Re: Crypto APIs)
by James A. Donald 17 Dec '03

17 Dec '03

At 05:02 PM 10/5/95 -0400, Perry E. Metzger wrote: > >"James A. Donald" writes: > > They want to rule over us. [...] There is no commonality of > > purpose, hence no possibility of cooperation. At 05:02 PM 10/5/95 -0400, Perry E. Metzger wrote: > I disagree. Most NSA types are probably stock government employees > who want to get their job done with the least muss and fuss. > > [...] > > I don't think the NSA is inherently the enemy at all. Signals > intelligence and protecting the U.S. and its citizens from signals > intelligence is probably necessary. Naturally members of an organization wish the organization to become great and powerful: A great and powerful Netscape would be a Microsoft. A great and powerful NSA would be a KGB or an SS. Naturally everyone likes their job to meaningful, everyone likes their job to have an impact. Everyone wants to be important. If the NSA are eyes without hands, they are impotent, they are useless. So they want hands. They want information about us to be used by the government, which means they want the government to exercise detailed control over us in response to their detailed information about us. Our function lust would, if fulfilled, give us only moderate satisfaction, their function lust, if fulfilled, would give them vast power, and hence vast satisfaction. Our function lust, if fullfilled, would give us more power over computers. Their function lust, if fullfilled, would give them more power over us. > However, in general, what you are looking at is just the > result of an entity trying to preserve itself having access to > governmental force. I doubt that there are many "national domination" > types in the agency, Despite grandstanding by the republicans, no government agency has ever been closed down, or suffered layoffs, merely because its function became completely obsolete. (Though some have suffered renamings and reshuffles, and some have been allowed to shrink through natural attrition) The guys who used to control prices in the trucking industry now work full time regulating each other. (I kid you not) We are still stockpiling helium to lift a fleet of dirigibles for world war one. (Like Dave Barry, I am not making this up, though the Republicans have planned to close down the helium agency.) Job preservation is irrelevant: They are government employees. Power is the issue. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Where is text of wiretap bill
by James A. Donald 17 Dec '03

17 Dec '03

Did the wiretap bill, as passed, contain those magic words: "or other legal authority"? Where can I get the text of the wiretap bill? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

3 3

Supercomputer export ease
by Rich Salz 17 Dec '03

17 Dec '03

According to a squib in the local tabloid: Clinton has approved a plan to ease export restrictions on the sale of supercomputers. The decision is expected to be announced today; it follows DoD recommendations. The wording is funky enough to be interpreted a couple of ways, so here's a quote: "Under the revised policy, U.S.firms will be able to sell billions of dollars worth of high-tech computers to civilian customers around the world. Currently manufacturers must seek licenses from the Commerce Dept. to sell a computer that can perform more than 1,500 million theoretical operations per second." Does that mean no more licenses, the mFLOP limit has been raised before license required, there is no limit but you still need a license? Answers today/tomorrow when the policy comes out, I guess. /r$

2 1

Supercomputer export ease
by John Young 17 Dec '03

17 Dec '03

WSJ, Oct 6, 1995. U.S. Export Rules to Ease On Some Supercomputers Washington -- President Clinton is expected to announce today that he is easing export restrictions on certain U.S. supercomputers, a move sought by the computer industry. Administration officials say that given continuing technological advances and world-wide availability of many high-speed computers, the current restrictions are unrealistic and damaging to American companies. Critics contend, however, that easing the restrictions will exacerbate weapons proliferation. Mr. Clinton approved raising the speed of computers that may be exported to most countries to 2,000 million theoretical operations a second, or MTOPS, from 1,500 MTOPS, according to officials. For certain nations, including China, Egypt, Israel, India, Pakistan, Syria and Russia, civilian customers would be able to buy computers with speeds up to 7,000 MTOPS without prior government approval. Military customers in those countries could purchase computers with speeds of 2,000 to 7,000 MTOPS but only with an individual export license. Certain nations, such as Iran, Iraq, North Korea and Libya, would still be banned from buying high-speed computers. [End]

1 0

Graphic encryption
by privsoft＠ix.netcom.com 17 Dec '03

17 Dec '03

I am currently working for a company that has a graphic encryption product called PrivaSoft. I was wondering if there were other products or engines that also provide graphic encryption. (graphic encryption is the use of a encryption algorythm to scramble an image taken of a document.) Also if any of ya'll are famillar with graphic encryption, I am looking for opinions as to its strengths / weaknesses. Steve O. Mgr. Tech. Services ************************************************* PrivaSoft TM * 1877 Springfield Ave PO BOX 600 * Maplewood NJ 07040-0600 * Tel. 201-378-8865 Fax. 201-762-3742 * Http://www.privasoft.com/privasoft * E-mail: privsoft(a)ix.netcom.com * *************************************************

2 1

Re: Graphic encryption
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> I am currently working for a company that has a graphic encryption > product called PrivaSoft. I was wondering if there were other products > or engines that also provide graphic encryption. (graphic encryption is > the use of a encryption algorythm to scramble an image taken of a > document.) Is there anything particular in graphic encryption? I usually encrypt graphics and document images as regular files with regular encryption... Hadmut

1 0

Re: subjective names and MITM
by jbaber＠mi.leeds.ac.uk 17 Dec '03

17 Dec '03

This discussion can be divided into two separate situations. The first of which is exemplified perfectly by Hal: hfinney(a)shell.portal.com writes: >m5(a)dev.tivoli.com (Mike McNally) writes: > >hfinney(a)shell.portal.com writes: > > > This situation with the MITM is actually about the same as if you were > > > communicating insecurely in the first place. You are exposed to all of > > > the same risks. > >The only way to achieve the level of security offered by physical face > >to face communication with a person is to have a physical face to face > >conversation at some point. If you only ever communicate via > >electronic means, you are always subject to the risk of dealing with a > >synthetic entity. (I think.) >I don't think so, or at least the risk can be minimized much more than in >the model where we just say that we're communicating with keys, therefore >a MITM is perfectly legitimate because it's just a matter of who holds >the keys. Suppose I want to talk to PC Magazine columnist John Dvorak. >Suppose I find a VeriSign certificate for his key, with his name and >employment information. I've never met him. We've never had a face to >face conversation. Yet I claim I can communicate with considerable >security with Dvorak using this certificate, certainly more than if I >just use any old key which is lying around with his name on it, one which >may be owned by a MITM. Here the wish is to communicate with a 'real' person. A person that actually exists and has an in-built reputation that is separate from his key. This is very much a real life situation and is very similar to the first time that you meet someone - it is very hard to know that someone is who they say that they are, few people ask for ID and even ID is possible to fake (an old key that is actually owned by a MITM). In this case the person is known (of) and not the key - therefore it makes sense to attempt to ensure that the link between the key and the person is a strong (trustworthy) as possible. However this is not the case in the second situation: I could say that know that I enjoy reading mail from some people on the list, that I agree with some people on the list or that some people on the list hold very strong opinions on certain subjects. However this would not be correct as I have not met anyone else on the list in person (we do not all live in the US). It would be more correct to say that I enjoy reading mail from some addresses on the list (etc.) - I have no real idea whether hfinney(a)shell.portal.com is Hal or actually Tim expressing different views. If I mail Hal therefore I am actually mailing the entity that sends mail to the list from that address and I would do so being pretty sure that I was communicating with the person who mails here - but I would have no idea whether he is actually male, female, blond, brunette etc apart from what I chose to believe from others. Now mail is far easier to fake/intercept than a digital signature/encryption - at least I hope so. Therefore if Hal where to sign all of his messages I could check the signatures with a public key obtained from anywhere at all and if they passed then I could be confident that the messages were all written by the entity with control of the secret part of the key - at least far more confident than I am at all of the mail from hfinney(a)shell.portal.com actually comes from there. So instead of me getting the idea that hfinney(a)shell.portal.com posts interesting messages I get the idea that the holder of the secret key posts interesting messages - I would probably still use the mail address as keys are less convenient with current mail readers but that is an implementation problem. Hals reputation is therefore transfered to they key - no matter where I got the key from. So if I send encrypted mail to the person with the private part of Hal's key I can be sure that it can only be read by the person who actually sent the messages pertaining to be from Hal. So the MITM problem is 'defined away' in the case where a reputation grows with a key but is still a major problem where you want to transfer a ready made reputation to a key (as in the first example). In effect the key becomes a pseudonym and you can be sure of communicating with the pseudonym safely but can not be sure of anything about the pseudonum that you have not experienced yourself without trusting someone else (VeriSign in the first example). Thus the problem is more reputation transfer than anything else. Jon C. Baber jbaber(a)mi.leeds.ac.uk http://www.chem.surrey.ac.uk:80/~ch02jb/

3 3

Re: Graphic encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199510061517.IAA10725(a)ix5.ix.netcom.com>, privsoft(a)ix.netcom.com (Steve ) wrote: > I am currently working for a company that has a graphic encryption > product called PrivaSoft. I was wondering if there were other products > or engines that also provide graphic encryption. (graphic encryption is > the use of a encryption algorythm to scramble an image taken of a > document.) > > Also if any of ya'll are famillar with graphic encryption, I am looking > for opinions as to its strengths / weaknesses. The description you give us is meaningless. The strengh of an encryption alogirithm must depend only on the algorithim and key used, not on the data (in your case graphics) being encrypted. It is utterly irrelevant _what_ is being encrypted, all that matters is _how_ it is being encrypted. Send us the algorithm and source code and we'll take a look at it. And by the way, "proprietary" algorithms are generally junk and should not be relied upon by security concious individuals and businesses. Only algorithms that have undergone extensive peer review should be considered for use. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHVT7yoZzwIn1bdtAQEUOgGAnyOPIjo4D18AUDNDzXAcqRLXO7vcaRiw ode3TBA5gLm1FaGPSEk5y5g3VKiVS6ai =bV6Z -----END PGP SIGNATURE-----

1 0

National Secuirty Science and Technology Strategy
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

This excerpt is from the summary of a long policy statement on the National Security Science and Technology Strategy published by the White House on September 19. The full report is well worth reading -- it addresses military, economic, intelligence, scientific and technological issues and lays out projected initiatives. Has anyone seen news reports on this? ----- >From URL: http://www.whitehouse.gov/White_House/EOP/OSTP/ nssts/html/execsum-plain.html Executive Summary _______________________________________________________ In March 1995, President Clinton ordered a sweeping reexamination of the United States Government's approach to putting science and technology to the service of national security and global stability in light of the changed security environment, increasing global economic competition, and growing budgetary pressures. This National Security Science and Technology Strategy, the product of that reexamination, is the country's first comprehensive Presidential statement of national security science and technology priorities. It augments the President's National Security Strategy of Engagement and Enlargement by articulating science and technology policies and initiatives that support the President's three primary national security objectives: enhancing our military readiness and capabilities, preventing conflict from occurring through engagement with other nations, and promoting prosperity at home. It advances that document's central approach of preventing conflict and maintaining the capability to respond should conflict occur. It is built on the recognition that our security depends on economic strength as well as military power. And it is grounded in the conviction that investment in science and technology is central to our ability to meet the challenges ahead. This National Security Science and Technology Strategy defines our new approaches to applying science and technology to the challenges that most directly affect our nation's security. [snip balance of summary]

1 0

Re: Graphic encryption
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Fri, 6 Oct 1995, Lucky Green wrote: >And by the way, "proprietary" algorithms are generally junk and should not >be relied upon by security concious individuals and businesses. Only >algorithms that have undergone extensive peer review should be considered >for use. It's OK, when these guys were spamming Usenet a few weeks ago with their product announcement (admittedly, they did at least keep it to comp groups) they said it was export-approved. Therefore, it can be pretty much written off from a security standpoint - it's at best as good as 40-bit RC4, and I sure wouldn't use that for secure communications. I'd still like to know how it works so we can see just how insecure it is, though. Mark

1 0

Open Market, Inc. Announcing security products
by Harry S. Hawk 17 Dec '03

17 Dec '03

Open Market, Inc. Is announcing "free software and services that will help hundreds of Internet-based businesses and millions of users protect themselves from potential security breaches." I don't know any more info.. I'll send more when available. -- Harry Hawk Manager of Computer Services Warwick Baker & Fiore 212 941 4438 habs(a)warwick.com

1 0

Open Market (more info)
by Harry S. Hawk 17 Dec '03

17 Dec '03

Basically they are going to set up a web site to act as a clearing house for security related breaches. On particular thing they will do is: 1) Hosting a web site where a user with any broswer can find out if their browser is secure. List security problems associated with that browser. "basically a self diagnostic center" That will be done by tues. -- Harry Hawk

1 0

Re: subjective names and MITM
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > A public key *is* "very probably unique". A "randomly selected" 1024 bit > prime number has a specific amount of entropy in it. The likelihood of > two users world wide "randomly" choosing the same such prime may be > precisely determined (assuming you can figure the entropy). > Given the difficulty of finding primes, how likely do you think it is that given one of the well known methods and finding the first 1024 bit prime that pops out would give you an effective attack? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

2 1

Re: Graphic encryption
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> Is there anything particular in graphic encryption? I usually > encrypt graphics and document images as regular files with regular > encryption... I believe graphic encryption outputs a valid image file that is apparently white noise until you perform the decryption transformation on it. An obvious way to do this with a non-lossy file format is to encrypt pixel vales with a stream cipher. Another way to make the image unviewable would be to shuffle the pixels or rasters with a PRNG. andrew

3 2

Open Market, Inc. Announcing security products
by Harry S. Hawk 17 Dec '03

17 Dec '03

Here is what they are going to do.. by tues 1) Hosting a web site where a user with any browser can find out if their browser is secure. List security problems associated with that browser. "a self diagnostic center" Using their knowledge base about browsers to create this feature. shortly thereafter: 2) Creating ref. implementations for the Open Market server; methods of verifying what browser you are connecting with and lookup security bugs and or proceed with transaction. Make CGI scripts available for operators of other servers. Basically letting other sites do what they are doing it step 1. 3) Offer a free upgrade problem for people who have a server that has had a security breach. They can download a known secure server. This upgrade is for any commercial server browser that has a known breach. E.g., update a netsite server but not a CERN 3.0 server even if the CERN operator has hacked it to make it secure. WWW.openmarket.com

1 0

Transgenders begin lobbying against ITAR
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

Transgender Lobby Days has come and gone. I taught transgender persons about PGP and ITAR. It got a good reception, and they are beginning to use it. We went to all 535 congressional offices in two days, and began to get the "transgender lobby block" noticed. We did get all of the legislative staffers email addresses, and will spill the results of this soon, so you can mount an anti-ITAR campaign of you own. I concentrated on the media galleries, and began to get the transgender positions related to the media. We did get lots of press, and a 20-20 piece coming soon. They were all virtually uninformed about ITAR or the Netscape situation. I did my best on ITAR while I was there. This report is being filed at alt.coffee, a cybercoffeehouse on Avenue A and 10th Street, in New York City. Gotta go this is costing 16.00 an hour to file. Love Always, Carol Anne Member Internet Society - Certified BETSI Programmer - WWW Page Creation ------------------------------------------------------------------------- Carol Anne Braddock <--now running linux 1.0.9 for your pleasure carolann(a)censored.org __ __ ____ ___ ___ ____ carolab(a)primenet.com /__)/__) / / / / /_ /\ / /_ / carolb(a)spring.com / / \ / / / / /__ / \/ /___ / ------------------------------------------------------------------------- A great place to start My Cyber Doc...

1 0

Re: Certificate proposal
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > I may not have been clear: the certificate I was referring to was the one > from Egghead, the one which I will use to make sure that I have a valid > key for Egghead. Such a certificate would of course not have my credit > card number; it would probably have some information related to Egghead. > My rhetorical point was that information would most plausibly be a NAME > by which I would refer to Egghead. I am still trying to understand how > these proposals to take names out of the picture will apply to a > commonplace situation like this one. The certificate would identify the entity you're having commerce with. It doesn't have to have a name, the certificate would replace the need for a name. If you wanted a name, you could use the certificate to access it. The certificate would give you a public key that would be the central identifier. Associated with it might be many attributes of the key-entity. You might use the key to find out a name, and bank account number, or an ip-address to use to communicate with. Don't think of it as being a name, "Egghead Software", and this is the key associated with it. Think of the key as the central thing. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Council of Europe on Crypto: Finland
by Tatu Ylonen 17 Dec '03

17 Dec '03

People have been digging the background of the Council of Europe recommendations here in Finland. It has turned out that Finland was represented an assistant director of the Criminal Police who is known as a supporter of extremely broad powers for the police. At the meeting, he has apparently presented his personal opinion as the official opinion of Finland; later the Council unanimously decided to recommend banning strong crypto. I hear a representative from Norway had apparently tried to speak some sense at the meeting, but had quickly been quieted by the others. It has also turned out that there have been studies on legislating cryptography and related issues in Finland during the past two years, but without concrete plans. The officials in charge of these issues were not aware of what was happening in Strasburg, and what Finland apparently has presented there certainly does not represent a concensus within the government. Things appear to be developing in promising directions, but much more work is still needed until things are on the right track. I strongly urge people in other European countries to contact their government officials, the press, and use other possible channels to dig out what exactly was happening and why, and make the officials and politicians understand the other issues that are related (computer security, universal surveillance, ability of independent political groups to function, trade secrets, etc). Professors and other persons in expert positions are important sources of information to the government in the preparatory process, and you should provide the officials with experts to consult on the issues. At least here it has turned out that preparations were being carried out with very few independent experts, input coming almost exclusively from the law enforcement side. Tatu Ylonen <ylo(a)cs.hut.fi>

1 0