December 2003 - cypherpunks-legacy

Call For Papers - Conference on Redistributable Software
by John Gilmore 17 Dec '03

17 Dec '03

[I'm hoping that we can get some papers on freely redistributable *crypto* and *security* software -- like PGP or PEM or SSL_eay or Kerberos or brute-force tools or SATAN or Java tools or whatever! I'm on the program committee and am trying to make the conference as broad as possible, not just focusing on "traditional" free software. Help! --gnu] CALL FOR PAPERS First Conference on Freely Redistributable Software Sponsored by the Free Software Foundation 2-5 February 1996 Cambridge, MA Over the past 15 years, free and low-cost software has become ubiquitous. This conference will bring together implementors of several different types of freely redistributable software and publishers of such software (on various media). There will be tutorials and refereed papers, as well as keynotes by Linus Torvalds and Richard Stallman The Conference will be held at the Cambridge Center Marriott, 2-5 February 1996. Papers are invited on any aspect of GNU, Linux, NetBSD, 386BSD, FreeBSD, expect, PERL, tcl/tk, and other tools for which the code is accessible and redistributable. Extended abstracts are due on or before Thursday, 30 November 1995. Authors will be notified no later than 8 December. Full papers will be due Thursday, 4 January 1996. Program committee: Peter H. Salus, chair Robert J. Chassell Chris Demetriou John Gilmore Marshall Kirk McKusick Rich Morin Eric S. Raymond Vernor Vinge Abstracts of 350-750 words (in troff, PostScript, or straight ASCII, only) should be sent to conf96(a)gnu.ai.mit.edu -- ----------------------------------------------------------- Peter H. Salus #3303 4 Longfellow Place Boston, MA 02114 +1 617 723 3092 -----------------------------------------------------------

1 0

Re: forging headers (with more header information)
by Lee Tien 17 Dec '03

17 Dec '03

My apologies. I followed Tim's advice and turned on verbose headers, and this is what I got. Lee Return-Path: freeh(a)fbi.gov Received: from nimitz.MIT.EDU (NIMITZ.MIT.EDU [18.80.0.161]) by well.com (8.6.12/8.6.12) with SMTP id NAA20123 for <tien(a)well.sf.ca.us>; Tue, 24 Oct 1995 13:06:23 -0700 From: freeh(a)fbi.gov Message-Id: <199510242006.NAA20123(a)well.com> Received: from sgigate.SGI.COM by nimitz.MIT.EDU with SMTP (1.37.109.4/16.2) id AA00301; Tue, 24 Oct 95 16:07:08 -0400 Date: Tue, 24 Oct 95 16:07:08 -0400 Apparently-To: tien(a)well.sf.ca.us X-UIDL: 814570964.056 > How difficult is it to forge headers? How difficult is it to trace a > message to the actual sender if the header is forged? Not very difficult at all (to forge, that is). This is a quick and dirty example that should be somewhat traceable. If you want pointers on how to trace it, post the whole thing, including headers, to cypherpunks. Louis

1 0

Sign my own certificates?
by cjs＠netcom.com 17 Dec '03

17 Dec '03

Oh jesus, I need to get myself a certificate for the netscape servers at work. All I need are three forms of identification, two written letters, an authorized signature, $300, mailed and faxed, along with an e-mail or two. I think this is an amazing pain in the ass. Any way I could sign a certificate by myself for myself and have it work with the netscape products? Just curious, Christopher

1 0

CYB_lip
by John Young 17 Dec '03

17 Dec '03

11-7-95. Washrag: "Cyber Liberation." The future of American politics is being decided in semiconductor plants in Santa Clara, in the cluttered offices of all-night software designers in Redmond, and, of course, all over the Internet. "At some point in the not-very-distant future," says Newt Gingrich, "somebody is going to have encryption you can't break.... Governments are not going to be able to stop it." This brave new world is closer than you think. It will drastically change the focus of politics because control will be extremely difficult, if not impossible. We're on the brink of a revolution that will make what the Republicans are doing this year look trivial beyond belief. The Internet has the potential to set us free -- to learn anything and do anything, whenever we want. No wonder politicians want to regulate it to death. CYB_lip (7 kb)

1 0

Re: forging headers (with more header information)
by David E. Smith 17 Dec '03

17 Dec '03

On Tue, 7 Nov 1995 09:08:39 -0800, Lee Tien wrote: >Return-Path: freeh(a)fbi.gov >Received: from nimitz.MIT.EDU (NIMITZ.MIT.EDU [18.80.0.161]) by well.com >(8.6.12/8.6.12) with SMTP id NAA20123 for <tien(a)well.sf.ca.us>; Tue, 24 Oct >1995 13:06:23 -0700 >From: freeh(a)fbi.gov >Message-Id: <199510242006.NAA20123(a)well.com> >Received: from sgigate.SGI.COM by nimitz.MIT.EDU with SMTP > (1.37.109.4/16.2) id AA00301; Tue, 24 Oct 95 16:07:08 -0400 >Date: Tue, 24 Oct 95 16:07:08 -0400 >Apparently-To: tien(a)well.sf.ca.us >X-UIDL: 814570964.056 Without having any access to anything but the headers, it looks like you are an employee for SGI and sent the message from there. Look at the last Received: header. It went from sgi.com to mit.edu to well.com and then to you. Dave ----- David E. Smith, c/o Southeast Missouri State University 1210 Towers South, Cape Girardeau MO USA 63701-4745 +1(314)339-3814, "dsmith(a)midwest.net", PGP ID 0x92732139 http://www.midwest.net/scribers/dsmith/

1 0

Re: Exporting software doesn't mean exporting (was: Re: lp ?)
by Mark Murray 17 Dec '03

17 Dec '03

> > "Peter D. Junger" writes: > > : Where the hell did you get that idea? [that the ITAR applies to > > : foreigners abroad]. > > > > >From Section 120.17 of the ITAR which provides: > > > > _Export_ means: > > > > . . . . > > > > (4) Disclosing (including oral or visual disclosure) or transfering > > technical data to a foreign person, whether in the United States or > > abroad . . . . Hmm. Not only is this law unenforceable, it is unenforced. Anyone, non-US or otherwise can buy crypto books - you just can't get the code on floppy. Bruce Schneier went through this procedure when he CJ'ed "Applied Cryptography". \begin{lighter_note} The illegal bit about (for instance) the munitions T-shirt is that it has a bar code. _This_ makes it illegal for export, because not only is it machine washable, it is machine readable. \end{lighter_note} Academic exchange of mathematical knowledge has never been under scrutiny. "Technical data" will have to be interpreted to mean somethiing different, like details of the inner workings of militart encryption equipment and the like. M -- Mark Murray 46 Harvey Rd, Claremont, Cape Town 7700, South Africa +27 21 61-3768 GMT+0200 Finger mark(a)grumble.grondar.za for PGP key

2 1

encrypt-key remailers
by Jennifer Mansfield-Jones 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello, all -- I've a semi-clueless question for the gurus here. I'm trying to use the Encrypt-Key option on some of the mixmaster (type I) cypherpunks remailers, and running into trouble. Please pardon the level of gory detail here; I'm at a loss to see what I'm missing, so I present a verbatim record of what I have tried so far. Consider the sample remailing directions below. The remailer-help documents include very similar examples. The single-space indenting is only to indicate where files are included, and avoid complaints from pgp-aware mail handlers. :: Encrypt-Key: apasswd Request-Remailing-To: cardtris(a)umich.edu Subject: reply-block-test ** The above gets encrypted with flame's public key, yielding a normal little PGP message. The block gets :: Encrypted: PGP Prepended onto it, and the result looks like: :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.6.2 hIwDQyA95PVgp+UBA/4/Vm0EMi2BYBCioaLe35qx1rOxQVGEYoulmwjdDtFsXTup L08nyycNVIdxIAW5O+0T4kVuV3/ycAd84SmxDAls9n5Ebc6vP+gwE+dWCaY1TNok 1Ju08hheCJ2nC0piiN/eT0eR646fMvKGI1CiitBKXPSSkPT6alYlQvLPxd+uV6YA AACBvZthKwNEb5DQg/5otGH3njgrJISEyvgEKDZaMFuOUPzxk4IZ4NXm0v2cgHVz yxMelKz4WHnOylmZ3WWTFmngukIdasIiFf5avRZ/A4Ff1FRXf7SpxvTfGpA4pYPE yjmFhsw/NCnRVqBAH65MiU0USQhPZkZDwLe6spBaJpxENq5C =/tbc -----END PGP MESSAGE----- Trying the above, I find that it does *sort of* work as a reply block. If I append sample text and send everything to remailer(a)flame.alias.net, I get a reply back that looks like, for instance: Date: Mon, 6 Nov 1995 19:22:13 +0100 From: Anonymous <nobody(a)flame.alias.net> To: cardtris(a)umich.edu Subject: reply-block-test ** The appended text, which I expected to come back conventionally encrypted with 'apasswd', has just vanished into the void. Obviously I'm missing something... probably something that seemed painfully obvious to the writer of the remailer help file. If I omit the encryption key and '**', I can get reply blocks to work fine, even chained through multiple remailers. Suggestions? many thanks, -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Dept. of Biology Jennifer Mansfield-Jones University of Michigan cardtris(a)umich.edu http://www-personal.umich.edu/~cardtris/cardtris.htm ^---- PGP key available -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMJ5ueHTZ8yRAewEFAQEewgP/U3OhcBaKSjd1Jpg51UX7NMD3SfrF56WI fQExYw1lG70GqfEko9T1ft89mDJlj1IvjToR6TJPws8P919Y2qikw333wCt6A9eR pTMf2Jy1OjKwXRIqlFtrIMky+X2jUYDSMk3H+U1IwT7jjJUfVtzPuSEia0ZzFGmi U5BLQvrLamQ= =z1yS -----END PGP SIGNATURE-----

2 1

Re: Exporting software doesn't mean exporting (was: Re: lp ?)
by Mark Murray 17 Dec '03

17 Dec '03

> > Mark Murray writes: > > Hmm. Not only is this law unenforceable, it is unenforced. Anyone, > > non-US or otherwise can buy crypto books - you just can't get the code > > on floppy. Bruce Schneier went through this procedure when he CJ'ed > > "Applied Cryptography". > > To my knowledge, Bruce Schneier never CJ'ed "Applied > Cryptography". Phil Karn did that. Point is, it got CJ'ed, and easily too. In fact I understand that the process was 'trivial'. Just the software on floppy was a problem. M -- Mark Murray 46 Harvey Rd, Claremont, Cape Town 7700, South Africa +27 21 61-3768 GMT+0200 Finger mark(a)grumble.grondar.za for PGP key

1 0

Re: Sign my own certificates?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Oh jesus, I need to get myself a certificate for the netscape servers >at work. > >All I need are three forms of identification, two written letters, an >authorized signature, $300, mailed and faxed, along with an e-mail >or two. > >I think this is an amazing pain in the ass. You forgot about the sperm sample. I wouldn't necessarily consider that pain, though... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: lp ?
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>"Peter D. Junger" writes: >>"Perry E. Metzger" writes: >> >>: >>: Thaddeus J. Beier writes: >>: > So, if this person was sending cryptographics codes from Switzerland >>: > to Israel, the code would have been imported to the US, then exported >>: > by UUNET. They can't do that, can they? Probably nobody would prosecute, >>: > but it might be something to threaten UUNET with if one of their Northern >>: > Virginia neighbors ever wanted something the couldn't get otherwise. >>: >>: It isn't clear that telecoms treaties don't implicitly make this legal >>: in spite of the export regulations. >> >>Once again, what the ITAR forbid is the disclosure of cryptographic >>software to a foreign person within or without the United States, so >>it does not make any difference whether the message containing the >>code passes through the United States or not. > >OTOH, the ITAR explicitly permits "temporarily imported" munitions to >be re-exported. Those clauses should entirely eliminate the issue of >whether UUNET could be held liable under ITAR. ITAR says otherwise -- >see section 120.18. What if all traffic routed through the US was automatically modified, say, by inverting all bits, and then de-inverted after it exited the country. (a software flag would alert the systems to this). At the time it was exported, it would not be runnable code, nor compilable source code. Sure, somebody would claim that "it's easy to turn it into runnable code, just by XORing the file with ones." The response is obvious: Every 100K file is only a XOR away from every OTHER 100K file.

1 0

Re: toolkits?
by Stephen Whitaker 17 Dec '03

17 Dec '03

Thanks, Daniel, for a thoughtful response. At 08:18 AM 11/7/95 CST, Daniel R. Oelke wrote: >First off - avoid trying to legislate minute details of any encryption >or signature scheme. Bureaucrats trying to understand, much less control >technical things is doomed to fail. (take GOSIP as a prime example) > I didn't mean to suggest that government would be responsible to get it right. It is possible to show them how it's done though. >Second - push for legal acceptance of digital signatures and >acceptance of privacy through encryption. I believe Utah has taken a strong >step in this direction. Most people, businesses, and courts won't accept >digital contracts and the like until there is more of a sound >set of laws behind them. This is good as it can be pitched as economic development. Any good models? Where to find the UTAH language? Pitfalls to watch out for? >Strong laws against government snooping or >against anti-encryption or anti-anonymous laws are a good thing IMO. This will probably be tough in the current environment. Again, any good language available? Fortunately Vermont is small enough where anyone can get a bill printed and introduced if it is properly drafted. What did the recent US Supreme court decide in support of anonymity? > >Third - provide services to the citizenry. For example - provide >a public key server. Or how about a digital time-stamping service. >If the crap was kept out of these services, and they were free for >anyone to use, then it would advance the idea of encouraging people to >use crypto in their daily lives. > Now were getting specific. These are things that us ordinary folk can do which show the 'leaders' how to follow. What software, hardware, applications, support and sysadmin experience is required and where is it available on what terms. What are the cash flow opportunities to support such services? >Warning - Although I think there are some good things that governments >can do, it is also very important to watch out for "sabotage" by >the government. Governments tend to like control too much and by >trying to maintain control, reverse a useful service to one that >is a dis-service to the people. In general, if governments get >out of the way, people will take care of problems themselves. > Agreed. That why after five or six years of trying to get the privacy laws passed, and watching government drag anchor, I started fishin the cypherpunks list for some pragmatic solutions to everyday situations. I'd still like to be pointed to some toolkits/reference works which will teach me how to access and use available information (or data) to map the net performance, message paths, transmission delay times, sniffers active, etc. -sw

1 0

[NOISE] Karl Hess/Schulman Events
by J. Kent Hastings 17 Dec '03

17 Dec '03

Visit Neil's page, http://www.pinsight.com/~zeus/jneil/ Here are places he'll be in Southern California this month to promote his new book. Contact Neil at jneil(a)genie.com for more information. > J. NEIL SCHULMAN APPEARANCES > > -------------------------------------------------------------------- > [Download Neil's Photo] [Download Cover] > > "SELF CONTROL Not Gun Control" > November, 1995 > > NOVEMBER, 1995 APPEARANCES > > * Friday Nov. 10, opening until close of show > Saturday Nov. 11, opening until 4 PM > Sunday Nov. 12, opening until close of show > Personal appearance / book autographing! > Great Western Gun Show > At Fairplex in Pomona, CA > Building 6, Table 7048 -- > next to Threat Management Institute / Peter Alan > Kasler > > * Saturday Nov. 18, afternoon > Personal appearance / book autographing! > Richard Kyle Books > 242 East 3rd Street > Long Beach, CA 90802 > Further Info: (310) 432-KYLE > > * Monday, Nov. 20, 7:00 PM dinner, 8:15 PM program > Speech: "SELF CONTROL Not Gun Control" > Karl Hess Club > Marie Callender's Restaurant 4356 Lincoln Blvd. > Marina Del Rey, CA $13.00 includes meeting, buffet > dinner with soup, salad bar, meatloaf entree & sides, > corn bread, choice of three pies & beverage, tax & > tip included. Reservations appreciated at (310) > 289-4126, 24 hours. > EMail for further info to agorist003(a)aol.com. > > If you would like J. Neil Schulman to make a personal appearance at > your club meeting or store, Email: jneil(a)genie.com or Phone/fax: > 1-500-44-JNEIL (1-500-445-6345). If difficulty connecting, call > through AT&T 1-800-CALL-ATT then 500-445-6345. > > Return to J. Neil Schulman's Home Page. > -------------------------------------------------------------------- > HTML by J. Kent Hastings [Artist] , zeus(a)pinsight.com, > > 1354 East Ave. # R-108, Chico, CA 95926. Fax: (916) 893-1525. Kent -- "Put pages for your business on the World Wide Web, just $5 per month!" -- J. Kent Hastings -- zeus(a)pinsight.com -- http://www.pinsight.com/~zeus/

1 0

Re: Photuris Primality verification needed
by William Allen Simpson 17 Dec '03

17 Dec '03

> From: "Brian A. LaMacchia" <bal(a)martigny.ai.mit.edu> > > Recently, someone asked for a smaller prime of only 512-bits for speed. > > This is more than enough for the strength of keys needed for DES, 3DES, > > MD5 and SHA. Perhaps this would be easier to have more complete and > > robust verification as well. > > Our practical experiences with discrete logs suggests that the effort > required to perform the discrete log precomputations in (a) is slightly > more difficult than factoring a composite of the same size in bits. In > 1990-91 we estimated that performing (a) for a k-bit prime modulus was > about as hard as factoring a k+32-bit composite. [Recent factoring work > has probably changed this a bit, but it's still a good estimate.] > Thanks. I have added the [from Schneier] estimate e ** ((ln p)**1/2 * (ln (ln p))**1/2) and number field sieve estimate e ** ((ln p)**1/3 * (ln (ln p))**2/3) to the Photuris draft, with a small amount of explanation. Hilarie Orman posted that 512-bits only gives an order of 56-bits strength, 1024-bits yeilds 80-bits strength, and 2048 yields 112-bits strength. I do not have the facilities to verify her numbers. As most of us agree that 56-bits is not enough (DES), the 512-bit prime seems a waste of time and a tempting target. I'd like to drop it, but Phil is inclined to keep it with a disclaimer. Bill.Simpson(a)um.cc.umich.edu Key fingerprint = 2E 07 23 03 C5 62 70 D3 59 B1 4F 5E 1D C2 C1 A2

6 7

Re: So much for free speech...
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:57 AM 11/6/95 -0800, Timothy C. May wrote: >Children are usually not accorded full constitutional protections, >especially not in public schools, but this does not mean the police should >arrest those who utter the wrong words! (Maybe suspending the student, >though I certainly wouldn't do that.) That's the rub. Kids can be kept locked up even with no crime. "Children don't have a right to liberty only a right to custody." An adult would probably not get arrested in the same circumstances (cops have more discretion to push kids around) or if arrested not prosecuted, or if prosecuted, case dismissed. It's a good thing the kid didn't engage in racist/Nazi acts like cutting government spending and taxes or they would have thrown the book at him. >This is the "safe and secure" world we are in, where bad thoughts and bad >words are punished. Or threatened with lawsuits. Anarchy seems infinitely >preferable to me. You got that right. DCF "Remind me to use an anonymous remailer in the future when indulging in racism."

1 0

BoS: Netscape 2.0b2 allows for invasion of privacy (fwd)
by bkuhn＠scientech.com 17 Dec '03

17 Dec '03

Talking of Netscape - this posting prompted me to forward it given the security and privacy implications inherent in the problem. Cheers Graeme ------- Start of forwarded message ------- >From: Scott Weston <scott(a)tripleg.com.au> >Subject: Netscape 2.0b2 allows for invasion of privacy >Newsgroups: aus.net.announce,comp.privacy >Date: Fri, 01 Dec 1995 11:09:06 +1100 Hi 'Net Dwellers, First off - I've posted this before (however not to this group) and only got a response from the Netscape Corp. They were glad I found the problem and said that they would fix it, however I feel that people should know about it. Also I would like people to help me spread this document around, i.e. if you know of a newsgroup (or people) that would find this interesting then please re-postit. On with the problem... I've recently got hold of the latest netscape, and was (at first) very excited about the new "LiveScripts" that it supports. If people don't yet know - these "LiveScripts" allow you to put small programs into your web page that is then executed by the Netscape client. There is no DIRECT way for these programs to send information back to the owner of the web page, however I was able to do it in a not-so-direct way. The "LiveScript" that I wrote extracts ALL the history of the current netscape window. By history I mean ALL the pages that you have visited to get to my page, it then generates a string of these and forces the Netscape client to load a URL that is a CGI script with the QUERY_STRING set to the users History. The CGI script then adds this information to a log file. Now if this hasn't quite CLICKED yet lets do a little example. Johnny Mnemonic starts up his newly acquired version of Netscape2.0b2 to start his daily "surf" session. First he decides to check his CD-NOW purchase and uses the handy Auto-Login URL. Then he decides to go to Lycos and do a search. In his search he find my page, which he decides to visit. Suddenly he is transported, not to my main page but to one of my CGI scripts, which in turn happens to have ALL the URL's he just been to in it. This means that in my log will be: - the URL to use to get into CD-NOW as Johnny Mnemonic, including username and password. - The exact search params he used on Lycos (i.e. exactly what he searched for) - plus any other places he happened to visit. I do this in a way that the user will KNOW that it has happened and will _hopefully_ email Netscape and tell them they are NOT impressed. But it would be EASY for me to change the CGI script so that the user is unaware that it has actually happened, unless they closely examine their URL history (in fact they'll probably just think its a netscape bug). If you're skeptical about this then do the test yourself. Get netscape 2.0b2 and do some normal surfing, and then go to Lycos. Do a search for: scotts car boot sale which should return the URL - http://www.tripleg.com.au/staff/scott Click on the URL and sit back an watch. First my main page will show up but a little while later you should be transported to a CGI bin script that will show you your URL history. I have tested this with both the Linux 2.0b2, and Solaris 2.0b2 versions and both have done the same thing. I would be interested in knowing if it happens for ALL versions of Netscape2.0b2. The log file does log the User Agent (i.e. the name of the platform you are using) so by simply going to the page I will know that your version of Netscape is also open to this form of attack. Currently I can find no way to configure Netscape2.0b2 to NOT run LiveScripts - and at the very least this option should be quickly added to the next version of netscape to be released. But a far better solution (IMHO) would be for netscape to pop up a window before running the LiveScript and let you know what the LiveScript wants access to, e.g. if it only wants to print out the current time then that's OK, but if it wants to read my history list and then transport me to a CGI script and add me to a logfile then maybe I would say NO. I think I've said enough.... If you've got any further questions, or want some more information just email me : scott(a)tripleg.com.au -- Scott. Quote from a car accident insurance claim: "I told the police that I was not injured, but on removing my hat, I found that I had a skull fracture." ------- End of forwarded message -------

1 0

Re: BoS: Netscape 2.0b2 allows for invasion of privacy (fwd)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:33 PM 12/8/95, Bill Kuhn wrote: >Talking of Netscape - this posting prompted me to forward it given the >security and privacy implications inherent in the problem. > >Cheers >Graeme > >------- Start of forwarded message ------- >>From: Scott Weston <scott(a)tripleg.com.au> >>Subject: Netscape 2.0b2 allows for invasion of privacy >>Newsgroups: aus.net.announce,comp.privacy >>Date: Fri, 01 Dec 1995 11:09:06 +1100 > >Hi 'Net Dwellers, "'Net Dwellers" or "Det Weilers"? Hmmhhh.... In any case, this has already come up a couple of times on the Cypherpunks list, and was even commented upon by Jeff Weinstein of Netscape a couple of days ago. The bug was fixed in b3. I really encourage people who are not following the list more carefully to check the back traffic before posting bug reports. Forwarding messages is often the culprit in this, as the forwarder simply assumes we may be interested, but he has himself not been following the thread. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: The Elevator Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:47 PM 12/8/95, Jerry Whiting wrote: >A group of us have been wrestling with a problem and I'd like to ask for some >outside help. We've come to call it the Elevator Problem. > >Alice and Bob want to establish a secret in from of Eve. In other words, >they want to agree on a secret key in an elevator full of Eve's. Isn't this just the "subliminal channels" scenario? Originally phrased in terms of prisoners under the watchful eyes of their jailers nevertheless establishing a private communication channel? Schneier describes this beginning on page 66 (of his 1st edition). Your scenario looks identical to this. So you should check out the papers on this in the Crypto Conference proceedings. As to whether you can implement this without using patented algorithms, I don't know. Not enough information given. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

7 6

InfoWarCon
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

P L E A S E D I S T R I B U T E W I D E L Y InfoWarCon (Europe) '96 Defining the European Perspective Brussels, Belgium May 23-24 1996 Sponsored by: National Computer Security Association Winn Schwartau, President and CEO, Interpact, Inc. Robert David Steele, Chairman & CEO, OPEN SOURCE SOLUTIONS Information Warfare represents a global challenge that faces all late-industrial and information age nation states. It also represents the easiest and cheapest way for less developed nation-states and religious or political movements to anonymously and grieviously attack major nations and international corporations. Not only are the definitions of InfoWar unclear, but they span many areas and disciplines. This conference will examine the European perspectives on all three classes of Information Warfare while contributing some American lessons learned, mistakes made and successes enjoyed. Class I: Personal Privacy Class II: Industrial and Economic Spying and Warfare Class III: Global Conflict, Terrorism and the Military As at all other InfoWarCon, this special European Conference encourages active audience participation, contribution and debate. May 22, 1996 17:00 - 20:00 Pre-Registration 18:00 - 21:00 Hosted Cocktail Party with Music Most conference speakers will be in attendance. Meet Mr. Schwartau and Mr. Steele. May 23, 1995 07:00 - 08:30 Registration 07:00 - 08:30 Sponsored Continental Breakfast PLENARY SESSIONS 08:30 - 09:00 Keynote Speech Major General William Robbins Assistant Chief Of Staff, Command, Control, Communications, Computing, and Information Ministry of Defence, United Kingdom (Invited) 09:00 - 10:00 "Information Warfare: Chaos on the Electronic Superhighway" Winn Schwartau President and CEO, Interpact, Inc., USA An overview of Information Warfare from the civilian perspective by one of the world's leading experts on the subject. This will be an eye-opening presentation with time reserved for questions from the audience. Mr. Schwartau will be available throughout the conference for personal and private discussions as well as book signings. 10:00 - 11:15 Military View of Information Warfare Moderator: Captain Patrick Tyrell Assistant Director, Information Warfare Policy, Ministry of Defence, United Kingdom Panel: The German View The Russian View The Croatian View 11:15 - 11:45 Sponsored Break 11:45 - 13:00 Law Enforcement in Cyberspace: Cooperation is the Key: Panel Moderator: Winn Schwartau, Interpact, Inc. Panel: Interpol Surite FBI Netherlands How will global partners respect each other's laws and cooperate in their enforcement? Will extradition for cyber-crimes become necessary? Leading experts will walk us down the paths to success and offer lessons learned on failures and risks. 13:00 - 14:30 Lunch 13:30 - 14:00 Special Luncheon Presentation BREAKOUT SESSIONS 14:30 - 16:00 Breakout I: Threats to European Civil Prosperity Moderator: Admiral Lacoste/General Heinrich, France (Invited) Panel: Belgium Germany United Kingdom Europe is becoming as dependent upon its econo-technical infrastructure more than ever with the design and construction of the European Space Initiative. Communications systems create the basis for global commerce, transportation systems permit the distribution of goods, the financial infrastructure is a requisite component of any information based economy and the power grid glues it all together. But, the threats to their stability and integrity are many and must be dealt with on a continent that has a history of war and more recently terrorism. What are the risks? The rewards? And the solutions? Breakout II: Information Warfare: Support for Conventional War Fighting Moderator: TBD Panel: US - Gen. Jim McCarthy USAF (Ret) Russia Netherlands Conventional Wars and regional conflicts are replacing the fear of East-West conflict. Advanced Industrial and Information Age societies will supplement their armed forces with enhanced information processing capabilities. What are they and will they change the face of war? 16:00-16:30 Sponsored Break PLENARY SESSION 16:30 - 18:00 "Hackers: National Resources or Merely Cyber-Criminals?" Moderator: Mich Kabay, Ph.D. Director of Education, NCSA and Robert Steele, President, OSS, Inc. Panel: Hactic and The Digital City Experiment: Amsterdam, Netherlands (Invited) Hacker, United Kingdom CHAOS Computer Club, Germany Are hackers merely criminals operating under the guise of Internet freedom? Or are they national resources to be cultivated and who have served as an early warning system for Cyberspace? One group of American hackers have threatened to "Declare War on France" on behalf of American interests. How do we as nations deal with this? Mich Kabay and Robert Steele will debate the issue and then you will meet the hackers in person. The first Information Warriors invite your questions, comments and interaction. Learn first hand who they are, what they believe and how they function. 18:00 - 21:00 Hosted Reception 21:00 - 23:00 "Dutch Dinners" for Birds of a Feather Rallying points will be provided. May 24, 1996 07:00 - 8:30 Sponsored Continental Breakfast 08:30 - 9:00 Keynote Speech "Efforts to Maximize Information As New Age Weapon" (TBD) PLENARY SESSIONS 9:00 - 10:00 "Creating Smart Nations Through National Information Strategies: Intelligence And Security Issues" Robert David Steele, President, OSS, Inc. US Planning for the future requires new thinking and a new "triad" of defense: Open Source Intelligence, Electronic Home Defense and Information Warfare. 21st Century realities invite dozens more players whom must be monitored and controlled. Governments and the military should avail themselves of the publicly available open source information as part of their ongoing intelligence operations. Mr. Steele has suggested that nations should "draft" the civil sector by requiring 'due diligence' and very high standards of private sector communications and computing security. 10:00 - 11:15 "The Convergence of Military and Commercial Vulnerabilities" Moderator: Winn Schwartau, President and CEO, Interpact, Inc. Panel: Bob Ayers, DISA, Department of Defense, US Holland / Belgium UK France Much of military success depends upon the reliable operation of civilian and commercial systems. No longer do the government and military and private sector function in isolation. What levels of cooperation are required to assure proper defense and war fighting capability? How much of the private sector must be viewed as a national security asset - to be protected as much as is a forward deployed military unit? 11:15 - 11:45 Sponsored Break 11:45 - 13:00 Societal Impact of Information Warfare Moderator: Winn Schwartau, President and CEO, Interpact, Inc. Society is absolutely dependent upon technology; without networks and computers and communications, portions of society can collapse within days. If major systems fail, what will the reaction of a techno-reliant society be? And, what are the ethics of a military who instigates the collapse of an adversary's civilian infrastructure rather then resort to bombs and bullets? Is a techno-phobic society psychologically prepared for the consequences? 13:00 - 14:30 Lunch 13:30-14:00 Special Luncheon Presentation BREAKOUT SESSIONS 14:30 - 16:00 Breakout I: Legislation & Personal Privacy: A Global Electronic Bill of Rights? Moderator: General Pickering, Canada (Invited) Panel: Electronic Privacy International (Invited) Sweden The Vatican This panel will examine the different approaches governments take to protect the personal privacy of their citizens and what steps need to be taken to create a global consensus. How do differing privacy laws affect countries ability to do business? How will authoritarian regimes counter the perceived threat of free and open information flow? Breakout II: "Industrial Espionage: An Update" Moderator: DST, France (Invited) - (RS) Panel: Surite tells all Kroll Associates US Germany 122 Countries are actively engaged in industrial and economic espionage to the benefit of their respective states. It's a lot easier for a third world or agrarian society to steal intellectual and proprietary property than to invest time and resources develop their own. Who's involved and what are they doing? What steps need to be taken to defend such actions? 16:00 - 16:30 Sponsored Break PLENARY 16:30 - 18:00 Defining War in the Information Age "The New National Security" Brief comments by Winn Schwartau and Robert Steele - and then a lively interactive audience debate. An enemy bomb landing in any country can be easily construed as an act of war. However, in Cyberspace, anonymous acts of aggression that lead to war or replace conventional attacks are not so simple to classify. This highly charged subject will consider what war is and what it isn't: - Is an attack against a financial institution an act of war? - What about the intentional collapse of a communications infrastructure? - Is human lethality a necessary pre-requisite for war? - Do we need to redefine national security for the post Cold-War world? 18:00 - 18:10 Closing Comments 18:00 - 20:00 No-Host Reception Hotel Information: Hotel Palace rue Gineste 3 1210 Brussels Belgium +32 2 203 62 00 +32 2 203 55 55 (Fax) InfoWarCon (Europe) - 96 Registration Form: Name: ___________________________________________________________ Title: ___________________________________________________________ Org: ___________________________________________________________ Address: ___________________________________________________________ Address: ___________________________________________________________ City: ___________________________________________________________ State: _______________________________ Zip: _____________________ Country: __________________________ Email: ________________________ Phone: __________________________ Fax: _________________________ FEES: Payment made BEFORE March 1, 1996: ( ) $845.00 NCSA Members/OSS Attendees ( ) $895.00 All others ( ) $795.00 3 people from same organization ( ) $745.00 5 or more people from same organization Payment made AFTER March 1, 1996: ( ) $895.00 NCSA Members/Paid OSS Attendees ( ) $995.00 All others ( ) $845.00 3 people from same organization ( ) $795.00 5 or more people from same organization Make checks payable to NCSA, or Charge to: ( ) VISA ( ) MasterCard AMEX ( ) Number: ___________________________________________ Exp date: ___________________________ Signature: ___________________________________________ MAIL OR FAX OR EMAIL REGISTRATION TO: National Computer Security Association 10 South Courthouse Avenue Carlisle, PA 17013 Phone 717-258-1816 or FAX 717-243-8642 EMAIL: conference(a)ncsa.com To obtain the latest edition of this program, send EMail to: euroinfowar(a)ncsa.com For more information about NCSA: WWW: http://www.ncsa.com CompuServe: GO NCSA EMail: info(a)ncsa.com Sponsorships for various InfoWarCon (Europe) 96 events are still available. To find out how to sponsor portions: Contact Paul Gates at the NCSA: pgates(a)ncsa.com To reach: Winn Schwartau: Winn(a)Infowar.Com Robert Steele: ceo(a)oss.net V 1.1/12.7.95 Peace & Happy Holidays Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

1 0

Re: GAK and Self-Incrimination?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 8-DEC-1995 13:28:32.69 Given that GAK means one never knows if the government is listening, could a person claim protection against self-incrimination as a reason to not use GAK, and get away with it? (This is different from the phone system, which may also be tapped. The analogy would be the same if the government forced one to pick a telephone it could tap over one it could not, which so far has not been the case, but which soon may be if switching systems which are not compliant with Digital Telephony Act provisions are shut down.) Consider this hypo: I send an encrypted message to a partner in crime containing plans for future crimes and descriptions of past crimes. I don't GAK the message. The government prosecutes me under the Anti-Terrorism and Child Protection Act of 1997. My defense? That GAKKing the message would be tantamount to incriminating myself, which the Fifth Amendment protects me against. ------------------- There is the problem with this argument that personal diaries have recently (Packwood) been found to not fall under the Fifth amendment. However, IA(most definitely)NAL. -Allen

1 0

NSA flying disk follow-up [Extremely Frivolous]
by cman＠communities.com 17 Dec '03

17 Dec '03

I spoke with Dennis Cisco at the NSA today, and he is unwilling to sell or otherwise distribute the NSA flying disk promotional items "except at trade shows where we are promoting our technology transfer program." Since they are not planning on attending any such conferences in my area in the near future, it is unlikely I'll be able to help any of the (numerous) people who expressed an interest in obtaining one of these fine flying disks. (http://www.communities.com/foo/NSAfris.gif) If you'd care to discuss this matter with Mr. Cisco yourself, he can be reached at: (301) 688 0701. Note that this is in Maryland. Also, the (301) 688 0606 number listed on the frisbee seems to be either always busy or not answered -- I'm assuming it's the # for the NSA tech transfer office. Please let me know if any of you have better luck.

3 2

Re: Free calls to Govt (fwd)
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

I did and it did not work. At 04:22 PM 12/10/95 EDT, you wrote: > I've been told that number is out of date. Since I forgot to save it, >would someone who did check and find out? > Thanks, > -Allen > > -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: Still more on the Digicash protocol
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:26 PM 12/8/95 -0600, Mark Twain Bank Ecash Support wrote: >>There's no need to send that payment info in the clear -- why not encrypt? > >DigiCash agrees that it is desirable to encrypt the payment request. The >problem is how? You can't use the payor's public key, since the payor is >anonymous to the payee. There are other, high overhead, protocols that might >be used, but after taking MIM into account, securing the payment request >from within Ecash while retaining acceptable latency is much harder to >acomplish than one might think. Obviously if the payer is the one transmitting the message, she doesn't use her public key to encrypt; hers would be used for signature if appropriate. She should use the payee's public key, or some negotiated key like DH. It doesn't lose any privacy, because she already knows an address to send the money to, and the payee can create a public key for that address, or some other public key he makes available to payers. >The best solution at this time seems to be to use the already existing https >connection to transmit the payment request. The next version of Ecash will >offer this feature as an option to the user. I had assumed that the payment information wasn't encrypted because that's a separate problem from the basic digicash, and because if the payer wants to keep the transaction private, she probably also needs to encrypt the other side of the transaction - e.g. the request for n widget at $d/widget. https or other ssl connection, or an encrypted telnet, or encrypted email, or some other protected mechanism all would seem to be appropriate. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281 # Anybody notice that Microsoft's Wide Open Road ad has barbed-wire fences # on both sides of the road?

2 1

More elveator problem
by Jerry Whiting 17 Dec '03

17 Dec '03

More on The Elevator Problem: I'll confess that we're working on a new private key encryption product. Free and clear of existing claims on intellectual property, I'd like a protocol that answers the elevator problem: how can Alice and Bob agree on a private key via a compromised channel? I don't want them to meet under a street lamp and whisper in each other's ears _before_ trying to establish a secret on a crowded elevator. I'm willing to accept that the basic question is undoable without stepping on DH et al., I just don't want to give up until all parties are convinced it can't be done. As I stated in my original post, we're willing to consider less-than-perfect implimentations if we can quantify mathematically the risk involved. In some scenarios, Alice and Bob might not expect any Eve's in the crowded elevator or value the content at such a price that they're willing to live with less than 100%. As long as we can document the risk, the end user can make the decision as to whether the risk is worth it. Something that I neglected to mention before is that Alice and Bob do have a unique ID within this system, not that they necessarily know each others. If one assumes that they do, they then share a secret: the knowledge of each other's unique ID. Another segment of our attention is being spent daydreaming about the potential applications of a secondary channel in the cleartext portion of a crypto "package" or "bundle". The comment about secondary channels that I believe Tim made regarding the inmates and the warden is something we discuss in our spare time. Then again the wheels of justice doth turn and patents ain't forever... Jerry Whiting jwhiting(a)azalea.com

1 0

Rally in SanFran meatspace to protest censorship in cyberspace!
by John Gilmore 17 Dec '03

17 Dec '03

Spread the word! *** NETIZENS!! RALLY AGAINST CENSORSHIP *** Amendment I: "Congress shall make no law ... abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble." **PROTEST ** PROTEST ** PROTEST ** PROTEST ** PROTEST ** PROTEST ** It's like illiterates telling you what to read. On December 6 members of the House Conference Committee on Telecommunications Reform approved a proposal to censor free speech in cyberspace. If the measures are adopted, the Net and online media will become the most heavily regulated media in the United States. They *will not* enjoy the First Amendment freedoms now afforded to print media. Instead, online publishers and users will be held to a vague and patently un-Constitutional "indecency" standard. "Violators" will be subject to fines of up to $100,000 and prison terms of up to five years. In response, ALL members of the Bay Area media, online, Internet, new media, and telecommunications communities are invited to participate in a protest rally to express our outrage that the politicians in Congress (which is not even connected to the Internet!) are attempting to destroy our First Amendment rights in cyberspace, and directly attack our livelihoods. Help stop the demagogs in Washington! There is nothing "decent" about denying free speech to us, our children, and our children's children. Preserve our Constitutional rights! Join us! WHEN: Monday, December 11, 1995 12:00 - 1:00 PM WHERE: South Park (between 2nd and 3rd, Bryant and Brannon) San Francisco. SPEAKERS: To be announced [including John Gilmore, Jim Warren, Dave Winer, Mike Godwin, Howard Rheingold] BRING: Attention-grabbing posters, signs, and banners that demonstrate your committment to free speech and expression, and your feelings about Congress. FOR UPDATED INFORMATION: http://www.hotwired.com/staff/digaman (Although this event is being organized in the offices of Wired magazine and HotWired, we are *actively* seeking participation and support from all members of the local community. Please forward this message to anyone you think should attend, and to all relevant news groups.) CONTACT: Todd Lappin -- 415-222-6241 -- protest(a)wired.com

1 0

Oracle of Man
by oracle1＠shell02.ozemail.com.au 17 Dec '03

17 Dec '03

Whatever your Newsgroup interest may be, The fact that you are using the Internet, means that you are part of the greatest explosion of information technology (IT) in the history of mankind. Computer developments are well documented but the future of artificial intelligence is limited only by our imagination. Paul Phillips, owner of one of the largest IT companies in Australia, has written a compelling book which is raising controversy and arguments throughout the world. His disturbing and unnerving prediction is that we are now close to a breakthrough in the race to give computers a conscious intelligence. This will give them the ability to interface with human beings. This giant leap forward brings the incredible possibility of being able to "download" our whole psyche. This will include our personality, intelligence and knowledge transfering into Technological Life Forms" or "TLF's", to give ourselves eternal life. For further information, please visit our Web page on http://www.oracle_of_man.aust.com

1 0