December 2003 - cypherpunks-legacy

Re: underground digital economy
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:27 PM 1/17/96 -0600, Jim Miller wrote: >This is the part that bothers me. Wouldn't a gateway between anonymous >e-money and identified e-money would stick out like a sore thumb to >agencies tracking the flow of identified e-money? Wouldn't identified >e-money trails start and/or terminate at the gateway? Once the gateway is >discovered, all clients on the identified e-money side of the gateway >would be discovered. But those clients could be shell companies given to the "real" users. As long as one has a continuing opportunity for anonymous *spending* you can transfer the value of the underground e-cash into useful goods and services. DCF

1 0

Re: new web security product
by Steve Gibbons 17 Dec '03

17 Dec '03

# Perry Metzger wrote: # > I don't think its going to fly. No one wants to pay for an unneeded # > $100 piece of hardware to encrypt the same credit card over and over # > again, when a nearly zero marginal cost piece of software can do the # > same thing. Merchants might. Current credit-card processing terminals are increadibly overpriced for what you get. $100.00 plus the price of an inexpensive PC, plus proprietary software isn't too far of the mark, in comparison. # I agree with Perry. Hardware encryption does add a layer of security # not normally found in software, but it is hardware. I've been a fan of unrelated encryption at each layer of the 7 (5, 4, whatever) layers, lateley. In military/financial terms, the question of "who has access to what" and "needs to know what" at different levels of the protocol stack make a big difference. Network guys should be able to perform traffic analysis, application guys should be able to debug application-specific traffic, but not visce versca. # Shoot, I don't even have a 28.8 modem yet, why would I want a black # box that supposedly does something with my Credit Cards? If you think "Not _my_ credit cards, but my _customers'_...", then it starts to make sense. -- Steve(a)AZTech.Net

1 0

Re:
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 03:41 PM 1/16/96, you wrote: >I thought you might find this interesting... Thanks, that is very cool beyond just ecommerce, because what does it mean for personal encryption? If I buy one of these doo-hickeys for $100, and so do you, does that mean we don't have to buy an AT&T 3600 (secure phone) to talk securely, and also not have to worry about Clipper crap? Or (as it probably is) does that mean we _have_ to talk through this company and it only sends tiny bits of info from the card reader... (it'd be cool if you could modify it...) Interesting. > >found at:http://www.cnn.com/TECH/9601/encryption/index.html >New security device may broaden business on the web > >January 16, 1996 >Web posted at: 9:30 p.m EST (1430 GMT) > >>From Correspondent Marsha Walton > >ATLANTA (CNN) -- For cyberspace marketers, The World Wide Web is a potential >world wide mall, an electronic marketplace for consumer goods and services. > > But for now, most visitors are window-shopping, not buying. A new survey by >the University of Michigan shows consumers are wary of purchasing goods >online for fear their credit card numbers will be misappropriated. > > People who think nothing of giving their credit card number to an anonymous >voice over the phone or handing their card to a waitress at a restaurant, >flinch at the thought of putting that number into a computer. > > But a New Jersey, ISED Corp., has created a device that >secures transactions, both on the Internet and over the telephone. It's >called SED, or secure encryption >device. It costs about a hundred dollars, attaches to a >phone or a PC and operates with the swipe of either a credit or ATM card. > > "What the device will really allow is consumers a new form >of payment from home using their ATM card. They'll be able to purchase goods >and services or whatever on the internet, " said Roger Payne, an engineer >for BT Labs which is testing the product. > > Potentially vulnerable personal account information is >scrambled or encrypted on the magnetic stripe on the card. It is >electronically transferred through the hardware. That eliminates the need >to say or "key in" the account number or expiration date. > > "So that if somebody who is not supposed to be looking at it, they can't >understand what's in there," said Grant Helmendach whose company BUYPASS >processes three quarters of a billion financial transactions a year. > > BUYPASS is marketing SED to "mom and pop" retailers which charge goods by >making an imprint of credit cards, relying on paper transactions that are >costlier, and less secure. > > "Lots of folks want to focus on the Walmarts of the world. not a lot of >people have focused on the smaller specialty shops, specialty retailers, and >what folks at SED have done, is built a terminal that's very inexpensive, >so they can play in this game. They have financial incentive to do that," >said Helmendach. > > As buying by computer catches on, the device could eventually be used to pay >for everything from a pizza delivery to bailing a friend out of jail, and >would be as much a part of the home computer as a floppy disk or a hard drive. > > And just as consumers have grown accustomed to computers and ATM cards, the >combination of the two could be another step toward a "cashless" society. _______________________ Regards, If God intended one space between sentences, why do we have two thumbs? - ? Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

Re: pgp broken?: my mistake
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

I apologise for including the following line: >>On 16 Jan 96 at 19:16, Derek Atkins wrote: Making it appear that Mr Atkins had something to do with the quote, which he did not. After rereading, the entire post has a sort of nasty tone that I did not intend. Oh, well, maybe I should return to lurk mode for a while... Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

01 16 96 CuD Cypherpunks-related Items
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, Cypherpunks-related items in 01 16 96 Computer under- ground Digest: Cryptography and Privacy Justice Dept. press release: no PGP prosecution (fwd) FLASH: Phil Zimmermann case dropped! Letter to Wiesenthal Center in re "hate speech" ban AP/NYT: Jewish Groups Call for Internet Censorship CuD is available as a Usenet newsgroup: comp.society.cu-digest The most recent issues of CuD can be obtained from the Cu Digest WWW site at: http://www.soci.niu.edu/~cudigest Cordially, Jim

1 0

Lotus to export 64 bit, partially-escrowed Notes
by Peter Trei 17 Dec '03

17 Dec '03

Alerted by a colleague at the RSA Data Security conference today, I just checked the Lotus site. Folks may wish to look at http://www.lotus.com/home/whatsnew.htm A new 'international' version of Lotus notes is being released, with 64 bit session keys, as opposed to the old 40 bit version. 24 bits of the session key are stored encrypted under a special, government-access RSA public key. This is in addittion to the full 64 bit key being available under the recipient's public RSA key. The idea is that the USG would have to search only a 40-bit keyspace, while others will need to search a 64-bit keyspace. Reportedly, this 'workfactor reduction key' will NOT be available to foreign governments. My colleague reports that opinion at the conference was divided over whether Lotus was doing something which made good business sense, or whether this was 'caving-in'. Speaking only for myself Peter Trei trei(a)process.com

3 2

Re: THE RECIPROCAL ?......
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:33 AM 1/17/96 -0600, you wrote: > >Terence Joseph Mallon writes: > > "When people talk of encryption they use the word break, they are > > approaching from one way but not the only way. I am at present trying the > > reciprocal, that is, to mend." > >Why do I sometimes feel that personalities that once were drawn to >design of perpetual motion machines or techniques for squaring circles >may very soon flock to cryptographic "research"? Actually, I think she was just fucking with his mind... It sounds like an answer that I would give to a paranoid newbie, given half the chance. (If I had thought of it...) "A mindfuck is a terrible thing to waste." I am sometimes surprised at the number of "They have broken PGP" stories I keep hearing. People who know NOTHING about cryptography somehow "know" that PGP has somehow been "broken". I wonder how these memes are getting into the culture at large? Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

RE: Random Number Generators
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

If you're going to work with hardware to get really random numbers, why not go to the back of any of several PC-type magazines, and order the radiation detector board that someone is hawking? Can't really do any better than that, can you? Counting cosmic ray hits and noting their time differentials should be just what the doctor ordered, right? Kurt ---------- From: Perry E. Metzger[SMTP:perry@piermont.com] Sent: Wednesday, January 17, 1996 11:00 To: Timothy L. Nali Cc: cypherpunks(a)toad.com Subject: Re: Random Number Generators "Timothy L. Nali" writes: > For a class project, I will be designing a VLSI cmos chip to generate > truly random numbers (The chip will be fabricated). I'm limited to a > 2-micron standard cmos technology > The most promising design I've seen so far (that I can actually > do) is based on clocking a D flip-flop in the following way: I'd say that the design you have picked has a couple of problems with it. The first is that you are, from what I can tell, building a synchronizer, which means that you may have metastability problems. (Your diagram wasn't completely clear so I can't tell). Also, you are depending on a sloppy clock and a not sloppy clock actually having the stated properties, which means you aren't really generating randomness so much as hoping you can detect and exploit it. As it is very hard to determine if a stream is really random, this makes your life difficult. Far better to try to use some analog tricks in the circuit itself to generate the random numbers for you. Of course, some of these end up producing metastability problems of their own... Can anyone point this guy at good texts on all of this? I've never found one... Perry

1 0

02 96 Wired: Cyperpunks-related
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, Cypherpunks-related items in 02 96 Wired: TITLES PAGES Surveillance-on-Demand 72 Spam King! 84 Cyphermilitia 95 Steve Jobs 102 [interview; see 162.2: "If the Web becomes too complicated, too fraught with security concerns...."] Catching Kevin 119 Privacy Is History 124 How Good People Helped Make A Bad Law 132 [FBI reverse-engineers EFF] I may have overlooked some items. Wired subscription requests: 1 800 SO WIRED. Cordially, Jim

1 0

CryptoAPI and export question
by m5＠dev.tivoli.com 17 Dec '03

17 Dec '03

Tom Johnston writes: > We would ship a CSP development kit to a foreign vendor, and sign a CSP > developed by the foreign vendor, but only with the appropriate export licenses. So you'll only perform the signing operations in the United States? In other words, what if I'm in Egypt, and I develop a CAPI-compliant DLL (or whatever). Could I go down to the Cairo Microsoft office and get my stuff signed there? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Nobody's going to listen to you if you just | Mike McNally (m5(a)tivoli.com) | | stand there and flap your arms like a fish. | Tivoli Systems, Austin TX | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

[Local] Update Information for Portland Cpunks Meeting
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Portland Cypherpunks meeting is still on. We will be having a key signing. Reminder about time and location: Location: The Habit Internet Cafe 21st and Clinton in Portland OR http://www.teleport.com/~habit/ for more info. Date: January 20th, 1996 (THIS SATURDAY) Time: 5:23pm So far I have received only four keys for the key signing. I am kind of disappointed about the results of the proposed key signing for the meeting... If you are planning on attending, even if you are not planning on participating in the key signing, I need to know so the Habit can plan for the added influx of people. So far I have a large pile of "maybes" and few confirmations. If you have topics you would like to do a presentation on, please give me information on it so that I can distribute it to the other participants. (Or bring it up before the meeting.) *** NOTE *** Teleport (my ISP) has been having mail problems. If you have sent me mail and not received an confirmation, please resend. I may not have received it. Currently, there is only one other speaker confirmed (besides myself). I would like to see more input from the rest, so this does not just become a one way spouting of information. The one confirmed speaker will be presenting some of his findings on remailers involving reliability and getting nyms to function for those not versed in the field. It should be useful information for anyone using remailers. (He had a few findings that surprised me...) I have had a few interesting "maybes", but I will wait until (or if) they show up... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMP1nl+QCP3v30CeZAQFtGAf8DEofknvToxZWO5upwZoFiSUCaENrPtM/ 6t6Mdl3eTZHan28qJV9vXkKAG6Q9gANQ342NQeH1CbmOalNLxnVrETbKTKv8llNG ASH1iZML//JEQJT3XeHYHAPBBCg18zIfskjU0h0of60MzmcsykHN/ZJTIpps8UIq sgB8fk2Uh9LVg/VFyIvnVnpIMQPZ1W+Z5YQco3rEnqKycKjOi0E0XoKsaJFoWelj 1aHtmWrXxC1Lr2H7fVa0DsF5Vh3w5h2RaelpZBR8QB7Uz8JwYb4jaBtdkrSMlqeg IGZaKirdZDX7i0geB905aVVdiRrahbAz4nV82DxkVEbn/h56XHAtvg== =3PKR -----END PGP SIGNATURE----- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Hack Microsoft Promotion Gets some Press
by Rich Graves 17 Dec '03

17 Dec '03

Just FYI, and patting everybody on the back. I've tried to deflect the credit, and at least in PC Week I was successful. January 8th PC Week, Netwired section, only distributed in print I think (which is odd). It mentions c2.org as a "controversial link" on the win95netbugs FAQ, which is odd because nobody has ever complained to me or on the newsgroups about it. But controversy sells, so that's probably a plus anyway. http://www.zdnet.com/~pcweek/ (their Web server sucks, though, you might not get through) InfoWorld, next issue, probably on the cover. http://www.infoworld.com/pageone/nickextra.htm San Jose Mercury News, probably tomorrow or the next day, not sure whether it's the main section or the computing/business section. http://www.sjmercury.com/ MERCURY on America "Online" Simson is rapidly approaching deadline and has frozen his sources, so please disregard my last about sending anything further to him. I will accept it and pass it on to anyone who inquires in the future. I think I was probably too timid by half in not violating anyone's anonymity by even forwarding notes to Simson and by not spamming Simson's mailbox, but that's OK, it'll all come out eventually. Watch these spaces for Microsoft's response. http://www.microsoft.com/windows/pr/clarifications.htm http://www.wagged.com/ Three cheers especially for Peter, Frank, and Sameer. -rich(a)c2.org http://www.c2.org/hackmsoft/ llurch(a)networking.stanford.edu http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html

1 0

Returned mail: User unknown (fwd)
by Alan Horowitz 17 Dec '03

17 Dec '03

Alan Horowitz alanh(a)norfolk.infi.net ---------- Forwarded message ---------- Date: Thu, 18 Jan 1996 08:27:15 -0500 From: Mail Delivery Subsystem <MAILER-DAEMON(a)infi.net> To: alanh(a)larry.infi.net Subject: Returned mail: User unknown The original message was received at Thu, 18 Jan 1996 08:26:56 -0500 from alanh@localhost ----- The following addresses had delivery problems ----- Name Withheld by Request <anon-remailer(a)utopia.hacktic.nl> (unrecoverable error) ----- Transcript of session follows ----- ... while talking to utopia.hacktic.nl.: >>> RCPT To:<anon-remailer(a)utopia.hacktic.nl> <<< 550 <anon-remailer(a)utopia.hacktic.nl>... User unknown 550 Name Withheld by Request <anon-remailer(a)utopia.hacktic.nl>... User unknown ----- Original message follows ----- Received: by larry.infi.net (Infinet-S-3.3) id IAA19226; Thu, 18 Jan 1996 08:26:56 -0500 Return-Path: alanh Date: Thu, 18 Jan 1996 08:26:56 -0500 (EST) From: Alan Horowitz <alanh(a)infi.net> To: Name Withheld by Request <anon-remailer(a)utopia.hacktic.nl> cc: "Alan Horowitz <alanh(a)infi.net> \"Timothy C. May\"" <tcmay(a)got.net> Subject: Re: PPF #25 and the UN test In-Reply-To: <199601180540.GAA14063(a)utopia.hacktic.nl> Message-ID: <Pine.SV4.3.91.960118080009.15630B-100000(a)larry.infi.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Very interesting. You make bona-fide sounding noises. Now let me ask you this. Do you think that USA has, or will ever have, security organs as kick ass as the East Germans had? Yet within a short time after the Soviets decided, to cede that whole part of Europe, to the Bonn sphere of influence, those East German operatives were running to cover their ass. Love of Liberty runs deep within the American psyche, analogously to the way that devotion to Islam runs deep in the Arab countries. The Islamists have plenty of sympathizers in various Arab security organs. Let's recall that President Sadat was shot by bona fide memmbers of the Egyptian military, in a highly organized operation. If you were a CFR guy, would you bet your life that you could order 500 more Wacos, without having to fear that thre would be no loyalty problems inside your chosen operating units? Let's accept that 20% of the SEALS said they'd confiscate legally-owned firearms from Americans....is 20% enough? Of the other 80%, could you rely on _none_ of them to casue major, major problems? The secret government has had total control of the economy, since the day the Federal Reserve was delegated the authority to create national debt. America is already well-controlled for the benefit of Insiders. They really don't need to attain higher visibility or more power. They are anglo-saxons, not banana-republic cult-of-personality types. Does Walter Wriston have to worry about Tim May deciding to stockpile blackpowder rifles? The SEALs are cannon fodder. They know it. Alan Horowitz alanh(a)norfolk.infi.net

1 0

RE: Alta Vista, Great Stuff!
by Steve Gibbons 17 Dec '03

17 Dec '03

In Article: <199601170427.XAA27753(a)UNiX.asb.com>, Beethoven <wlkngowl(a)unix.asb.com> wrote: # Hey, I saw a message on the list about personal mail # showing up in an A.V. search, and figured why not try # it out and see what comes up under one of my nyms... # Lo and behold, my nym corresponds with the title of a # popular comic strip and an episode in a bad TV show... # Crypto related? # Imagine your nym is related to something common-place at # the time of posting. Even though you may be well known # under that nym, simple searches for that name will turn up # loads of crapola, or at least some light entertainment # for someone searching for oyur past posts. # (It can also turn some unsuspecting people looking for the # crapola onto your interests...) # Yes, I know that sophisticated search engines and simple # expressions can filter out most of the unwanted junk, but # not all of it. Likewise filtering will let some of your # posts fall through the web-crawler-cracks. I've ran into three similar situations lateley. 1) Quite a few people assume that aztech.com is Aztech Labs, the makers of various sound cards, video cards, and CD-ROM drives. (I _wish_ these fols would use the various search engines to find who/what they're looking for.) 2) I'm hosting a web-page for a band called One Foot In The Grave. There's a (fairly popular, I guess) British sit-com by the same name, with quite a few followers that have set up pages for the TV show. 3) There happens to be a steve(a)tezcat.com, and we occasionally receive email from long-lost aquaintances that was intended for the other. Generally this is in response to something that either one of us posted to Usenet. Crypto relevance? Only on item 3, if PK encryption was in wide-spread use, and easy to use, this wouldn't happen. The MUA would realize that it didn't have a local PK key for steve(a)tezcat.com, and inform the user (who could then perform a soundex lookup on their existing keys, and realize that they meant to contact steve(a)aztech.com.) Soundex (or equivilant technology) search spiders are going to make the whole mess even worse... ObPunk: I decided that the easiest way to hide from item 1 was to change domain names. By chance, someone else was interested in aztech.com, so I even made a profit. :) I keep meaning to write something up, and submit it to comp.risks, but who has the time?... -- Steve(a)AZTech.Net

1 0

underground digital economy
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Question: The existing underground economy uses the same money as the aboveground economy (i.e. paper money, for the most part). Could a significant underground digital economy develop if the aboveground digital economy used only identified e-money? Jim_Miller(a)suite.com ____________________________________________________________________ The Internet is a land bridge for memes ____________________________________________________________________

1 0

Scientic American
by Dan Harmon 17 Dec '03

17 Dec '03

The latest issue of SA has a small piece in zero knowledge transactions in the Math Rec section. Dan

1 0

Re: A WfW security curiosity (possibly another security hole)
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>>[WFWSYS.CFG file] > >This is the file used by admincfg.exe (on WFW3.11 disk 8). This file >contains "security" settings, such as whether or not to cache passwords >on disk (*.PWL files). Ahh, so you can silently reenable password cacheing by manipulating this file, thereby defeating Microsoft's "turn off password cacheing" kludge. Wonderful. I'll have a poke around on Monday to figure out what bits to flip and post the results here. Thanks for the info... Peter.

1 0

noise levels
by Perry E. Metzger 17 Dec '03

17 Dec '03

The noise levels around here are getting astounding. Posts on windows registration wizards, gun control, unemployment, Kevin Mitnick's underwear, and all the rest are most certainly NOT doing us any good. Here we are in the midst of IBM putting espionage enabled versions of Lotus Notes out (someone should be putting out a hack to change the embedded public key), Microsoft putting out a crypto API that could potentially be of enormous interest, activity moving in the Karn lawsuit, and all sorts of other important events, and YOU DUNDERHEADS ARE MAKING IT IMPOSSIBLE TO CARRY OUT IMPORTANT DISCUSSIONS. If you want to help the NSA in its mission to stop the dissemination of strong crypto, by all means, continue posting garbage. Perry

6 5

EPIC: Commerce Report on Crypto Availability
by tc＠phantom.com 17 Dec '03

17 Dec '03

Commerce Releases Crypto Availability Report The US Department of Commerce today released a report on the international market for encryption software. The report, which was jointly produced by the Commerce Department's Bureau of Export Administration and the National Security Agency reviews the foreign availability of encryption products and other nations' import, export and domestic use policies. The report finds that there are foreign products available which "can have an impact on US competativeness" and that US export controls "may have discouraged US software producers from enhancing the softare features of general purpose software to meet the anticipated growth demand by foreign markets. It anticipated that there is a steadily increasing demand for crypto to be included in general use software products becuase of well publicized break-ins. A large portion of the report has been redacted by the NSA. EPIC filed suit under the Freedom of Information Act in December 1995 to obtain a full copy of the report and will continue to demand its release. EPIC believes that the US goverment should remove export controls on public domain and commerical software that contains encryption and end the policy of demanding that key escrow be implimented in all encryption software. Enclosed in the Commerce Department Press Release and Executive Summary of the report. The full report is over 100 pages. EPIC will make every effort to make the full report available in electronic form as soon as possible. More information on crypto policy is available at the EPIC Web Site at http://www.epic.org/crypto/ UNITED STATES DEPARTMENT OF COMMERCE NEWS WASHINGTON DC.20230 OFFICE OF THE SECRETARY FOR IMMEDIATE RELEASE CONTACT: Carol Hamilton Thursday, January 11,1996 (202) 482-4883 Eugene Cottilli (202) 482-2721 DEPARTMENT OF COMMERCE RELEASES STUDY ON THE INTERNATIONAL MARKET FOR ENCRYPTION SOFTWARE Washington, D.C. -- The growth of an international market for encryption software is being slowed by strong export controls, both in the United States and other major countries. Moreover,the quality of products offered abroad varies greatly, with some not providing the level of protection advertised. The study, jointly prepared by the Commerce Department's Bureau of Export Administration (BXA) and the National Security Agency (NSA), evaluates the current and future market for computer software with encryption, which allows users to protect their data using codes. The study also reviews the availability of foreign encryption software and assesses the impact that U. S. export controls on encryption have on the competitiveness of the software industry. "Our study provides a clear snapshot of the international competition in this segment that the software industry faces," said Cornmerce Secretary Ron Brown. "Better understanding of the products and the marketplace gives us the tools to ensure that our export control policies are appropriate," he added. The study noted encryption software presently accounts for only a small percentage of the total computer software but should grow substantially as the U.S. and other countries deveiop and expand public networks and electronic commerce. The study found that the U.S. software industry still dominates world markets. In those markets not offering strong encryption locally, U.S. software encryption remains the dominant choice. However, the existence of foreign products with labels indicating DES (Data Encryption Standard) or other strong algorithms, even if they are less secure than claimed, can nonetheless have a negative effect on U. S competitiveness. The study also notes that the existence of strong U.S. export controls on encryption may have discouraged U.S software producers from enhancing the security features of general purpose software products to meet the anticipated growth in demand by foreign markets. page 2 All countries that are major producers of commercial encryption products were found to control exports of the products to some extent. A few countries (e.g., France, Russia, and Israel) control imports and domestic use of encryption, as well. As part of the study, NSA evaluated twenty-eight different foreign encryption software products, finding that some were less secure than advertised. Because customers lack a way to determine actual encryption strength, they sometimes choose foreign products over apparently weaker U.S. ones, giving those foreign products a competitive advantage. -30- A STUDY OF THE INTERNATIONAL MARKET FOR COMPUTER SOFTWARE WITH ENCRYPTION [Note: This is a redacted copy of the ogigional secret decoment. Brackets [] accompanied by the origional classifications have been used to indicate location and size of excised classified text] Prepared by the U.S. Department of Commerce and the National Security Agency for the Interagency Working Group on Encryption and Telecommunications Policy EXECUTIVE SUMMARY BACKGROVND In late 1994, the President's National Security Advisor directed that an interagency report be prepared assessing the current and future international market for software products containing encryption and the impact of export controls on the U.S. software industry. The report was to include an assessment ofthe impact of U.S. encryption export controls on the international competitiveness of the U.S. computer software industry and a review of the types, quality, and market penetration of foreign-produced encryption software products. This paper presents the joint efforts of the Department of Commerce/Bureau of Export Administration and the National Security Agency to complete this tasking. (U) EXPORT CONTROLS All countries that are major producers of commercial encryption products control exports of those products to some extent. Control methodologies and licensing practices vary, however, and a few countries, most notably France, Russia and Israel also control imports and/or domestic use of encryption. There is a significant amount of international cooperation in controlling encryption exports. (U) Some European and other countries apparently treat exports to the United States of DES- based software more liberally than the United States treats DES exports to those countries. Some countries have stated that they generally restrict DES exports to financial end-uses. In general, no independent verification of these licensing practices was obtained. However, in some cases the U.S. was able to obtain DES products from them for non-financial end-uses. It is possible that some countries may allow these exports based on their political/economic/military relationship with the destination country (e.g., within the European Comrnunity, or former COCOM), for end uses that are considered legitimate commercial applications of the technology, or, in the case of exports to the United States, because DES is a national standard. (U) As the technology and the marketplace have evolved, the USG export control authorities have relaxed licensing constraints on cryptographic products several times over the past 10 years. These changes have usually been made after industry pressures and internal debate to balance national security and economic concerns. (U) DOMESTIC AND INTERNATIONAL MARXETS While presently encryption software accounts for only a small percentage of the total software market (1-3%), according to numerous information security experts contacted in the course of the study, the future growth trend for this sector is expected to be great. The market for encryption in distributed computation, databases, and electronic mail is beginning to expand exponentially as the U.S. and other countries develop and popularize electronic commerce, public networks, and distributed processing. (U) Encryption in these environments will often be implemented in software, as opposed to hardware, because it is generally less expensive and simpler to install and upgrade. Absent changes in government standards, for the next ten years, encryption software will primarily use DES and RSA-licensed encryption algorithms. Other non-standard and company proprietary algorithrns will be used primarily for security-specific products for small niche markets. (U) Certain developments are promoting greater use by the general public of software-based network security features, including encryption, throughout the industrialized world. They include ever increasing use, fueled by well publicized "break-ins," of distributed databases, popular acceptance and usage of global networks, and the development and use of electronic commerce. (U) These developments are ongoing at one stage or another in practically all of the countries surveyed for this assessment. Less technologically advanced countries, where demand for encryption software is reportedly negligible, will soon undergo widespread development and computerization leading to increased demand for encryption so~ware within the next 10 years. (U) The overwhelming majority (75%) of general-purpose software products (e.g., word processors, spread sheet programs, and database programs) available on foreign markets today are of U.S. origin. Cornmerce Department analyses indicate that the U.S. has few viable foreign competitors for such products, and of those general-purpose products with encryption features, all were found to be of U.S. origin. (U) In the security specific software market, however, U. S. manufacturers face competition in several foreign markets from such encryption exporting countries as the United Kingdom, Germany, and Israel. To a large extent, markets for these products tend to be "national. " Not only do export controls affect sales, but local vendors of security-specific products are at a competitive advantage in that they are better situated to work closely with end- users and develop encryption solutions tailored to meet the conditions of the local environment. (U) NSA confirmed the existence of a significant number of foreign security-specific software products with encryption features, predominantly from Western European suppliers. Security-specific products are usually not available on the shelf at retail stores either in the U.S. or abroad, but can be purchased through direct contact with the manufacturer. (U) ES-2 BXA attempted to quantify U.S. competitiveness and market share in 31 foreign countries where encryption is thought to have significant demand. While sources in the countries surveyed had limited access to import statistics or market literature on encryption software and encountered nwnerous difficulties in evaluating this complex market, definite conclusions may be drawn from the responses. (U) Sources in 14 countries indicated that U.S. export controls limit U.S. market share in their countries. Sources in seven countries indicated that export controls have either no impact or no major impact. (U) Sources in most countries indicated that the U.S. market share is keeping pace with overall demand despite the impact of U.S. export controls, which may promote indigenous production or reduce U. S. market penetration. In all known cases, the U.S. holds the majority of the general-purpose encryption software market. (U) Three exceptions are Switzerland (where the U.S. market share reportedly declined in 1994, while the market shares of other European countries rose), Denmark and the United Kingdom, which reported unspecified declines from previous years. Sources in all three countries attribute the decline to U.S. export controls, which they claim promote the development and sale of indigenous encryption products. (U) In many countries surveyed, exportable U. S. encryption products are perceived to be of unsatisfactory quality. (U) ANALYSIS OF FOREIGN PRODUCTS NSA used various methods to procure encryption software products from a variety of countries and companies, as reflected in the TIS database and other sources. Altogether, 28 products from 22 foreign producers in 10 countries were acquired for the purposes of this study. Of these, 21 purportedly use the DES algorithm, while the remaining 7 use proprietary algorithms. (U) [ ] (S) ES-3 ECONOMIC IMPACT In the absence of significant foreign competition, the impact of U.S. export controls on the international market shares of general-purpose products is probably negligible. Customers are often unaware of the encryption features in these products and primarily base purchases on the features implementing the primary function of the product (e.g., word processing or database). (U) [ ] (S) BXA attempted to quantify the economic impact of export controls on the U.S. software industry by forwarding a detailed voluntary questionnaire to 206 software vendors and other interested parties. Thirty six encryption software manufacturers provided completed surveys out of the 71 returned. By and large, the companies were unable or unwilling to quantify the costs of export controls, but did provide substantive explanations of how and why they believe they are adversely affected. (U) Some general-purpose software companies claim that export controls have affected their plans to expand security features to meet anticipated growing demand. These companies believe that they could expand their domestic and international customer base with such features. (U) The export licensing process itself is not a major obstacle to U. S. competitiveness. Only seven survey respondents use the Department of State licensing system. While they continue to have some complaints about the administrative burdens and time delays associated with State's process, several noted that there had been improvements in recent years. Only two of the survey respondents had been denied licenses by the Department of State. (U) Numerous survey respondents indicated that they avoided applying for export licenses from the Department of State altogether. Some larger companies whose products tended to be general-purpose in nature either developed two ~fersions of so~ware, or incorporated an encryption algorithm they knew would qualify for Commerce general licenses. (U) Many smaller, security-specific software firms, on the other hand, elected to limit their sales to the domestic market only. These companies indicated a high level of foreign interest in purchasing their products, and therefore lost potential sales. While it is difficult for them to quantify their potential market, they believe it to be sizeable. They claim their small size limited their ability to develop two versions of their products, and the fact that their products were for secunty purposes ES-4 specifically requires them to incorporate strong encryption. Only one company was able to provide specific examples where a foreign competitor o~ta ned a sale due to an export license denied by U.S. authorities. (U) There is little evidence that U.S. export controls have had a negative effect on the availability of products in the U.S. marketplace. A broad range of products with secure algorithms exist in the U. S. market and availability of products is based principally on the level of customer demand. Export controls may have hindered incorporation of strong encryption algorithms in some domestic mass-market, general-purpose products, since some companies find developing and maintaining two versions of a product infeasible. (U) The existence of foreign products with labels indicating DES or other strong encryption algorithms, even if they are less secure than claimed, can nonetheless have a negative effect on U.S. competitiveness. Most encryption users base their purchasing decisions on the advertised product features, along with price, company reputation, etc. (U)

1 0

Re: Lotus to export 64 bit, partially-escrowed Notes
by jim bell 17 Dec '03

17 Dec '03

At 03:45 PM 1/17/96 -6, Peter Trei wrote: >A new 'international' version of Lotus notes is being released, with >64 bit session keys, as opposed to the old 40 bit version. > >24 bits of the session key are stored encrypted under a special, >government-access RSA public key. This is in addittion to the full >64 bit key being available under the recipient's public RSA key. > >The idea is that the USG would have to search only a 40-bit keyspace, >while others will need to search a 64-bit keyspace. >Reportedly, this 'workfactor reduction key' will NOT be available to >foreign governments. >My colleague reports that opinion at the conference was divided over >whether Lotus was doing something which made good business >sense, or whether this was 'caving-in'. My "vote"? They're "caving-in."

2 1

Crippled Notes export encryption
by Alan Pugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -- [ From: Alan Pugh * EMC.Ver #2.3 ] -- Since this is definitely on-list, and I haven't seen anything on it here yet, I'm posting the whole thing. Apologies for duplication. Date: Wednesday, 17-Jan-96 04:23 PM Subject: infoMCI FLASH - Lotus-Security - Lotus Announces C [infoMCI FLASH] i n f o M C I F L A S H infoMCI (sm) Lotus-Security - Lotus Announces Compromise for Export of Strong Encryption By ELIZABETH WEISE AP Cyberspace Writer SAN FRANCISCO (AP) _ Lotus Development Corp. announced a compromise with the federal government Wednesday that will allow it to put better security features into the international version of its Notes program. While the arrangement assures the government it can access data under extreme circumstances, it represents an advance in the strength of security allowed in software exported from the United States. Federal law prohibits the export of certain high-level encryption programs, which are defined as a munition under a Cold War-era arms control act. Encryption programs take ordinary data and put it in secret form that cannot be accessed without the proper data ``key.'' The government's arbitrary standard for cracking encryption programs when needed is at a technical level described as ``40-bit.'' Some software programs sold in the United States, including Lotus Notes, now use stronger 64-bit encryption. Lotus has been under pressure to bring such security to Notes users overseas. Although 40-bit encryption is quite strong, highly-sophisticated attacks using several computers have been able to break it recently. ``Our customers have basically lost confidence in 40-bit cryptography,'' said Ray Ozzie, president of Iris Associates, the unit of Lotus that developed Notes. ``That left us in a bind. We are the vendor that's supposedly selling a secure system to them and they are saying it's no good,'' Ozzie told a standing room audience at the RSA Data Security conference. Changes in the general export laws seemed unlikely so Lotus negotiated an interim solution. The export version of Lotus Notes 4.0, which went on sale last week, includes 64-bit encryption but the company has given the U.S. government a special code that unlocks the final 24 bits. For companies that use the international version of Notes, it's as if Lotus put two strong locks on a door and gave a key for one to the U.S. government. Thieves have to get break through two locks, the government only one. ``This protects corporate information from malicious crackers but permits the government to retain their current access,'' Ozzie said. He acknowledged the solution was only a compromise and said Lotus wants to see better data security methods developed worldwide. However, many participants at the conference saw the move as a cosmetic answer to the tension between corporate desires for the best security and government's interest to access data when necessary. ``It's a useful stopgap measure that has no value in the long run,'' said Donn Parker, a senior security consultant with SRI International, a computer research company in Menlo Park, Calif. Simson Garfinkel, author and computer security expert, said he's not sure international buyers of Notes will like the solution. ``Foreign companies don't want the U.S. government to spy on their data any more than the U.S. government wants foreign companies to be able to spy on theirs,'' Garfinkel said. International Business Machines Corp. bought Lotus in July, citing the success of Notes, a sophisticated communications and database program. AP-DS-01-17-96 1619EST (66413) *** End of story *** - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMP2KdioZzwIn1bdtAQGdegF9GVCEfL50vWd7e5XX/mKEnzGy5YGvW0iD rNPCmz3Xxf3h9wOVJMLrCeDGwe4/m84g =6jpa -----END PGP SIGNATURE-----

4 3

[NOISE] Re: A Modest Proposal: Fattening up the Proles
by Bruce Baugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 08:54 AM 1/17/96 -0500, John Young <jya(a)pipeline.com>wrote: > By any means, emulate elitist indolents and avoid anxiety. > Display iron-fisted civilized beliefs, practice tough-love > humiliation and master-over-slave manners and militant > mind-couture, but do nothing truly disruptive of the status > quo that so rewards niche market exploiters of genuine > dissent. The patient displays advanced signs of Stephen Donaldson's Disease. We recommend _immediate_ replacement of the TrendyLeft <tm> thesaurus and spelling checker package with more robust models. Strunk&White GoodWrite <tm>, say, or perhaps RichardScarrySoft <tm>. More seriously, I recommend a re-reading (or first reading, as it may be) of Orwell's "Politics and the English Language". I quote: "In our time it is broadly true that political writing is bad writing. ... Orthdoxy, of whatever color, seems to demand a lifeless, imitative style. The political dialects to be found in pamphlets, leading articles, manifestos, White Papers and the speeches of under-secretaries do, of course, vary from party to party, but they are all alike in that one almost never finds in them a fresh, vivid, home-made turn of speech. When one watches some tired hack on the platform mechanically repeating the familiar phrases - bestial atrocities, iron heel, bloodstained tyranny, free peoples of the world, stand shoulder to shoulder - one often has a curious feeling that one is not watching a live human being but some kind of dummy. ... And this is not altogether fanciful. A speaker who uses that kind of phraseology has gone some distance towards turning himself into a machine. ... "Consider for instance some comfortable English professor defending Russian totalitarianism. He cannot say outright, 'I believe in killing off your opponents when you can get good results by doing so.' Probably, therefore, he will say something like: 'While freely conceding that the Soviet regime exhibits certain features which the humanitarian may be inclined to deplore, we must, I think, agree that a certain curtailment of the right to political opposition is an unavoidable concomitant of transitional periods, adn that the rigors which the Russian people have been called upon to undergo have been amply justified in the sphere of concrete acheivement.' "The inflated sytle is itself a kind of euphemism. A mass of Latin words falls upon the facts like soft now, blurring the outlines and covering up all the details." Ironically, of course, Tim May's brutal honesty (right or wrong, he's almost always clear) is lots more "populist", the sense of being readily and widely understood, than John Young's stale academese. Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMP2PZX3AXR8sjiylAQG6gAfPVudIcO/WocUGwVYF7GVk5GvYT7ToYnR0 76SQXeEmwuvoG0reFoJdKJEGpJ5IQTboIgIyHYmEtirteH3y1vGeeiqQfmIhtx+S aUUtNHSOGKNUfSNvwY2Fw0Ij/3sAR16jZFmh4T1TPRW1xwgo0KYUkvB4tk5tx1sD Hzd+D2cPJNP/WhmwntkaXhynwnlgcYyLxqwjoD4QfiEHHS0Lbv+JVWuutJpKTih0 yFnhStoD9YL0ynZwIbfqZpl7HiX3FAAQ7aNLFPyqqRajJmTO7GuQLju8T1cWT+n+ oUTzgmXLtw5FY4OOLPR6mKkLvilyb1UzmX+GG/AlA671Ng== =qBu4 -----END PGP SIGNATURE----- Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0

Re: Ozzie Apes Jim Clark, Fix Is In to Cave and Cry
by Frank Stuart 17 Dec '03

17 Dec '03

>Wall Street Journal, Jan 18, 1996 > >IBM Compromises on Encryption Keys, U.S. Allows Export of >More-Secure Notes [...] >The new overseas version of Notes, tagged Release 4, will give >foreign users 64-bit security. But to get permission to export >the software, Lotus agreed to give the government access to 24 >of those bits by using a special 24-bit key supplied by the ^ >National Security Agency. [...] Does anyone know if there really is just one 24-bit key for every copy of Lotus Notes or is this a miscommunication? If there really is just one 24-bit key for everyone, can't you just look for the bits that don't change among different 64 bit keys? (e.g. AND a "sufficiently large" number of 64-bit keys together to find the 1's that don't change and then OR them to find the 0's until you've got the 24 bit key). Someone, please tell me that's not how it works (or post the 24-bit key :>). | (Douglas) Hofstadter's Law: Frank Stuart | It always takes longer than you expect, even fstuart(a)vetmed.auburn.edu | when you take into account Hofstadter's Law.

2 1

Re: CryptoAPI and export question
by hallam＠w3.org 17 Dec '03

17 Dec '03

>Two points: the CSP development kit is export-controlled; and signing a >CSP developed by a foreign vendor is treated as a export -- so the signature >is export-controlled. >We would ship a CSP development kit to a foreign vendor, and sign a CSP >developed by the foreign vendor, but only with the appropriate export licenses. This could lead to problems. I'm not sure what the European Community reaction to US attempts to export its legal system will be. The problem is that the Lotus Notes scheme changes the previous deal. Before the European governments benefited from the US export control laws because they had wiretap abilities. Now they are denied wiretap capabilities and have the US able to snoop on all their traffic. Could find yourselves in the middle of a nasty battle... Phill

1 0

Base conversion
by grimm＠MIT.EDU 17 Dec '03

17 Dec '03

I am trying to write some code to perform base conversions on very large numbers (possibly as large as 256^(2^(ULONG_MAX))). Specifically, I store the numbers in base 256, but I would like to be able to print them in base 10. Any really brillant ideas? -James

1 0