December 2003 - cypherpunks-legacy

Marshall McLuhan and encryption...
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

> Nick's a big shot at Wired magazine. So it should be no surprise > to learn that Wired attacked cypherpunks in its 01 96 issue. In > a fake interview with "Wired's patron saint," Marshall McLuhan is > made to say (p 130): > > Concerns about privacy and anonymity are outdated. Cypherpunks > think they are rebels with a cause, but they are really senti- > mentalists. Well, maybe McL. would have spit such nonsense, very characteristical of him. "The media is the message" is among the biggests con jobs performed on humanity. It's like having a guy dying form thirst and telling him: "The pipe is the beverage"... One fine example of the destruction of reason. If a PGP encrypted message was sent to Mr.McLuhan, could he see if it is a "there is a contract on you..." or "happy new year" or "I love you..." To any Cypherpunks, the media *IS NOT* the message! Dear Wired peoples and Mr. McLuhan: get lost! > The era of politics based on private identities, anonymous indi- > viduals, and independent citizens began with the French Revolution > and Napoleon's armies...and ended with Hitler.... The cypherpunks > are still marching to the same martial music. He is partially right. With Renaissance, came the idea that Reason and human mind were powerfull and that knowledge, because man's only survival tool is reason, is a value to pursue. But french revolution did not convey theses ideas, neither did Napoleon. And Hitler definitely not. All of the three were, ultimately, collectivists or looters. Therefore, the author of the text is guilty of setting up straw man and of context blanking. JFA Reality Is. Existence exists. Words have a precise meaning. $

1 0

Re: C2 and the Worst Case
by an359557＠anon.penet.fi 17 Dec '03

17 Dec '03

>Are you saying that when someone with an anonymous mailbox on c2.org >retrieves his/her mail via a POP3 connection, no log is made of >the originating IP address? It's even worse than that. The IP address/hostname that connects to c2 shows up when you finger that user on c2! Sameer, can you please change that? An anonymous user don't wanna leave a trail as obvious as an IP address. --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

2 1

Telecoms Bill
by Mark Grant, M.A. (Oxon) 17 Dec '03

17 Dec '03

Well, if "cypherpunks write code", is there any code we should be writing in response to this? Mark

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

<<"In other words it was stvation/devastation city">> It was lot worse than that on the Japanese-imperialits occupied islands of the Pacific when the Nisei troops choosenot to surrender and instead, mad last-ditch charges against AMerican lines - which killed not a small number of Americans. And of course, there were the suicide bombers. Submarine operations don't cost zero lives, either. In fact, just plain old regular military logistics - keeping the boys mobilized and in place ina theatre of operations - don't cost zero lives, even if there are _no_ hostilities. And while all the starvation and devastation was going on in Japanese cities, the Japanese troops were torturing and murdering Allied POWs, and Asian civilains in all the Japanese-occupied teritories. Those people deserved liberation, too. I think you give your game away when you complain about how we were being unfair to Comrade Stalin. As far as Pax Americana goes, the Japanese just _volunteered_ to_increase_ the payments they make to support the American garrison in Japan. The non-Okinawans want us in their country. I guess they know that the alternative is a Red Chinese garrison. And lots of other Asians are afraid of the same alternative - or of Japanese garrisons in their homeland. THey've "been there, done that". Alan Horowitz alanh(a)norfolk.infi.net

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

On Sun, 4 Feb 1996 Pot(a)networking.stanford.edu wrote: > This is not FLAMEpunks. > WHAT??? --and miss all the fun? __________________________________________________________________________ go not unto usenet for advice, for the inhabitants thereof will say: yes, and no, and maybe, and I don't know, and fuck-off. _________________________________________________________________ attila__ To be a ruler of men, you need at least 12 inches.... There is no safety this side of the grave. Never was; never will be.

1 0

fcpunx subscribe
by Wendy Fu 17 Dec '03

17 Dec '03

Wendy Fu, Network Manager St. John's University School of Law 8000 Utopia Parkway, Jamaica, NY 11439 E-Mail Address: wfu(a)sjulaw.stjohns.edu Phone: (718)990-1666

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

>> INFORMATION IS INSECURE THE MOMENT YOU TOUCH A KEY. > >> This does not mean that Internet commerce is dead. Any scheme that is >> not based on self-identifying one-way financial instruments such as >> credit cards will be essentially unaffected by this problem. Moreover, >> even credit cards may be made safe on the Internet using one of two >> approaches: secure hardware add-ons and the First Virtual approach. etc. My name for this kind of software: Terminate and Stay Clueless ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Although this particular request was sent to the cypherpunks mailing list, others continue to send requests to my mailbox. >>>>> "Wendy" == "Wendy Fu" <WFU(a)sjulaw.stjohns.edu> writes: Wendy> endWendy Fu, Network Manager Wendy> St. John's University School of Law Wendy> 8000 Utopia Parkway, Jamaica, NY 11439 Wendy> E-Mail Address: wfu(a)sjulaw.stjohns.edu Wendy> Phone: (718)990-1666 I don't know how my address got associated with this list, but please, *do not* send requests about FCPUNX to steve(a)miranova.com. Requests about how to set up Gnus scoring for performing your own filtering of the cypherpunks list are welcome. -- steve(a)miranova.com baur Unsolicited commercial e-mail will be proofread for $250/hour.

1 0

Re: Fair Credit Reporting Act and Privacy Act
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:25 AM 2/5/96 -0500, Frank Willoughby wrote: >If the Privacy Act were rewritten to be as strict as the BDSG, businesses >would have a (mandatory) legal requirement to: > >o Ensure that personal data is stored properly (by encrypting it, etc) >o Ensure that personal data is not distributed >o Ensure that databases are *not* being maintained which describe the > characteristics of individuals (buying habits, income, property > ownership, etc) wantonly propagated by marketing (direct mail, > telemarketing, etc) companies. > Unfortunately, it would also: * Require government registration of computers and databases containing information about people (whether these computers are used by business or individuals). This eases regulation of computers and future confiscation. * Reduce market efficiency by making it harder to match buyers and sellers (because neither could easily find out about he other) thus causing higher prices and poorer people. * Do nothing to protect personal information from the government which would get to collect more of it than ever in the course of enforcing data protection laws. If you don't want people to know things about you, don't tell them. DCF

2 1

IMC Resolving Email Security Complexity Workshop
by abarrett＠ee.net 17 Dec '03

17 Dec '03

Found this in the box the other day - thought it might be of interest, esp regarding secure email standards. Warmest regards, AJ <---- Begin Forwarded Message ----> Return-Path: dcrocker(a)brandenburg.com Date: Tue, 23 Jan 1996 10:20:50 -0800 To: (potential attendees) From: Dave Crocker <dcrocker(a)brandenburg.com> Subject: IMC Resolving Email Security Complexity Workshop This is a query of your interest in participating in a working meeting. As an initial activity of the newly-formed Internet Mail Consortium, we are hoping to use the coincident timing of EMail World in San Jose and the ISOC Security Conference in San Diego to call for an all-day meeting on the matter of email security. (If you aren't familiar with the IMC, please check out info(a)imc.org or <http://www.imc.org/>.) This note is intended as a pre-announcement and a solicitation for feedback concerning your interest. We'd like to get a sense of the number and range of folks who might/can/will attend. We do not yet have logistics or finances fully worked out, but the timing pressure is tight enough to warrant this letter before the official announcement. Comments about the activity and, especially, an indication of availability, willingness, and (best of all) intention to attend would be highly welcome. Please pass this note on to others who you think are (or should be) interested in email security. Specifics As its first activity, the Internet Mail Consortium proposes to organize a one-day workshop to consider the problem of multiple MIME-based security mechanisms. This is a complicated topic with a long and painful history, but the previous pain is insignificant when compared to what is emerging for vendors and, worse still, for users. Our proposal is to conduct an open meeting with attendance by principals and others involved in this area of work. We will invite the key contributors and solicit additional attendance by vendors, providers, users, and technologists who are concerned with email security. The attendance goal is to have a critical mass of those with the technical expertise and industry involvement to review and debate the requirements, capabilities, and possibilities. The work goal is to seek common ground for a common solution. While we are not overly hopeful that the end of the day will see peace and resolve among the masses, we do hope for a large amount of improved understanding and some amount of convergence. With luck, there will even be improvement in the clarity of constituency for the different technical choices -- that is, a strengthening of the political base for some of the alternatives. We would like to hold the event: Wednesday, 21 February 8:30 am - 5:30 pm (all day) (Near) EMail World event, San Jose Convention Center, CA. This is the last day of EMail World and the day before a two-day ISOC Security conference in San Diego. We propose to structure the meeting with a tight agenda, having a very focused sequence of work on the problem; this is definitely not for general education. Some amount of review is appropriate, but not much. Attendees will be expected to be knowledgeable in the basic technologies, so that only general systems design and specific algorithm choices need to be cited. To help everyone prepare, the Internet Mail Consortium will organize a set of mail-response and Web pages with references and summaries of the current technologies, and will establish a mailing list for exchanges leading up to the meeting. Proposed Agenda Morning Brief descriptions of the candidate solutions Review of the functional and technical requirements Review the extent to which each alternative satisfies the requirements Seek consensus about the requirements Afternoon Haggle about the strengths and weaknesses of the technical alternatives Explore the choices and/or negotiate a preferred solution Those who have worked on this topic in the IETF are quite tired of the whole situation, but the unfortunate reality is that the current product and user choices are quite problematic. We need to continue seeking a viable service. We expect to charge $50 per person, to cover basic costs. I should have more details about this next week. Please do let us know your comments. Thanks! d/ -------------------- Dave Crocker +1 408 246 8253 Brandenburg Consulting fax: +1 408 249 6205 675 Spruce Dr. dcrocker(a)brandenburg.com Sunnyvale, CA 94086 USA http://www.brandenburg.com <---- End Forwarded Message ----> __________________________________________________________________ Out the buffer, | PGP encrypted e-mail preferred. Through the com port, | Finger for Public Key. Over the POTS line, | Also available on a key server near you. Into the NT Box, | Up the fractional T1, | Key ID: 0X457AA6BD Onto the backbone, | Keyprint: 99 C7 17 3B 32 08 3F 17 Nothin' but 'Net. | F4 A9 42 A9 2F BC 39 B1 ------------------------------------------------------------------

1 0

attila sez
by paralax＠alpha.c2.org 17 Dec '03

17 Dec '03

On Date: Mon, 5 Feb 1996 06:49:57 +0000 (GMT) a> attila sez: a> It is not whether paralax does not know shit from beans, but that a> he proves to all that he would prefer to censor TCMay and James A. a> Donald than listen to their opinions, despite the fact he posted his a> own rather trivial and absurd point. a> political correctness and the liberal news intrepretations of "all I seek to censor no one. I prefer to confront racisim whenever and wherever I see (read) it. Mr. May embarassed himself with his denigrating application of the word "Jap" to describe the Japanese people after demonstrating a gross lack of knowledge and sensitivity about Jews. It is NOT a matter of "political correctness" unless YOU and Mr. May believe refraining from addressing an African-American as a nigger the moral equivalent of sucumbing to "politcal correctness". a> with this, I suppose I have been entered upon your "list" of a> enemies of the 'statist' nation along with TCMay and James A. Donald, All three of you would be flattering yourselves if any of you thought you made anybody's list. A. Paralax View

1 0

Re: FV's blatant double standards
by John Pettitt 17 Dec '03

17 Dec '03

At 09:26 AM 2/4/96 -0500, Simson L. Garfinkel wrote: >At 8:18 AM 1/31/96, Rishab Aiyer Ghosh wrote: >>FV demonstrated, through it's "card sharp" or whatever, that >>real-time transactions are vulnerable to sniffers on the recipient's >>own machine. Of course. We all knew that. But the mistake is to >>assume that FV isn't _equally_ vulnerable to that threat. If you >>can write a trojan that will somehow get privileged access to my >>machine, trap my keystrokes, and identify my credit card number, >>you can certainly write one that will, sitting on my machine: >> "intercept the user's electronic mail, read the confirmation >> message from First Virtual's computers, and send out a fraudulent >> reply" >>(to quote from Simson's article). Simson further quotes FV's Lee >>Stein: "A single user can be targeted, Stein said, but ''it is very >>difficult. . . . There are too many packets moving . . . to too many >>different machines.''" - which is of course equally true for real-time >>Netscape transactions. > >Oh, I think that such a program can be written. However, it would be much >harder to get right, considering all of the different ways that people read >e-mail. > > The code looks something like this: 1) hook into the winsock and look for an FV message in the web data stream, save the ID. 2) now look for an approve/deny/fraud, when you see one you know that the user uses an IP connection for mail and web. 3) Forward the ID to an anon box. 4) Look for outbound FV messages with 'fraud' or 'deny' and change to 'approve'. Clearly this will miss AOL, CI$ etc al but thats not important. The issue is not FV noticing the error, they will, it's how long it takes and how much you can steal in the interim. There is a Helen Keller quote I'm rather fond of which starts: "Security is mostly a superstition ..." *If the machine is not secure all bets are off* The most likly failure vector for this attack is that so few people use FV :-) John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch

3 2

TWP on Indecency Protest
by John Young 17 Dec '03

17 Dec '03

The Washington Post, February 5, 1996, p. A8. Language on 'Indecency' Sparks Telecommunications Bill Protest By John Schwartz Provisions in the overhaul of the nation's telecommunications laws that call for regulating adult materials on the Internet have sparked a storm of anger and protest on that medium. "This is the kind of legislation you'd see from a lot of senators and congressmen who have never logged on," said Michael Godwin, staff counsel for the Electronic Frontier Foundation, a civil liberties group. "The Christian Right thinks they've hit a home run here, but the inning isn't over." The provisions, proposed by Sen. J. James Exon (D-Neb.), have gained momentum with support from religious conservative organizations. The legislation would make it illegal to make "indecent" material available to minors via computer, with penalties of two years in prison and up to $250,000 in fines. Exon called passage last week "a victory for children and families," adding, "We've come to a successful closing of the 'peep show' doors to our youth." President Clinton has said he will sign the bill. Those opposed to the regulations, however, said the "indecency" standard, which has been used in broadcast regulation cases, is too vague and would seriously restrict the potential of the emerging on-line medium. "I am concerned this legislation places restrictions on the Internet that will come back to haunt us," said Sen. Patrick J. Leahy (D-Vt.). He warned that quoting from such works as "Catcher in the Rye" and "Ulysses" in on-line discussions could court prosecution and said that making it illegal to "make available" indecent language would outlaw posting of messages or images that a child might see. "Imagine if the Whitney Museum ... were dragged into court for permitting representations of Michelangelo's David to be looked at by kids." But John McMickle, an aide to Sen. Charles E. Grassley (R-Iowa), said drafters rejected the idea that Userious works of redeeming value" would fall within the law, which he said would apply only to "patently offensive" material. McMickle said the bill "is not a Comstock-type effort to wipe out literature or political speech." The American Civil Liberties Union, the Electronic Frontier Foundation and other organizations are preparing a lawsuit challenging the indecency provisions on constitutional grounds. Other legal actions are in the works. An on-line publication, American Reporter, has announced it will soon publish a column by a Texas judge denouncing the legislation intentionally salted with "indecent" language; Randall Boe, a Washington attorney for the American Reporter, said he would immediately sue after publication. "We want to move promptly to have this statute set aside as unconstitutional," Boe said. "The longer it's in place, the greater the harm done to the Internet and to the First Amendment." Boe's firm, Arent, Fox, Kintner, Plotkin & Kahn, was defense council in the landmark "seven dirty words" case, which set the legal standard for indecent language in broadcasting based on a monologue by comedian George Carlin. Cathleen Cleaver, director of legal studies for the Family Research Council, said yesterday she expected such suits and that her conservative organization, which has pushed for on-line regulation, would fight to uphold it. The Justice Department has stated that the legislation would be vulnerable to attack on constitutional grounds. But in response to a letter from Grassley, Assistant Attorney General Andrew Fois noted last week that the department is defending the indecency standard in legislation "and will continue to defend similar statutes against constitutional challenges, so long as we can assert a reasonable defense consistent with the Supreme Court rulings in this area." -----

1 0

Re: Fair Credit Reporting Act and Privacy Act
by Frank Willoughby 17 Dec '03

17 Dec '03

Verily at 03:05 PM 2/5/96 -0500, Duncan Frissell did write: >At 08:25 AM 2/5/96 -0500, Frank Willoughby wrote: > >>If the Privacy Act were rewritten to be as strict as the BDSG, businesses >>would have a (mandatory) legal requirement to: >> >>o Ensure that personal data is stored properly (by encrypting it, etc) >>o Ensure that personal data is not distributed >>o Ensure that databases are *not* being maintained which describe the >> characteristics of individuals (buying habits, income, property >> ownership, etc) wantonly propagated by marketing (direct mail, >> telemarketing, etc) companies. >> > >Unfortunately, it would also: > >* Require government registration of computers and databases containing >information about people (whether these computers are used by business or >individuals). This eases regulation of computers and future confiscation. Works great in theory, not in practice. Having worked in Germany for 9 years, I can *guarantee* that the German gov't hasn't implemented the above. It may have been a good idea (in their eyes, not mine), but it isn't implementable in a democratic society - it bogs down in the implementation phase). Are you planning on registering every computer system that each person and company has with the gov't? Most sysadmins I know are up to their ears in work and are barely able (if at all) to recognize which users they have on their system, and why they have accounts at all (business justification). This might also get pretty wild when the ISPs get polled in terms of usage. (Compuserve notwithstanding). Gathering the registration data will be a bear to implement - keeping it current will be impossible (for the forseeable future). Besides, this would cast further shadows of "big brother" and remind former "ossies" in the former GDR/DDR & eastern block of days gone by - which they would probably rather not remember. Also, just because Germany tries this approach (and fails), doesn't mean we have to repeat their mistake in this area. > >* Reduce market efficiency by making it harder to match buyers and sellers >(because neither could easily find out about he other) thus causing higher >prices and poorer people. Actually, it would probably increase market efficiency as they would be spending their marketing budget on other appropriate methods which have a higher success-ratio. I don't know what the success rates are of mass-mailings, or tele-marketing, but I doubt if they approach 1% (wild guess). Seriously - what is your first impulse when you reach the phone and find out the caller is a tele-marketer? The annoyance factor is rather high for these. More than likely, this was also the reason that unsolicited mass-faxing of marketing info was forbidden by law a while ago? FWIW, personally, I think many marketing organizations have gone off the deep end in their efforts to try to be effective (to wit: putting logos on clothing, in video games, etc; sponsor's logos in Home Pages, 3-5 minutes of TV commercials every 6-10 minutes of TV (for those rare moments one gets to watch TV (thank heavens for cable TV & CNN)). 8^) > >* Do nothing to protect personal information from the government which >would get to collect more of it than ever in the course of enforcing data >protection laws. > You're assuming this isn't happening now? IMO, that would be a rather naive assumption. Personally, I think that the law should also consider exactly this point. The gov't should have no more access to personal information than it needs to carry on its job - and we as taxpayers should decide how much access they need to have. >If you don't want people to know things about you, don't tell them. Agreed....But, this essentially means giving up your phone, your credit cards, your house, your car, your job, and generally withdrawing from society. Not a particularly viable plan, IMO. The main problem is that the companies do little to nothing about protecting an individual's private data. It isn't any of my business how much money, you make, the amount your home is worth, your credit rating, info about your family (wife, kids, etc), religion, etc - yet, all of these are within the easy access of many individuals who don't have a "need-to-know" of this information. If I don't have a "need-to-know" about this info, I shouldn't be able to access it. > >DCF Of course since we are re-writing the Privacy Act from scratch, we can leave out the items you mentioned & design it the way it should be. Best Regards, Frank

1 0

IEEE Security Symposium Program
by Rich Salz 17 Dec '03

17 Dec '03

Date: Mon, 5 Feb 1996 14:14:22 -0800 To: pem-dev(a)tis.com, ietf-pkix(a)tandem.com, ipsec-owner(a)ans.net >From: Stephen Kent <kent(a)bbn.com> Subject: IEEE Symposium Program Announcement I'm distributing a copy of this year's program to members of these security-oriented WG mailing lists as a means of "getting the word out" to individuals who may be interested in attending this sort of conference. As the chair of the former PEM WG, and current co-chair of the PKI WG, I feel that this announcement is appropriate for these lists, and I hope my fellow IPSEC WG members agree that it is appropriate for that list as well. I apologize in advance for those of you who, like me, will receive multiple copies of this announcement. Steve =========================================================================== 1996 IEEE SYMPOSIUM ON SECURITY AND PRIVACY _/_/ _/ _/ _/ _/ May 6-8, 1996 _/_/ _/_/_/ The Claremont Resort, _/ _/ Oakland, California _/ _/ _/_/ Sponsored by the _/_/_/ IEEE Technical Committee on Security and Privacy _/ _/ In cooperation with the _/ _/ International Association of Cryptologic Research _/_/_/ _/ Symposium Committee _/ Dale M. Johnson, General Chair _/_/_/ _/_/ Stephen Kent, Vice Chair _/ _/ _/ John McHugh, Program Co-Chair _/ _/ _/ George W. Dinolt, Program Co-Chair _/_/_/ _/_/_/ _/ _/ _/ PRELIMINARY PROGRAM _/ _/ _/ Subject to Change _/ _/_/ MONDAY, MAY 6 08:30-09:00 WELCOMING REMARKS: Dale Johnson and John McHugh 09:00-10:30 PANEL: Object Management Group CORBA Security Standard Moderator: Terry Benzel Participants: TBA 10:30-11:00 BREAK 11:00-12:00 COVERT CHANNELS An Analysis of the Timed Z-Channel Ira S. Moskowitz, Steven J. Greenwald, Myong H. Kang Defining Noninterference in the Temporal Logic of Actions Todd Fine 12:00-13:30 LUNCH 13:30-15:00 PANEL: Goals for Computer Security Education Cynthia Irvine, Chair Leslie Chalmers Karl Levitt Steven F. Barnett Jim Schindler Roger R. Schell 15:00-15:30 BREAK 15:30-17:00 FIVE-MINUTE RESEARCH TALKS SESSION Submissions in the form of one-page ASCII abstracts due by email to mchugh(a)cs.pdx.edu no later than 2 April 1996. See http://www.cs.pdx.edu/SP96/ for more information. Abstracts to be distributed at the conference. 18:00-19:30 RECEPTION TUESDAY, MAY 7 09:00-10:30 DOMAIN SPECIFIC SECURITY Security for Medical Information Systems Ross Anderson Discussion Discussants TBA 10:30-11:00 BREAK 11:00-12:00 PROTOCOLS Entity Authentication Dieter Gollmann A Fair Non-repudiation Protocol Jianying Zhou, Dieter Gollmann Limitations on Design Principles for Public Key Protocols Paul Syverson 12:00-13:30 LUNCH 13:30-15:00 DATABASES Ensuring Atomicity of Multilevel Transactions Paul Ammann, Sushil Jajodia, Indrakshi Ray View-Based Access Control with High Assurance Xiaolei Qian Supporting Multiple Access Control Policies in Database Systems Elisa Bertino, Sushil Jajodia, Pierangela Samarati 15:00-15:30 BREAK 15:30-17:00 BIOLOGICALLY INSPIRED TOPICS IN COMPUTER SECURITY An Immunological Approach to Change Detection: Algorithms, Analysis, and Implications Patrik D'Haeseleer, Stephanie Forrest, Paul Helman A Sense of Self for UNIX Processes Stephanie Forrest, Steven A. Hofmeyr, Anil Somayaji, Thomas A. Longstaff Cryptovirology: Extortion Based Security Threats and Countermeasures Adam Young, Moti Yung 17:30-19:30 TECHNICAL COMMITTEE MEETING WEDNESDAY, MAY 8 09:00-10:30 MODELING A Security Model of Dynamic Labeling Providing a Tiered Approach to Verification Simon Foley, Li Gong, Xiaolei Qian A Communication Agreement Framework of Access Control Martin Roscheisen, Terry Winograd Decentralized Trust Management Matt Blaze, Joan Feigenbaum, Jack Lacy Security Properties and CSP Steve Schneider 10:30 11:00 BREAK 11:00 12:30 NETWORKS Security Flaws in the HotJava Web Browser Drew Dean, Dan S. Wallach On Two Proposals for On-line Credit-card Payments using Open Networks: Problems and Solutions Wenbo Man Secure Network Objects Leendert van Doorn, Martin Abadi, Mike Burrows, Edward Wobber Run-Time Security Evaluation (RTSE) for Distributed Applications Cristina Serban, B. McMillin 12:30 12:45 CONCLUDING REMARKS 12:45 SYMPOSIUM ADJOURNS 1996 IEEE SYMPOSIUM ON RESEARCH IN SECURITY AND PRIVACY _/_/ _/ _/ REGISTRATION FORM _/ _/ _/_/ _/_/_/ Name:_______________________________________________ _/ _/ _/ _/ Affiliation:_______________________________________________ _/_/ _/_/_/ Postal Address:_______________________________________________ _/ _/ _/ _/ _______________________________________________ _/_/_/ _/ _______________________________________________ _/ _/_/_/ _/_/ Phone:_______________________________________________ _/ _/ _/ _/ _/ _/ Fax:_______________________________________________ _/_/_/ _/_/_/ _/ _/ _/ Email:_______________________________________________ _/ _/ _/ _/ _/_/ Note: Address information will be distributed to attendees. Please enter the appropriate registration category. Payment must be included and must be by credit card or by check in U.S. dollars, drawn on a U.S. bank, made payable to "IEEE Symposium on Security and Privacy." Dates are strictly enforced by postmark. Advance registration (up to 29 March 1996) ___ Member of the IEEE (Member # ____________, required)........$310.00 ___ Non-Member..................................................$385.00 ___ Full-time Student...........................................$100.00 Late registration (from 30 March 1996) ___ Member of the IEEE (Member # ____________, required)........$370.00 ___ Non-Member..................................................$460.00 ___ Full-time Student...........................................$100.00 Do you wish to present at a poster session or lead an evening discussion? [ ] Yes [ ] No Do you have any special requirements?_________________________________________ Please indicate your method of payment by checking the appropriate box: [ ] Check in U.S. funds drawn on a U.S. bank (PLEASE ENCLOSE WITH THIS FORM) Credit card authorization: (Charges will appear on your statement as made by IEEE COMPUTER SOCIETY) Visa MasterCard American Express Diners Club [ ] [ ] [ ] [ ] Credit Card Number:_________________________________________________________ Card Holder Name:______________________________Expiration Date:_____________ Signature:__________________________________________________________________ Mail registration to: Or FAX this form (CREDIT CARD Stephen Kent REGISTRATIONS ONLY) to: BBN Corporation FAX: +1 617 873-4086 MS 13/2A VOICE: +1 617 873-6328 70 Fawcett Street Cambridge, MA 02140 >>>>SORRY, NO REGISTRATIONS BY EMAIL. NO REFUNDS.<<<< Five-Minute Research Talks Session ================================== At the 1995 Symposium a session of five-minute research talks was held for the first time. These proved very popular, so there will be another session this year. It is being held on Monday to give attendees more opportunities to contact the presenters during the rest of the conference. If you are interested in presenting a five-minute talk, please submit a one-page abstract in ASCII format by email to mchugh(a)cs.pdx.edu no later than 2 April 1996. See http://www.cs.pdx.edu/SP96/ for more information. Abstracts to be distributed at the conference. Please note that the five-minute time limit will be strictly enforced. Evening Sessions ================ The 1996 IEEE Symposium on Research in Security and Privacy will accommodate poster sessions and evening discussions. There will be rooms with blackboards and bulletin boards for interested parties to post presentations on work in progress, recent research results, and innovative proposals, or to lead discussions on topics of current interest. These rooms will be available Monday and Tuesday, May 6 and 7, from 8 p.m. to midnight. If you are interested in posting a presentation or organizing a discussion on a particular topic, please indicate so on the registration form. Hotel Reservations - The Claremont Resort ========================================= The Claremont Resort in Oakland, California is 20 minutes from San Francisco and just over an hour from Napa Valley. It is situated in the Oakland-Berkeley hills overlooking the San Francisco Bay on 22 acres of beautifully landscaped lawns and gardens. Facilities include the Claremont Pool and Tennis Club and The Spa at the Claremont. Oakland Airport is 14 miles from the hotel, or attendees may choose to fly into San Francisco and rent a car. SuperShuttle (+1 510 268-8700) provides service from the San Francisco Airport or the Oakland Airport to the Claremont Resort. The charge is $15 from Oakland Airport and $18 from San Francisco Airport, per person one way. Parking is available at the hotel at a cost of $8 per day for guests and a maximum of $9 per day for non-guests. Hotel reservations must be made under the group name IEEE Symposium on Security and Privacy. The group rate is $102 single, $114 double occupancy, plus 11% tax. The cut-off date for reservations is Saturday, April 6, 1996. Reservations made after this date will be accepted on a space available basis. Reservations must be accompanied by an advance deposit or credit card guarantee. You may cancel your individual reservations up to 72 hours prior to arrival, after which your deposit becomes non-refundable. Please be advised the check-in time is after 3:00 p.m.; check-out is 12 noon. For reservations and information, contact: The Claremont Resort, Ashby and Domingo Avenues, Oakland, CA 94623-0363; Phone: +1 800 551-7266 (7 a.m. to 8:30 p.m., PST) or +1 510 843-3000; Fax: +1 510 549-8582.

1 0

Re: Encryption and Backups
by John Pettitt 17 Dec '03

17 Dec '03

On Sun, 4 Feb 1996, Alan Olsen wrote: > Something that I have not seen addressed is the need for strong encryption > in backup software. > > Most backup software has an "encryption" option, but I have seen few that > have anything resembling strong encryption. Furthermore, I have seen no > real push for strong encryption for backups at all. > ... > Might be an idea for a product there... (And you can bet law enforcement > would throw a hissy fit about its existence.) > CP Backup (part of PC Tools for Central Point aka Symantec) has DES. As to how good the implementation is: I have no idea. -- John Pettitt email: jpettitt(a)well.sf.ca.us (home) jpp(a)software.net (work)

2 1

Re: Encryption and Backups
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:33 PM 2/4/96 -0800, John Pettitt wrote: > >On Sun, 4 Feb 1996, Alan Olsen wrote: > >> Something that I have not seen addressed is the need for strong encryption >> in backup software. >CP Backup (part of PC Tools for Central Point aka Symantec) has DES. As to >how good the implementation is: I have no idea. I have a copy, but I have not yet verified the key sizes. It is on my list of projects. (My current project is for determining if an app is accessing your PGP files under Win95. I may be stuck for a bit though... Looks like I might need the DDK to compile it.) Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ Is the operating system half NT or half full?

1 0

RE: Sometimes ya just gotta nuke em
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 8:33 2/3/96, "A. Padgett Peterson, P.E. Information Security" <PADGETT@hobbe wrote: >Tim rote: >>At 4:12 AM 2/3/96, Rich Graves wrote: >>>Who holds up the nuking of Hiroshima and Nagasaki as great victories >>>against tyranny? >>Since you ask, I do. > >And the biggest secret of the war was that "Fat Man" was the *last* A-bomb >we had or could build for about a year (had taken several *years* to >separate enough fissionable material for the three via two entirely >different processes). > >To me this is the great strength of the USA: given a theoretical problem, we >will develop a hundred different solutions, try them all in parallel, and at >least one will work. I agree - Not only were there two different separation methods but the two bombs dropped on Japan were of different designs (I think that the Hiroshima bomb was the same design as the land test version and the Nagasaki one was the untested design [so that if used, there would have been a tested design for the first drop]).

2 1

Re: Arthur C. Clarke Supports Strong Crypto
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 08:05 PM 2/4/96 -0800, Timothy C. May wrote: > >(Pardon me for mentioning crypto...) > >Arthur C. Clarke, known to most of you (author of many SF works, coiner of >the phrase: "all sufficiently advanced technlogies are indistinguishable >from magic," mention by Alan Olsen yesterday), has a role in a "Discovery >Channel" program called "Mysterious Universe." Actually, it was _I_ who mentioned this quote, but didn't specifically recall whom to ascribe it to. Perhaps Tim May didn't see it; a week or so ago May engaged in a shotgun-type killfile addition, including me when I was merely ( I still believe...) the victim in a local flamewar. If there is somebody out there who: 1. Is on speaking terms with Tim May. and 2. Has a little respect for my commentary, I would very much appreciate it if you would forward this comment to him to ensure that he sees it. The truly ironic thing is that Tim wrongly ascribes the comment to Alan Olsen, who is apparently the (recently admitted) perpetrator of at least one flamewar against me. Jim Bell jimbell(a)pacifier.com Klaatu Burada Nikto -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCUAwUBMRWQLvqHVDBboB2dAQF8zwP3SjAAIP46pqwsygL4Hm8YOChJ6xfIs4Vq vp+8rjMvPmZwxNtGN+7kcRTbXmau5P3MePSp94iK6k8qwisNqsoqCYkMBxs198fg 2YRZvfLAMQ0xsVznUSRA4bBTI3mLAv868xleSkIwhSjJ271qKUaI2K5exY1FgVK/ JnaVHWZTeQ== =tjA2 -----END PGP SIGNATURE-----

1 0

Fair Credit Reporting Act and Privacy
by tcmay＠got.net 17 Dec '03

17 Dec '03

[I urge people to put thread names in the subject lines, and not just leave the subjects as "Re:" or "Your mail." I have added a subject line.] At 5:58 AM 2/5/96, Karl Ike wrote: >It is impossible to get changes in the Fair Credit Reporting Act in the >traditional way. Credit reporting agencies have far too much personal >information that is passed out with incrediable ease at the consumers expense. > >I have a suggestion! > >Today, with TRW, Equifax and TransUnion's vast network, it is easy to obtain >anyone's credit report from various sources. Do you think if someone, >outside of the USA, obtained the credit reports on half, maybe all, of the >US Senators, congressmen, judges, etc, and published them in their entirity, >on the internet, from outside the US, would get their attention? Then there >would be changes, overnight, protecting the right of privacy! Let them >become the victim of credit reporting agencies once and shit will happen >overnight. "Protecting the right of privacy"? If I tell Joe Bob that you welshed on a debt made in the past, something that the person you welshed on has informed me of, how is this a violation of your right of privacy? Better yet, abolish the laws about so-called "Fair Credit Reporting." If Tim's Pretty Good Credit Reporting knows that Joe Blow filed for bankruptcy in 1975, by what right should men with guns come to his file cabinets and announce that he may not reveal true information that is older than, say, 8 years? Facts are facts. Not just for 8 years, or even 20 years. Debts incurred 30 years ago and not paid may still be useful bits of information in deciding whether to extend credit to a person. And even possibly untrue things are not the main justification for the FCRA. The FCRA is _not_ primarily designed to correct wrong information, but to place time limits on correct information. It limits speech. And it interferes with rational economic decisions. Fortunately, strong crypto and cyberspatial data havens will make enforcement of the FCRA increasingly difficult. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: THE JEWS (ALL of them!) Try to kick Ernst Zundel off Usenet!!
by ErnstZundl＠aol.com 17 Dec '03

17 Dec '03

Ich habe kleine Hoden

1 0

RC2 source code post to sci.crypt
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

So, who cancelled the post anyway?

1 0

Re: Sometimes ya just gotta nuke em
by James M. Cobb 17 Dec '03

17 Dec '03

Rich, Neither dropping nuclear weapons on Japanese cities nor an invasion of Japan was necessary to secure surrender of the Japanese government. David Kahn explains: Communications intelligence contributed...in major ways to the Allies' Pacific victory. It stepped up American submarine sinkings of the Japanese merchant fleet by one third. This cutting of Japan's lifelines was, Premier Hideki Tojo said after the war, one of the major factors that defeated Japan. David Kahn. "Codebreaking in World Wars I and II: The Major Successes and Failures, Their Causes and Their Effects" (1980). In: Kahn on Codes: Secrets of the New Cryptology. Macmillan Publishing Co. 1983. Page 108. The water transport intercepts should provide case after case of how American submarines won one of the most important victories in the Pacific: the sinking of the Japanese merchant fleet.... Kahn. "Opportunities in Cryptology for Historians." Op cit. P 289. Some information came out shortly after World War II, when we all heard about how we broke some Japanese codes before Pearl Harbor, which...did help very much...in the successful American submarine blockade of Japan, which very largely brought the Jap- anese empire to its knees. Kahn. "Signals Intelligence in the 1980s" (1981). Op cit. P 292. In other words, it was Starvation City. --------------------------------------- As an aside. these three quotations from Kahn on Codes, a collection of articles, show that David's views in this regard are consistent over the years. Continuing-- Dropping nuclear weapons on Japanese cities or an invasion of Japan was not necessary to secure surrender of the Japanese government. William Langer explains: In the greatest air offensive in history [during May, June, and July 1945] United States land-based and carrier-based aircraft des- troyed or immobilized the remnants of the Japanese navy, shattered Japanese industry, and curtailed Japanese sea communications by sub- marine and air attack and extensive minefields. United States bat- tleships moved in to shell densely populated cities with impunity and the Twentieth Air Force dropped 40,000 tons of bombs on Japanese industrial centers in one month. William Langer. An Encyclopedia of World History. Houghton Mifflin Co. 1948. Page 1169. It was Devastation City. ------------------------ Then why Hiroshima and Nagasaki? There were two main reasons nuclear weapons were dropped on Japanese cities: (1) generally, to proclaim Pax Americana...with a bang (2) specifically, to declare war on the Soviet Union. For the sake of completeness, let's ask: If it really had been necessary to drop nuclear weapons on Japan in order to compel the Japanese government to surrender, should they have been dropped? Without hesitation. Cordially, Jim NOTE. The first part of the "Opportunities" article was published in 1972. The second part, dealing with World War II, was written perhaps a decade later for publication in the collection.

7 7

No Subject
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

India's Department of Telecommunications (DoT) charges a licence fee of $50,000 per _annum_ for BBS operators, and nearly twice as much for e-mail providers. It is preparing to finalise a policy for Internet service providers; as it doesn't understand the distintion between Internet _networks_ (MCI, Sprintnet etc) and "retail" providers (the geek in the garage), it is planning to charge well over $100,000 in annual licence fees. This is totally against the opinions of Telecom Secretary R K Takkar, as expressed to my newsletter, The Indian Techonomist, some months ago. I spoke to Mr Takkar for some time, providing him the "education" that he asked for in my newsletter and that large datacom companies here have been curiously averse to give him. He appreciated my point of view, and invited me to send a proposal for an alternative datacom policy, which I have done (and which is summarised below). I hope to meet him next week to follow this up. As a major part of my call for removing restraints is based on the Internet's treatment by other world governments, I would like letters of support to show this. My proposal may appear tame, but it isn't really. It will allow small ISPs to pay as little as $150 a year in licence fees; reduce the (high) likelihood of cartels between large companies; and entrench electronic free-speech at (some) parity with other media. (Note that the DoT has said that it is "not considering" blocking access to parts of the Net for reasons of morals or security. This despite the local media's loudly proclaimed discovery that the Net is 97.34% paedophile, or whatever.) Highlights 1. Definitions - The category for E-mail providers becomes redundant, leaving international gateway, national network, and "retail" service providers - Content providers have constitutional protection as electronic publishers - BBSes do not require licensing, being content providers 2. Goals - Licence fees not for revenue generation, but to ensure responsibility (unavoidable. Mr Takkar's words) - Licence fees based on telecom infrastructure costs, not revenues (at the moment, a licence is almost like income tax) - Regulation required for free and fair competition (see below) - TRAI should also handle datacom regulation, and datacom consumer complaints (the Telecom Regulatory Authority of India is likely to be very independent of the government, headed by a former Supreme Court judge) 3. Regulation - Equal access to gateway, network and service providers (to prevent denial of service and cartels, very likely here without explicit rules preventing them) - Rationalisation of DoT leased line tariff structure (now, a network costs more than the sum of its parts! too complicated to explain briefly) 4. Licensing - Uniform fee structure for gateway, network and service providers (say 2.5% of leased line costs, which are known as they are provided by the DoT) - Barriers to entry greatly reduced (minimal ISP pays $150 p.a) - However, total licence fee revenue for DoT not significantly reduced (important for success of this proposal; large nationwide network may still pay $100,000+ thanks to its huge leased line requirements) The full text of the proposal will be made publicly available on the Net sometime next week. Those who would like to see it, and a template for a letter of support, should send me mail at dcom-appeal(a)dxm.org. I would like letters from non-commercial organisations, lobby groups, policy bodies, and so on, but NOT datacom companies (I wouldn't mind _personal_ letters of support from them, but they wouldn't do for the DoT). I would particularly like to see something from Hong Kong, which I have used as a good example of how to do things in Asia. Thanks, Rishab ---------------------------------------------------------------------- The Indian Techonomist - newsletter on India's information industry http://dxm.org/techonomist/ rishab(a)dxm.org Editor and publisher: Rishab Aiyer Ghosh rishab(a)arbornet.org Vox +91 11 6853410; 3760335; H 34 C Saket, New Delhi 110017, INDIA

1 0

RC2 question [No Nuke Content]
by Kevin L Prigge 17 Dec '03

17 Dec '03

Could someone throw a little light my way with regards to the permute[] array being derived from pi? I'm just not seeing it, I guess. Sorry for the interruption, I owe the list several off-topic flames and a discussion of some random non-crypto stuff at a later date. -- Kevin L. Prigge | "You can always spot a well informed man - UofM Central Computing | his views are the same as yours." email: klp(a)tc.umn.edu | - Ilka Chase PGP Key Fingerprint = FC E5 EE E7 8B 2E E9 D5 DA 1C 5D 6B 98 52 F6 24

1 0