December 2003 - cypherpunks-legacy

Re: Question: OTP
by jim bell 17 Dec '03

17 Dec '03

At 03:06 PM 10/21/96 +0000, paul(a)fatmans.demon.co.uk wrote: > >> This whole thing seems crazier each time I think about it. >> basically my question is: given that he picks his key securly does he have >> an OTP if the plaintext is shorter than the key? >> Bob > >Yes, if he were just to modular add the key to the plaintext (or XOR >them) he would have an OTP if AND ONLY IF the key were real random, >however, he doesn`t do this, he uses the key to seed an array or >linear congruential generators, which have been cryptanalysed to hell >and back. I think that there may be at least one potential application for a sorta-OTP system to be overlaid on a reasonably-secure public-key system: I think there might be an use for a system that allows the recipient of a message to prove to his own satisfaction that the sender of the message is who he says he is, but does NOT allow him to prove this to anyone else's satisfaction. The goal would be to prevent one party to the commucation from being strongarmed into not only revealing the data, but also providing trustworthy evidence against the other person. I haven't thought about this in enough detail to know if this is practical. Jim Bell jimbell(a)pacifier.com

1 0

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

American Banker: Friday, October 18, 1996 Internet Tops Bankers' List Of Leading-Edge Technologies By DREW CLARK A year ago, when the first U.S. bank was launched giving customers account access through the Internet, nearly half of all banks in a survey said they had no plans to follow its lead. They have since changed their minds. The Internet is high on bankers' emerging-technology priority lists, according to the 1996 American Banker technology survey. "The Internet is a medium that no banker can ignore," said Mary Donadoni, an analyst with Payment Systems Inc., the Tampa-based research firm that conducted the survey. To ignore it "is like saying you are not going to put a branch on Main Street." Over the past year, the number of U.S. banks, thrifts, and credit unions on the Internet's World Wide Web has grown from 132 to more than 1,000, according to James Bruene, editor of the Online Banking Report newsletter. "Banks are making decisions now," said William A. Soward, director of application marketing for Edify Corp. in Santa Clara, Calif. "Twelve months ago, they were kicking tires and trying to understand what the issues were." The American Banker/PSI survey showed one-third of the top 300 banks view Internet-related issues as the most critical they face - second only to the 35% who cited nonbank competition. Though only 10% of the top 300 U.S. banks offer Internet access to customers, 92% plan to by 1998. Community banks are expressing slightly more reluctance about the medium. Some 8% now offer Internet access, and half said they plan to do so within two years. They placed the Internet second on their list of concerns, behind general technology and software issues. "We're seeing more and more banks jumping on the bandwagon and saying, 'I need to do this,'" Mr. Soward said. "There is an emerging perception that a lot of the security issues have been addressed, but I'm not sure that's gotten out to the consumers." The bankers' thoughts about interactive services are being translated into action, with much of the emphasis on home banking via personal computer. Many of the higher-profile moves by big banks -- such as Citibank's slashing of fees for on-line customers, which caused subscribership to soar -- were complemented by community banking initiatives. In its first five months American Banker: Friday, October 18, 1996 Declining Costs Lead to an Explosion In On-Line Corporate Banking Services By STEVEN MARJANOVIC The increasingly competitive nature of business banking puts a premium on technology to improve customer satisfaction, boost revenues, and keep costs down. And that has brought an explosion in personal computers for connecting banks with their business clients. The American Banker technology survey indicated that 63% of the top 300 banks offer businesses access to their banking information via personal computers. Well over 90% plan to offer the information services by 1998, typically including account balances, statements, and electronic funds transfers. What's more, on-line corporate banking -- the equivalent of home banking for wholesale customers -- is getting easier and cheaper for more small banks and businesses. George Hart, president of Harbinger Corp., an Atlanta-based supplier of cash management software packages, said he has seen a marked increase in his business this year. About 25 banks are resellers of Harbinger's systems, including BankAmerica Corp., Barnett Banks Inc., and smaller customers, such as United American Bank of Memphis and Stillwater Bank and Trust Co., Stillwater, Okla. "These types of services . . . are not expensive any more" Mr. Hart said. "It's not a big deal to offer them." Also hot in the corporate realm, according to the survey, is financial electronic data interchange, or the exchange of payments and related documentation in standard computer formats. More than 40% of the top 300 banks plan to offer financial electronic data interchange by 1998. "We expect a lot of growth among companies in financial electronic data interchange in the next three years," said Maria Erickson, director of corporate services at Payment Systems Inc., which conducted the survey. The economics become especially favorable, she added, if "you consider the development of Internet-based financial EDI services." Among a new breed of cash management services, integrated payable and receivable services have garnered a lot of corporate attention lately, especially among larger and middle-market companies. Integrated payables are quickly growing in popularity from major banking companies like Chase Manhattan Corp. and Wachovia Corp. The service American Banker: Friday, October 18, 1996 A Second Bank Is Launched into Cyberspace By JENNIFER KINGSON BLOOM Almost a year to the day after the first Internet-based bank opened its virtual doors, the second such entity -- Atlanta Internet Bank -- has begun taking deposits. The new bank, a part of Carolina First Corp., is hoping to skim customers off the Internet by offering an eye-catching 7% interest rate on money market accounts. The founders say they are trying to prove the viability of the Internet as a banking channel and to show that the low overhead associated with doing business electronically can be passed on to customers. In the last year and a half, several well-established banks have opened "branches" on the Internet, enabling customers to pay bills, apply for loans, and manipulate accounts on-line. The services have proven popular, and both BankAmerica Corp. and Wells Fargo & Co. say the number of customers migrating to the remote channel has "exceeded expectations," although neither will divulge precise figures. And last Oct. 18, a Kentucky banker named James S. "Chip" Mahan took the idea to an extreme, establishing with great fanfare the Security First Network Bank, in which customers transact business exclusively on-line and over the telephone. The bank has since been spun off from its community bank parent, Cardinal Bancshares, moved its physical operation to Atlanta, attracted more than 4,000 customers, and amassed $15 million in assets. Across town from Mr. Mahan, an Atlanta entrepreneur named T. Stephen Johnson decided to put together a rival institution. Beginning early this year, he hired a skeleton executive staff and secured an investment from Carolina First, a $1.5 billion-asset bank based in Greenville, S.C. Then he forged a partnership with AT&T and, this Tuesday, the bank went live on the telecommunications giant's on-line service. Plans call for a full product line by yearend. "The reason we're so late in getting open is that we started watching to see how this thing was unfolding," Mr. Johnson said. "It seemed you had to start with Internet users and try to make bank customers out of them." Today, the Atlanta Internet Bank exists as a "product" of Carolina First, said Mack Whittle, the South Carolina bank's chief executive. But the term is mostly semantic. "Our plans are to roll it out as a separate, stand-alone financial institution sometime in the next 12 months," he said. Mr. Johnson said he has formed a corporate shell that is prepared to buy all the new bank's accounts from Carolina First. "We wanted to go ahead and get in business so we're doing it as a subsidiary, but we have a company that has a right to buy all the accounts for a dollar," he said. Mr. Whittle anticipates the Internet bank will raise private equity capital or issue an initial public offering next year. Carolina First will own 40% of the new entity, he said. Mr. Whittle predicted the drift of customers to cyberspace would happen "faster than most of us want it to," and said banks needed to learn quickly how to deliver banking services electronically. "It's about 70% cheaper to deliver it through the Internet than through traditional means," he said. "Plus, the next generation of consumers is going to demand it." If Silicon Valley was the first to put Internet banking on the national map, then Atlanta seems to have become the second pushpin. Atlanta has "more PCs per capita and more Internet users per capita than anywhere else in the South," Mr. Whittle said. Even so, Mr. Whittle said, the Internet bank is reaching for a national customer base, competing "very definitely" with Security First. "We're trying to market this not to our customers as much as to Internet users," he said. "It's a much easier sell for us to market to people who are already accustomed to using the Internet." Mr. Johnson takes a slightly different view. "I hope they don't think we're competitors, because we don't think they're competitors," Mr. Johnson said of Security First. "I think we both have a lot of hard work ahead of us to get the public to use this as a means by which they conduct financial business. "We won't compete with Wells Fargo or any of the other people involved" in the Internet banking arena, he said. "We all have a job to do, which is ultimately to help all the banks get their overhead structure in line with other businesses." Michael McChesney, an officer of both Security First and a subsidiary, Five Paces Inc., said the officers across town at the competing bank were "friends of mine," and wished them luck. "I'd like to see anyone who gets on the Internet doing banking succeed," Mr. McChesney said. "Our belief is that every bank will be on the Internet in five years." That said, Mr. McChesney also predicted the two banks would "compete head-to-head for some Atlanta Internet customers" and that it would be a "gentlemanly competition." Despite the mutual kind words, some hard feelings may linger: the Atlanta Internet Bank had originally agreed to use software supplied by Five Paces, then changed its mind and chose a system from Edify Corp. instead. The Atlanta Internet Bank tested its site with 60 to 70 people - mostly Carolina First and AT&T employees - and drew 150 newcomers in its first few days, said Donald Shapleigh, whose title is president of the Atlanta Internet Bank. The bank's Web site -- at www.atlantabank.com -- is spare, with far simpler graphics than those of Security First and other banks in the virtual world. "This is not Disney -- it's a bank," Mr. Shapleigh explained. "We want convenience, speed, and access. We want people to feel like we're a bank, to know that it's FDIC insured, but also to know that it's different because we're a virtual bank. "We don't have any branches and we're not interested in running a fleet of branches. We want people who are savvy with computers." For the first six weeks, the new service will be accessible only through AT&T's WorldNet. WorldNet, which charges a flat rate for unlimited Internet access, has 425,000 subscribers. The on-line service is giving the Atlanta Internet Bank a free advertising "banner" on its home page, placing subscribers a mouse-click away from the bank. The banner will remain in place at least until the bank receives two million "hits," or visits. Mr. Johnson said his goal is to have 20,000 accounts after a year - or one for each 100 hits. "Even credit card solicitations run about one percent," said Mr. Johnson, who will be? the new bank's chairman. Such a success rate would run counter to the experience of Security First Network Bank, which has run banners on America Online and elsewhere. The advertisements generated heavy traffic but relatively few accounts. Beginning Dec.1, the Atlanta Internet Bank's products will be available to anyone on the World Wide Web of the Internet. The whopping 7% interest rate -- which applies only to a short-term money market account -- will end at that time. Future rates will be "very aggressive," said Ched Hoover, director of marketing for the Atlanta Internet Bank. He said the highest money market rate he had seen other banks offer was 5.5%, which his bank would beat. Other initial offerings include interest-bearing checking accounts, direct deposit, electronic bill payment, account transfer capability, and ATM cards. Loan products and brokerage will be added by yearend, Mr. Johnson said. The nascent bank has four officers and eight customer service representatives. Mr. Shapleigh, the president, is a 20-year veteran of retail and corporate banking who has worked at SunTrust Banks Inc. of Atlanta. The tie-in with Atlanta Internet Bank is just the latest of several quasi-experimental technology initiatives that Carolina First has begun recently. The bank has installed 17 loan kiosks in shopping malls, and is preparing to place others in automobile dealerships. It is also investing in supermarket branches. "Like most banks, we see the delivery system changing," Mr. Whittle said. "We have tried to be as innovative as we can in seeking lesser expensive ways of delivering the product, in ways that the customer of the future is going to expect." News Release (IBM): Tuesday, October 15, 1996 Smart Card Pilot To Be Initiated By American Express And IBM Smart card to be used for "ticketless travel" on American Airlines American Express Co. and IBM today announced plans to pilot a system which will enable business travelers to move more quickly through airports by using the world's first multi-purpose corporate "smart card." By early December, the two companies will begin testing an American Express(R) Corporate Card using IBM smart card technology for use with airlines' electronic ticketing capability, often referred to as "ticketless travel." Initially, these smart cards will be tested with American Airlines' enhanced gate readers, which are now installed in 21 U.S. airports. For travelers, this process eliminates the hassle of carrying a paper boarding pass, enabling them to proceed directly to the gate after showing identification at the airport. At the gate, the traveler inserts the smart card into the gate reader, receives confirmation of seat assignment, and is ready to board the plane. In the pilot, American Express will issue fully-functional Corporate Cards, featuring IBM's multi-function smart card (MFC) technology, to a select group of employees at both companies. The companies made the announcement at the International Air Transport Association (IATA) Passenger Services Conference in Los Angeles. At the conference, IATA delegates are expected to vote on a proposed resolution establishing airline industry specifications for the use of smart cards. Travel Industry Milestones This product represents the first multi-purpose corporate card with a computer chip, the first commercial smart card application by American Express, and the first travel industry implementation of IBM's MFC technology. In this initial application, the smart card will verify the electronic reservation and confirm traveler identification in greater detail and with more reliability than existing cards. "This is an important first step in developing smart cards that allow business travelers to 'do more,'" said Ed Gilligan, president of American Express Corporate Services. "Smart cards will also allow travel suppliers to streamline the check-in process and to enhance customer reward programs. At American Express, our plan is to lead the way in developing smart cards that provide customers with additional value, convenience and security as part of an increasingly automated process from on-line booking to electronic expense reporting." "The travel industry is well-poised to take advantage of smart card and other innovative technologies," said Jerry Cole, general manager of IBM's Worldwide Travel and Transportation Industry Solutions Unit. "This application is another prime example of IBM working with its customers to apply powerful technologies in integrated solutions that translate into significant business benefits." American Airlines' AAccess system, which was launched in September, offers passengers the option of automated check-in at the top 21 domestic airports, which account for about 70 percent of the airlines' passenger boardings. The enhanced gate readers, in addition to reading normal magnetic-stripe boarding passes, will read charge cards and smart cards to issue boarding and seat confirmations. Smart Card Innovators American Express, which along with IBM and American Airlines, is a member of the Smart Card Forum, is developing a number of smart card applications to provide customers with enhanced convenience and value. In travel, American Express will pursue multi-function applications that will speed travelers past check-in points at airports, hotels and car rental agencies. "Our vision for smart card product development is to provide customers with an array of innovative products that can store and capture monetary value and information, extend payment options and perform a variety of non-financial tasks," said David Boyles, senior vice president and head of the Smart Card Center of Excellence at American Express. "This pilot with IBM demonstrates American Express' commitment to assume a leadership role in shaping global standards for smart cards to ensure a level playing field and to speed development of new applications in a variety of industries." At the IATA conference, IBM will demonstrate to the association's airline members how the next generation of smart cards can enhance the entire ticketless travel process -- from reservation to boarding. The steps in the process include: -- the passenger makes a reservation on-line through the Internet or other on-line service, or through a travel agency; -- the passenger then downloads the ticket confirmation number to a smart card via personal computer with smart card capabilities or at an airport self-service kiosk; -- the passenger then checks in, using the smart card at the airline desk or kiosk, and then proceeds to board, using an enhanced gate reader. IBM has provided technology solutions, products and services to the travel industry for more than 30 years. Many industries, including travel -- airlines, lodging, car rentals and travel agencies -- are quickly adopting technologies into their business operations. The IBM Worldwide Travel and Transportation Industry Solutions Unit collaborated with IBM's Smart Consumer Services group on this effort and will continue to do so on future smart card solutions projects targeted to the travel industry. And this one is especially for Timmy May: FIRST "GAY-FRIENDLY" MUTUAL FUND In what appears to be the first of its kind, a new mutual fund has been launched that is being marketed directly at homosexual men and women. "We won't invest in companies unless they have a progressive policy towards gays and lesbians," said Shelly Meyers, portfolio manager of the Meyers, Sheppard Pride Fund. The 37-year-old Meyers, an MBA who describes herself as gay, said she has found that the technology, financial services and consumer services sectors have a higher proportion of companies that are "gay friendly," with utilities and energy among the least friendly. The fund's investment philosophy is value-oriented, seeking equities that are undervalued, she said. The fund has about 40 issues in its portfolio, and ranges between 35 and 55 stocks. Its top five holdings are: Arrow Electronics Inc., McKesson Corp., Time Warner Inc., Glendale Federal Bank and American Express Co. -- Reuter, 10/18/96 MAJOR LONDON BANKS SKIP SIGNATURE VERIFICATION The big four High Street banks have stopped checking whether customers have put the correct signatures on personal checks for amounts below 1,000 pounds. Lloyds Bank, Barclays, NatWest and Midland have all decided that it is less expensive to reimburse defrauded customers than to instruct staff to scrutinise all checks. The banks last week refused to confirm the existence of the limits, which start at 1,000 pounds and can be as high as 5,000 pounds at some branches. -- The (London) Telegraph, 10/15/96 --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

NPR's Morning Edition: Monday, October 14, 1996 'Smart Cards' Becoming Next Generation of Debit Cards BOB EDWARDS, Host: This is Morning Edition; I'm Bob Edwards. The next generation of plastic money is ready, with banks and credit card issuers preparing to introduce smart cards to consumers. Smart cards use new technology to take debit and credit cards a step further, and could replace many of the transactions that still utilize cash. However, Ancel Martinez of member station KQED in San Francisco, reports that smart cards are not catching on quickly. ANCEL MARTINEZ, Reporter: You may not have noticed it but smart cards have been around for some time, mostly on a trial basis in various cities. VISA tried to make them popular during the Summer Olympic Games in Atlanta. Vendors and merchants accepted the cards, which contain a computer chip instead of the magnetic strip. Smart cards replace the need of cash at places, from fast-food joints to service stations. Tom Sack [sp] at the Veri-Phone Company [sp], oversaw the installation of hundreds of smart card terminals in Atlanta. TOM SACK, Veri-Phone Company: What we were interested in doing was raising consumer awareness of an alternate payment type, so what we're doing with stored value cards in general is to move some of the coin and bank note traffic into an automated form. ANCEL MARTINEZ: Smart cards keep track of individual bank balances, actually storing money on their microprocessors. They're faster to use than ordinary credit or debit cards. Sack says smart cards are better than regular cards, which must be constantly checked for authenticity and credit limit. TOM SACK: We're able to set up a session between the card and the terminal, where you really have two computers talking to each other, and what they can do is they can exchange secrets to prove each other's identity, for example. So what this allows us to do is to actually conduct the transaction without making the telephone call, so that we can do a transaction very inexpensively because we have more processing power in the card itself. ANCEL MARTINEZ: Designers and manufacturers hope to have as broad of application as possible for smart cards. State agencies are considering the use of smart cards for commuters to pay turnpike tolls, and as a way for people on welfare to receive government assistance. Another target is the booming cellular phone industry. Telecommunication companies suffer tens of millions of dollars in losses from rampant theft, but if customers' phones use smart cards, so key information is not embedded in the telephone itself, the chance of fraud is greatly reduced, since the phone won't work unless the owner inserts a smart card. But the card's value as a security device as come under question. Belcor Laboratories [sp] in New Jersey recently announced cryptologists discovered hidden problems on the smart cards, which have been advertised as tamper-proof. Bill Barr [sp] with Belcor says researchers discovered two things. BILL BARR, Belcor Laboratories: One, we've discovered how to manipulate a piece of computing technology and force it to make an error; and second, we've discovered that if it does make that error, then we can, by using our sophisticated mathematics, figure out how to extract the key out of the computing device, the secret. ANCEL MARTINEZ: If a sophisticated criminal can make a copy of a legitimate card, or if smart cards can be manipulated around the notoriously feeble security systems of the Internet, the technology may not be any good. Some experts, however, say there's no reason for panic. They say the Belcor study will not slow the eventual nationwide acceptance of smart cards. According to analyst Karen Apple [sp] at Forester Research [sp] in Cambridge, Massachusetts, banks remain steadfast in the belief that smart cards can, and will, reduce fraud. KAREN APPLE, Analyst, Forester Research: The credit card industry suffers from about a billion dollars in fraud every year as it is. I don't think it can get much worse than that. Smart cards do provide a greater level of security than the systems that are in place today. ANCEL MARTINEZ: Smart cards may be a good way for banks, credit card companies and merchants, to cut costs and save money, but smart cards are not in high demand with the people who matter most, consumers. Again, Karen Apple- KAREN APPLE: You have sort of a chicken-and-the-egg problem where nobody wants to be the first to make a move. Consumers don't want to embrace smart cards until they're accepted more widely, and merchants don't want to foot the bill to make smart cards more widely available, or more widely accepted. ANCEL MARTINEZ: Facing such a dilemma, retail groups, banks, financial service companies, have formed a coalition to negotiate new technical protocols for smart cards, as well as a means to finance the new technology. Called Smart Card Forum, it's a who's who list of American business. Citibank, Hewlett-Packard, American Express and Motorola are but a few, and there's a Microsoft representative. Software companies are keen on smart cards because they forecast that the electronic cash will set a new standard for commerce on the Internet For National Public Radio, I'm Ancel Martinez in San Francisco. Associated Press: Tuesday, October 15, 1996 Online Banking: Cutting Edge or Over The Edge? By PATRICIA LAMIELL A future television commercial, brought to you by your bank: Dawn creeps through the windows of a house. Logging onto his personal computer, a young executive instructs his bank to pay bills, checks on his investments and completes an online car loan application. His wife calls. Away on a business trip, she has just transferred cash, via a laptop computer, from the family's savings to their checking account. His son charges in, late for school and bellowing about lunch money. Dad grabs the boy's smart card - a plastic credit card look-alike embedded with a computer chip - and swipes it through a card reader in his PC to download electronic cash from his bank account onto the card. Banks hope this scenario becomes reality in the not-too-distant future. They're betting that online innovations will transform the way consumers complete most financial transactions, from buying a cup of coffee to investing for retirement. About 200, or 1 percent, of financial institutions in North America currently offer online banking, but because most large banks offer it, it is available to 60 percent of consumer banking customers, said Jim Bruene, editor of the OnLine Banking Report, an industry newsletter based in Seattle. If the industry has its way, every household will be banking soon from a home computer. "We see the numbers of online banking customers exploding from prior years," enthuses Michael Papantoniou, vice president for electronic commerce at Chase Manhattan Corp. But it's not certain that consumers will take to the new technology in enough numbers to justify the expense to banks. Dana Massie, an online client of Wells Fargo Bank, is director of technical research for Creative Technology Ltd., a multi-media company, and is probably as computer-savvy as banking customers come. But, Massie said, "I don't have a lot of patience for complicated stuff at home. When computers are as reliable and easy to use as televisions, then they will take off, because they're a lot more fun. But computers have to stop crashing, they have to turn on instantly - and computers are loud." Financial companies believe online banking will lower transaction costs and give them an edge over competitors. They've taken studies showing that customers like online banking because it saves them time, and that it appeals to merchants because it saves on billing and processing costs. But the notion of winging theoretical money through cyberspace still sends many consumers into a panic. And it prompts questions about security and privacy. Many people still want to handle cash and speak face-to-face with their bankers. A closer look at online banking: HOW DID WE GET HERE? Online banking actually has been around for years. "It may be one of those overnight success stories that took 15 years to develop," quips Bob Schettino, a spokesman for Intuit Corp., which makes the Quicken home finance software. The huge growth in consumer purchases of PCs over the past decade has fed the expansion of online banking. By 1995, more than 30 million households in the United States had home computers. More than a third used some type of personal finance software. Intuit and other software makers figured out how users of their home finance software could communicate via PC and modem with their banks. And the Internet became vastly more popular and more secure, leading to the creation in October 1995 of Security First Network Bank, the first Internet-only bank. Meanwhile, significant innovations in the smart card made it possible to carry electronic cash and perform financial transactions from a computer or telephone. The smart card - even more than the magnetic stripe card, which made automatic teller machines and debit cards possible - turned on its ear the notion that banking customers must visit a bank. Financial institutions began using online banking to attract and keep customers. PC owners, who as a group are young, well educated and affluent, are prize customers indeed. A few large banks, including Chase Manhattan Corp., Citibank, Bank of America and Wells Fargo, developed or acquired online banking systems. Other financial firms formed alliances with technology companies - Visa International has teamed with Microsoft Corp., while 15 banks formed a consortium with IBM. But online banking is still nascent. Of the 10 million households that use Intuit software products, only about 350,000 or 3.5 percent, have signed up for online banking, Intuit said. The American Bankers Association said about 1 percent of transactions in 1995 were completed online. ONLINE BANKING AND YOU What does this trend mean for the banking customer? Online banking shortens the amount of time consumers spends on finances, and allows them to work on them any time of the day or night. No more racing to the bank Friday afternoon to deposit a paycheck - Chase said 40 percent of its online banking is done on the weekend. Some consumers have been leery of doing banking or other personal business on the Internet, which works like a huge electronic party line, for fear someone could steal private information. But developers of online banking technology say new scrambling and encryption techniques have made Internet transactions safer. Indeed, researchers are concentrating on new applications that allow banking and commerce directly on the Internet, as well as through online service providers like America Online and CompuServe. They say online commerce is safer than giving a credit card number out over the telephone. A big stumbling block to the growth of online banking is that most vendors such as department stores and utilities don't accept electronic payments. Right now, this is a chicken-and-egg problem for banks - vendors are reluctant to invest in technology that their customers won't use. Consumers are leery of investing in technology that vendors don't accept. John Dickinson, a self-professed computer geek and freelance magazine editor, has been doing online banking for 12 years and pays 95 percent of his personal and business bills that way. But he still gets into scrapes with vendors. He said he can't get his phone company, for example, to consolidate the eight paper bills that it sends each month for different accounts at his San Francisco home and office. And Pacific Gas & Electric Corp. was taking two weeks to process his payments, and then started dunning him for being late. Three months ago, he "got really bored with calling them up all the time, so I just threw up my hands" and got the utility company to automatically debit his checking account each month. WHY THE BANKS WANT IT Financial institutions are in a life-or-death race with technology and telecommunications companies to provide home banking services. Electric utilities, telephone and cable companies already have lines into homes that can transmit financial information and are trying to develop new services. If customers can transfer money and get loans via a technology or communications company that already has lines into their homes, why would they need a bank? So banks must reassert control of the banking business, or cede it to non-financial companies. But regaining control is tricky indeed. Banks have invested billions of dollars in technology - such as machines to read magnetic stripes on cards - which is fast becoming obsolete. They have also built, at tremendous expense, a lavish branch system that, while shrinking, is expensive to maintain. Banks have to make good on these investments before they charge into new technologies that may themselves be quickly obsolete. They also must stay innovative enough to keep their increasingly computer-adventurous customers. The task is somewhat like catching a moving bus. "By the time people get literate with PCs," said Frank Woosley, director of financial services consulting for Deloitte & Touche in Dallas, "the smart banks are going to take the stuff that would normally be done on a PC and eliminate it altogether," like drafting checks, reconciling statements and moving money between accounts. If they are to continue to be the place where people deposit and borrow money, banks must devise cost-effective ways to turn the new technology into programs customers and merchants will use. That is a tall order, even for banking powerhouses. "But if we're not doing that," Woosley said, "we're not going to be in business much longer." Reuters: Tuesday, October 15, 1996 Deutsche Bank Gears Up For Virtual Shopping Test By Catherine O'Mahony FRANKFURT-- German shoppers weary of the long queues and curt service that typify the High Street here may soon have a more relaxing option -- virtual shopping courtesy of the biggest bank. Deutsche Bank AG is gearing up to test "Ecash" -- a system based around electronic "coins" which allow the user to buy goods and services over the Internet -- in just the third initiative of its kind worldwide. "Cyber money" is being hyped by computer boffins as the cash of the 21st century, although the initiators of Deutsche Bank's project are somewhat sceptical of the hype. "You can't expect people to change their habits overnight. This will start with the technology freaks who go along with everything," Christof Blum, head of Deutsche Bank's technological developments team, told Reuters. But Blum is confident that specific services, especially media-related products such as newspapers, magazine articles and other information, can sell well on the Net. Eventually, he said, "This will be pretty big." Blum and his team are working on a six-month pilot programme expected to start by January 1997, giving a selected group of Germans their first taste of a virtual shopping spree, albeit with a limited choice of products. Some 1,000 bank customers and a group of around 30 service providers, mainly publishers, will take part. Using software supplied by the bank, and developed by the specialist Dutch firm Digicash NV, customers will be able to ask Deutsche Bank via their PC to transfer funds from their regular bank account into an interim "Ecash" deposit account. The required amount of "electronic coins" -- denominated in deutsche marks -- can then be stored on the customer's PC hard disk, where they will be displayed in the form of a purse icon. Payment is simple: Internet users will be able to call up prices on screen for goods on offer and transfer the right amount of Ecash to the vendor by clicking on the purse icon. With even credit card acceptance still strikingly limited here, the day Germans switch on their PCs instead of their car engines for their weekly shopping trip is some way off. But Deutsche Bank says it wants to be ahead of the game when it arrives. Established in the late 19th century, the bank has been defying its stuffy image of late by making strong efforts to modernise its products, especially in retail banking. Part of its modern face is a six-month old "communications centre" at its main office for technological developments in suburban Frankfurt -- an open-plan space where staff can surf the Internet and test out prototype equipment. Blum, whose team is one of several at Deutsche Bank working on a variety of innovative products, says it will decide whether or not to proceed fully with the Net cash project on the basis of its six-month test. If so, the bank would join a tiny group of financial institutions involved with cybermoney -- the world pioneer is Mark Twain Bank of the U.S., which introduced digital dollars last year. Finland's Merita Bank is also running a test. Deutsche Bank says it is aware of the reservations many hold about the security of Internet cash but Blum says the Ecash software is completely secure. As in a regular ATM withdrawal, customers have to identify themselves to the bank to get access to the electronic cash and the "coins" are issued with code numbers similar to the serial numbers on regular banknotes. Nonetheless, Deutsche Bank has involved the Bundesbank in its discussions on the Internet project from the start. The guardian of Germany's famously solid deutsche mark is keeping a watchful eye on cashless payments in general amid concern that electronic commerce could be open to abuse and that virtual money could eventually disturb world cash flows. The bank has also been flooded with queries on its Internet cash plans from as far away as Japan. Its rivals on the home market, several of whom have set up banking services on the Internet in recent months, are also taking a keen interest, but none have yet taken the plunge with their own initiative. American Banker: Thursday, October 17, 1996 Amex Testing Its First Smart Card, with American Airlines By VALERIE BLOCK American Express Co. will join the smart card parade with a test of electronic ticketing for American Airlines passengers. After standing on the sidelines while the banking industry announced pilots around the globe and the bank card associations created an industry standard, the charge card giant is finally entering the ring. Using technology developed by IBM Corp., the program lets passengers insert a corporate charge card with a computer chip into a reader at American Airlines departure gates. They would receive a boarding pass, without presenting a paper ticket. The chip will contain the passenger's identification and frequent-flier number, which will be matched with ticketing information in American Airlines' data base. The cards, with magnetic stripes, will also function as corporate cards that may be used at any location that accepts American Express. Most major airlines, including Continental, Delta, Northwest, and United, are testing electronic ticketing. Lufthansa, which has such a smart card program in Europe, may be the only carrier with one in place. Initially the pilot program will be modest, with just "hundreds" of corporate charge cards combining magnetic stripes with chips being issued to American Express and IBM employees. But the plans are ambitious. Bill Hohle, smart card technology leader, described American Express' venture as "the first step to a comprehensive multiapplication travel and entertainment product." He envisions that cardholders could book travel, purchase airline tickets, expedite car rentals and hotel check-in, and electronically insert travel information into an expense report for reconciliation. The pilot is to begin by mid-December at 21 U.S. airports, including ones in New York, Los Angeles, Dallas/Fort Worth, and Chicago. American Express provides corporate cards for IBM in the United States. Mr. Hohle said American Express also intends to test an electronic purse application for smaller purchases. Rumors have it that American Express will purchase Proton, a stored value smart card program designed by Banksys of Belgium. But Mr. Hohle said it's "too early to discuss" those plans. Proton is in its pilot phase in several countries in Europe. It might seem odd that American Airlines is American Express' new partner, given that American Express issues the cobranded Delta Sky Miles Optima Card, while Citicorp issues the American AAdvantage card. But the charge card firm gained a technological break from the deal. American Airlines recently introduced a ticketless travel program, called AAccess, that uses magnetic stripe cards. To accommodate the program, the airline installed enhanced gate readers that can also read chip cards. Piggybacking on that technology, American Express will avoid the costs of installing and wiring card readers. It will also alleviate the onerous job of persuading merchants to accept the cards. Visa and its bank partners were forced to do that for the Visa Cash experiment, introduced in Atlanta during the Summer Olympics. Other bank smart card tests, such as the MasterCard program in Canberra, Australia, have been stymied by merchant resistance. "I see it as big win" for American Express, said James Accomando, a Fairfield Conn.-based consultant. "Now it gets a relationship with a dominant carrier in the U.S. that it didn't have before." Jerome Svigals, a card industry consultant in Redwood City, Calif., called the move a "willingness of American Express to explore new partnerships." He noted that all the card organizations are searching for "the best way to move forward" with smart cards. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

cypherpunks ftp site
by Norman Hardy 17 Dec '03

17 Dec '03

I am trying to get some code from <ftp.csua.berkeley.edu:pub/cypherpunks>. I get: ftp> get README.MIRRORS 200 PORT command successful. 425 Can't create data socket (128.32.43.51,20): Address already in use. ftp> Any suggestions to how to get eliptic.src and elliptic.doc reported to be at <ftp.csua.berkeley.edu:pub/cypherpunks/ciphers>? I searched AltaVista.

3 2

Finally -- A crypto question from me...HD encryption
by h2＠juno.com 17 Dec '03

17 Dec '03

Are there any good programs out there that can encrypt my HD?? Since there probably are, please mention some and where I can get them. Also, no one mention PGP.

4 3

Re: IP spoofer
by Matthew Ghio 17 Dec '03

17 Dec '03

Assuming that this was I troll, I took this to private mail. Since there is some relevance to computer security and anonymity I am forwarding it back to the list. Here is my reply to him: >>> Anyone got a good IP spoofer that can spoof the whole domain? The >>only >>> shit I can find is those shitty ones that spoof the first part of >>the >>> IDENTD which is possible to do in mIRC if you use it. Oh yeah, it >>has to >>> be for Win95. Yes I know that no one likes win95 but I dont have a >>> choice....I'll tell about that later. >> >>You're kidding, right? >> >>Either that or you need to find out who is forging mail from you. :) >> >Why would i be kidding...what forging mail.... Well, you posted to a mailling list about cryptography and asked a silly question about IP spoofing. Smells like a troll. Apparently others thought so too; I guess I was the only one silly enough to respond. "...what forged mail..." Well, your whole post was about forging the sender... Now, to answer your question: In order to do a successful IP spoofing, you must either gain access to the routing mechanism for one or more non-local IP addresses, or spoof a DNS (Domain Name System) server. To send packets with a forged IP address generally requires substantial ability to modify the behavior of the local TCP stack. Since Win95 does not provide such functionality via the winsock.dll interface, and the source code to the tcpip module is not available, in order to use Win95 for such purposes would necessitate rewriting and replacing a substantial portion of the IP-networking code. Since you expressed no interest in doing so, I assumed you were joking when you said that you wanted to use Win95. On operating systems which provide an interface for the user to insert raw packets into the local tcp/ip stack, ip spoofing is much more practical. Please see the post I made to the list about a month ago on the subject of IP Tunneling. I included two scripts, written under the Linux Operating System, which serve to give you a non-local IP address (using ssh as the tunneling transport mechanism). I assume that this would be sufficient for the purpose you intend. You will, however, need to find a cooperative network administrator from whom to borrow an IP address. The other option is DNS spoofing. The simplest form of this is to only forge the reverse-dns lookup. This requires access to the reverse-dns server, or merely suffient information about it to forge packets from it. (eg information obtained using a packet sniffer on the local ethernet) This method is fairly widely known and practiced. For this reason, most servers now check the reverse-dns against a forward-lookup, so you are unlikely to succeed at doing this. It might also be possible to engage in a denial-of-service attack (such as a packet flood) in order to prevent the reverse-dns lookup. This is, however, of limited utility since the IRC server, if it accepts a connection without a reverse-dns entry, would publicly display the numeric address, which anyone could then independently look up, or do a traceroute on. I hope this answers your questions about IP spoofing. In the future, please try to familiarize yourself with the ongoing list discussions, as this will encourage people to take your questions more seriously.

2 1

GET ME OUT OF HERE - TOO!
by crumrig＠us-state.gov 17 Dec '03

17 Dec '03

UNSUBSCIBE

3 2

Re: Prof Shamir arrested
by Jean-Francois Avon 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi Jim! Could you please tell me where I could find more about it? Is there a URL presenting the story? Did you broadcast the story to other groups? On 21 Oct 96 at 14:34, jim bell wrote: > Further recall that the so-called "Bit Tax" idea, the one most recently > proposed by that Belgian (?) Luc Soete, would apparently require that any data > transmitter keep account of any data it sends, in order to collect some sort > of tax, and thus any mistake in the count (either as a result of > misinterpretation of the rules, or a disk crash, or a power surge, etc) would > presumably turn a minor error into "tax fraud," or maybe they'll call it "bit > fraud." There is one other thing that you probably saw but did not point out: At least here in North America, networks and cables are *privately* owned. A bit tax would thus tax the use of private property by it's ownner. That is going a bit far! Also, the only one who could file for fraud is the owner. Otherwise, I could file a complaint and charge you for fraud that there are too much fart marks in your underwear... Or maybe they could institute a spoon and fork tax. Or a comma or alphabet tax, why not since it is in the same line? This is absolutely absurd and anybody planning such a scheme has *much more* than innocent intentions in mind. Ciao jfa - -- Jean-Francois Avon, Montreal QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQEVAgUBMmu/r8iycyXFit0NAQEePQf/TPFiji22lXaInCLXlYXJcJL+e8sHgk+r JXJ6n+54R81rJMTCOh6pSI/KzckXoBVpu8YEUTh46XcZICldzJGF1C5wHca9uJy9 MebhB+ccAAwxjELTbbSTUTYh/1cIHyJiucY6h3Vy/q3TAu3tJx5H248EAOvr21wc pfBp9nqAsC+WlHku1uhmOj9JbErGIhxW9rISYHNOQiCfIl1z1DPxVtac0zptG0Br Z8WDRQsOdXB6Efo8/n9oEdpJt5MaUgZdW1Ocz+bLsvQ6LdmfG5KenGYd4vW2nn2y 8tDdB9BOW5FMUFBatw7vfANOhT3O52paZ0qDJRAsJRG069MgfcrRdA== =ROpW -----END PGP SIGNATURE-----

1 0

(Fwd) Re: Prof Shamir arrested
by Jean-Francois Avon 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi Jim! Could you please tell me where I could find more about it? Is there a URL presenting the story? Did you broadcast the story to other groups? On 21 Oct 96 at 14:34, jim bell wrote: > Further recall that the so-called "Bit Tax" idea, the one most recently > proposed by that Belgian (?) Luc Soete, would apparently require that any data > transmitter keep account of any data it sends, in order to collect some sort > of tax, and thus any mistake in the count (either as a result of > misinterpretation of the rules, or a disk crash, or a power surge, etc) would > presumably turn a minor error into "tax fraud," or maybe they'll call it "bit > fraud." There is one other thing that you probably saw but did not point out: At least here in North America, networks and cables are *privately* owned. A bit tax would thus tax the use of private property by it's ownner. That is going a bit far! Also, the only one who could file for fraud is the owner. Otherwise, I could file a complaint and charge you for fraud that there are too much fart marks in your underwear... Or maybe they could institute a spoon and fork tax. Or a comma or alphabet tax, why not since it is in the same line? This is absolutely absurd and anybody planning such a scheme has *much more* than innocent intentions in mind. Ciao jfa - -- Jean-Francois Avon, Montreal QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQEVAgUBMmu/r8iycyXFit0NAQEePQf/TPFiji22lXaInCLXlYXJcJL+e8sHgk+r JXJ6n+54R81rJMTCOh6pSI/KzckXoBVpu8YEUTh46XcZICldzJGF1C5wHca9uJy9 MebhB+ccAAwxjELTbbSTUTYh/1cIHyJiucY6h3Vy/q3TAu3tJx5H248EAOvr21wc pfBp9nqAsC+WlHku1uhmOj9JbErGIhxW9rISYHNOQiCfIl1z1DPxVtac0zptG0Br Z8WDRQsOdXB6Efo8/n9oEdpJt5MaUgZdW1Ocz+bLsvQ6LdmfG5KenGYd4vW2nn2y 8tDdB9BOW5FMUFBatw7vfANOhT3O52paZ0qDJRAsJRG069MgfcrRdA== =ROpW -----END PGP SIGNATURE-----

1 0

Re: Usenet and Re: extortion via digital cash
by jim bell 17 Dec '03

17 Dec '03

At 12:34 AM 10/20/96 -0400, Scott McGuire wrote: >"Timothy C. May" <tcmay(a)got.net> wrote: >> At 11:01 PM -0400 10/15/96, Rabid Wombat wrote: >> >> >Also - in order to communicate back to the perpetrator, the victim needs >> >to communicate to the first step in the chain. The operator of that chain >> >> BlackNet-type pools eliminate the chain. There is no "first step in the >> chain," only a message pool or Usenet group which is propagated to tens of >> thousands of sites around the world (and even available via one's satellite >> dish and local cable, a la DirectPC, @Home, etc.). >> > >I've been thinking about the use of Usenet as a message pool and this seems to >be a good place to bring up my thoughts. As an already existing, widely >disseminated and easily used message pool, Usenet is very valuable to us. I'm >concerned that it may not last though. Many people now complain about how low >the signal to noise ratio is (even more than they complain about this list). >I've heard people say that they have given up on newsgroups in favor of mailing >list, web-zines, etc. So, if it gets too bad, might it just fade away? Or, if >it remains but becomes unpopular, will it be easy to restrict if we use it for >anonymous messages? What's needed is a method for an individual to read all of Usenet, and more, without anybody else knowing what each individual is reading. It's been mentioned before that on the back of those DSS boxes there's a connector which is supposed to eventually be able to provide computer data. Somebody mentioned that the data rate of Usenet is 100 megabytes per day. That works out to just about 9300 bits per second, continuous. That's probably only about 1/1000th of the data required to represent a NTSC video picture, and so it's about 1/100,000th of the data rate of the dish. I don't know the economics of this service in any detail, but if we assume 2 million such dishes generating about $1 of revenue per day, 1/100,000 of this revenue is about $20 per day. Obviously, the cost of this bandwidth is miniscule compared with the number of people who might want to use it. Sure, they're not just going to carry Usetnet, of course; they'd probably carry email and other services as well. However, many of the higher-bandwidth-consuming uses of the Internet will involve one-to-many broadcasting, which could be more easily provided by a dedicated satellite connection. Further, the company selling the dishes has a powerful motivation to make its product as useful as possible, since many people currently served by cable systems may have little reason to switch over absent a new feature. Given the low cost of this, there should always be enough bandwidth to implement some sort of blacknet-type system. Jim Bell jimbell(a)pacifier.com

1 0

Radikal in English
by silenced＠meaning.com 17 Dec '03

17 Dec '03

Rough English translations of issues 153 and 154 of _Radikal_, a German newspaper from-and for-the radikal/autonomous left, are now available at: http://www.meaning.com/library/radikal/ The newspaper has been banned by the German government. I have no connection with the organization and had never heard of them prior to the German government's attempted blocking of xs4all.nl. -silenced (silenced(a)meaning.com)

1 0

Stopping the buying of candidates
by jim bell 17 Dec '03

17 Dec '03

At 09:24 AM 10/17/96 -0800, Timothy C. May wrote: > >There are several swirling threads about the development of crypto systems >(e.g., "binding cryptography," "key recovery," "one-way traceable e-cash") >that are designed to allow law enforcement some ability to track illegal >transactions, catch some criminals, etc. One of the other items on my wish-list (short of a more, uh, "permanent" solution to politics) is a system to actually enforce the anonymity of political donations. What I mean is this: As bad as a large political contribution is, what's worse is that the candidate who receives it knows who it is from, and how large it is, etc. Given the recent flap over the Indonesian donations to the DNC, it seems to me that it would actually clean up politics if there were a mechanism to collect donations, blind them and send them to the proper candidate, but hide the actual source of that money. Hide it from the candidates, not necessarily the anyone else. This may sound difficult. After all, it will be argued that a given contributor will want to take credit for a donation and tell those who receive it; one way to help avoid this is the assess huge penalities (say, 10 times the value of the contribution claimed) to the party or candidate who is told of the source of a contribution but does not report the breach of security. The system could be set up to actually encourage people to test it and report fraud, and perhaps be awarded anonymously for providing evidence of misbehavior; and people should be able to (falsely) claim credit for donations, at least to the candidates themselves. Any donation reported to a candidate must be declared by the candidate and is then lost; their motivation for reporting it is that it'll be lost 10x if they don't. The result should be that the candidates should have no idea where the money is actually coming from, only that they are getting it. The contributors should be able to verify (via some sort of encrypted-open-books system) that the money they donate is actually being credited to the candidates, but they should not be able to use this system to prove to the candidate they made the contribution. I really wish those people who are developing that "binding cryptography" proposal would change their minds and decide to work on a proposal such as this, one that might actually help fix the political money problem. Jim Bell jimbell(a)pacifier.com

3 2

Fan mail from John Gilmore
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>Message-Id: <199610220113.SAA19070(a)toad.com> >X-Authentication-Warning: toad.com: Host localhost [127.0.0.1] didn't use HELO protocol >To: dlv(a)bwalk.dm.com, gnu(a)toad.com >Subject: Please stop the off-topic and insulting posts in cypherpunks >Date: Mon, 21 Oct 1996 18:13:22 -0700 >From: John Gilmore <gnu(a)toad.com> > >Whatever good opinion I had of you is quickly disappearing. You seem >to either have no self-control or you have decided not to exert it. > >If you plan to continue your current course, I suggest that instead, >you leave the cypherpunks list(s) and find somewhere else to vent your >anguish. Perhaps there is a place where people will care to hear what >you have to say. > >Thanks, > > John Gilmore

1 0

Re: ANother Timmy May clone
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

stewarts(a)ix.netcom.com writes: > This is the second time you've posted this. > It's an amusing product, if you like snake-oil, and more people would > have read your article if it didn't include gratuitous insults, > especially in the title. > > At 07:30 PM 10/20/96 -0400, you wrote: > >Timmy-May-style pseudo-crypto: ... I'm responding to the list since others may noticed the same: I did not post this article twice. I was surprised to see that it came back from toad.com to me twice. Some glitch much have caused is to be duplicated. Hasn't happened to any other articles... Sorry about that. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

INFO:Congress continues to push hard in the pro-encryption fight! (10/20/96)
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

============================================================================= ____ _ _ _ / ___|_ __ _ _ _ __ | |_ ___ | \ | | _____ _____ | | | '__| | | | '_ \| __/ _ \ _____| \| |/ _ \ \ /\ / / __| | |___| | | |_| | |_) | || (_) |_____| |\ | __/\ V V /\__ \ \____|_| \__, | .__/ \__\___/ |_| \_|\___| \_/\_/ |___/ |___/|_| LETTER FROM 20 MEMBERS OF CONGRESS ON NEW CLIPPER PLAN LETTER TO THE NET FROM SENATOR CONRAD BURNS (R-MT) LAW ENFORCEMENT NOW TRACKING CRIMES INVOLVING ENCRYPTION http://www.crypto.com/ Date: October 21, 1996 URL:http://www.crypto.com/ crypto-news(a)panix.com If you redistribute this, please do so in its entirety, with the banner intact. ----------------------------------------------------------------------------- Table of Contents Introduction Letter from 20 members of Congress on new Clipper plan Letter to the net from Senator Conrad Burns (R-MT) Law enforcement now tracking crimes involving encryption How to receive crypto-news Press contacts ----------------------------------------------------------------------------- INTRODUCTION As we look back at the last legislative session, it is amazing the progress we've made. As we build supporters for the pro-encryption forces in Congress we move the ball farther down the field. If you called, wrote, testified, or even just stayed involved in the issue this year, realize that you've made a significant difference in the way this issue went. It's not the end, though. We get a break for a couple of weeks and then Congress will be back, and ready to take up this issue again. Pro-encryption activists are gearing up the "My Lock, My Key" campaign for next year's fight. You can help by ensuring that you have told us who your member of Congress is. You never know, you might get a call or an email from one of us to help convince your legislator about the benefits of privacy and encryption! Participate in the "My Lock, My Key" Adopt-Your-Legislator campaign at http://www.crypto.com ! ---------------------------------------------------------------------------- LETTER FROM 20 MEMBERS OF CONGRESS ON NEW CLIPPER PLAN Congress of the United States Washington, D.C. 20515 October 15,1996 The Honorable Michael Kantor Secretary Department of Commerce Washington, D.C. 20230 Dear Secretary: We write to express our serious concerns about the Administration's most recent policy announcement on export restrictions on encryption technology. First we agree with the October 4, 1996, New York Times editorial that characterized the Administration's plan as "needlessly restrictive and probably unworkable" and (though better than previous Administration proposal) "risks doing more harm than good." We recognize that this issue involves a careful balancing of commercial, consumer, law enforcement and national security considerations. However, the well-respected 1996 report by the National Research Council on this matter emphasized that U.S. law enforcement and national security would be enhanced -- not weakened -- by broader use of stronger U.S. encryption technologies both at home and abroad. Furthermore, the report stressed that efforts to control international trade in encryption technologies will only be effective if implemented on a comprehensive, multilateral basis. Unfortunately, the Administration's most recent encryption initiative shortchanges both U.S. business and law enforcement interests. The proposal is flawed for four reasons: it fails to recognize that top-down, government-imposed policies are doomed to defeat: export policies must be directly linked, or indexed, to advances in technology; export controls must be fully multilateral in order to be effective; and export control decisions will be further delayed by granting the FBI new veto authority over U.S. exports. We fear these defects will continue to leave U.S. companies at a disadvantage in the world market, leave users of U.S. encryption uncertain about the security of their information and leave U.S. law enforcement and national security agencies behind the cryptography-curve. Although we were not consulted in the formulation of this policy, we nevertheless hope that in the coming months you will work with us and industry, consumer and user groups to refine it further. In addition to conducting oversight hearing in the next Congress on the Administration's proposal, we also want to assure you that we will continue to pursue legislative solutions toward this end. Sincerely, [signed] Sen. Ron Wyden (D-OR) Sen. Conrad Burns (R-MT) Sen. Trent Lott (R-MS) Sen. Larry Pressler (R-SD) Sen. Lauch Faircloth (R-NC) Sen. Barbara Boxer (D-CA) Sen. Pete Domenici (R-NM) Sen. John Ashcroft (R-MO) Sen. Alan Simpson(R-WY) Sen. Patty Murray (D-WA) Sen. Don Nickles (R-OK) Sen. Larry Craig (R-ID) Sen. Craig Thomas (R-WY) Sen. Kay Bailey Hutchison (R-TX) Rep. Zoe Lofgren (D-CA) Rep. Sonny Bono (R-CA) Rep. Howard Coble (R-NC) Rep. Steve Chabot (R-OH) Rep. Bob Goodlatte (R-VA) Rep. Bob Barr (R-GA) ----------------------------------------------------------------------------- LETTER TO THE NET FROM SENATOR CONRAD BURNS (R-MT) [We were informed that this net was for the net community, not specifically for Jonah Seiger. We bring it to you. -Shabbir] >From Conrad_Burns(a)burns.senate.gov Fri Oct 18 17:35:35 1996 >Date: Fri, 18 Oct 96 17:49:32 EST >To: jseiger(a)cdt.org >Subject: To Interested Members of the Internet Community: I am writing to thank you for all your help and support of my effort this year to pass legislation to enhance privacy and security on the Internet. As you all know by now, the 104th Congress adjourned before it had a chance to act on S. 1726, the Promotion of Commerce Online in the Digital Era Act of 1996. The bill, which was co-sponsored by Senators Leahy (D-VT), Pressler (R-SD), Lott (R-MS), Wyden (D-OR) and many other Senators from both parties, would have encouraged the widespread availability of strong, easy to use privacy and security tools for Internet Users. Although the Senate was not able to act on Pro-CODE this year, our efforts have laid the groundwork for real reform of US encryption policy in the 105th Congress. And despite significant opposition from the administration, Netizens had a significant impact on the Congressional debate on the encryption issue. I am honored to have helped to arrange the first ever Cybercasts of Congressional hearings, and I enjoyed the many online discussions I had with Netizens. Together, we have helped to show the Congress that the Internet user community can and should have a voice in debates over critical Internet policy issues. Finally, just days before adjournment, the Administration announced yet another encryption policy initiative. The proposal continues to insist on key escrow as a condition for lifting encryption export controls, and raises numerous questions about privacy and competitiveness. This debate is not over by any stretch of the imagination. I intend to move forward on pro-encryption legislation soon after the 105th Congress begins in January. You can find out more about this issue by visiting my web site (http://www.senate.gov/~burns) You can also visit the Encryption Policy Resource Page (http://www.crypto.com/) and the Internet Policy Coalition page (http://www.privacy.org/ipc/) Set up by experts to provide resources on the encryption policy debate, these sites also contain information on how you can get more involved. Thanks again for all your support. Next year, with your help, we can reach a commonsense solution to the critical policy crisis on encryption. Sincerely, U. S. Senator Conrad Burns ----------------------------------------------------------------------------- LAW ENFORCEMENT NOW TRACKING CRIMES INVOLVING ENCRYPTION [This was forwarded to us by one of our many encryption supporters with a stronger legal background. The summary of it seems to be that someone has decided to start tracking at crimes that involve encryption. Expect these numbers to be used against us next year in the debate over crypto. -Shabbir] >From:XXXXXXXXXX Check out title V of HR 3723, just signed into law by Clinton. It expressly directs that a) all criminal presentence reports (the written story-line/history given to the judge on which the sentence is calculated) shall include info on whether crypto was used to obstruct justice/commit crime, and b) the Sentencing Comm'n (the folks who write the rules) start looking at this issue, almost surely with a view to eventually writing Guidelines that would bump up sentences of perps who made the mistake of using crypto. Other parts of the bill make various changes -- I can't tell how substantial -- to sec. 1030, the main do-not-hack/crack statute. I'm not worried about this right now, since what little I've seen looks fairly cosmetic. ----------------------------------------------------------------------------- HOW TO RECEIVE CRYPTO-NEWS To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com) or send mail to majordomo(a)panix.com with "subscribe crypto-news" in the body of the message. To unsubscribe, send a letter to majordomo(a)panix.com with "unsubscribe crypto-news" in the body. ----------------------------------------------------------------------------- PRESS CONTACT INFORMATION Press inquiries on Crypto-News should be directed to Shabbir J. Safdar (VTW) at +1.718.596.2851 or shabbir(a)vtw.org Jonah Seiger (CDT) at +1.202.637.9800 or jseiger(a)cdt.org ----------------------------------------------------------------------------- End crypto-news =============================================================================

1 0

CDT Policy Post 2.36 - Congress Promises Action on Encryption Next Year
by Bob Palacios 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 36 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 36 October 22, 1996 CONTENTS: (1) Crypto Wrap-Up (2) Senator Burns' Sends Open Letter to Net Community (3) Bi-Partisan Group of 20 Members of Congress Raise Questions about Administration's Latest Encryption Initiative (4) How to Subscribe/Unsubscribe (5) About CDT, contacting us ** This document may be redistributed freely with this banner intact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ** This document looks best when viewed in COURIER font ** ----------------------------------------------------------------------------- (1) END OF SESSION WRAP-UP OF CRYPTO POLICY REFORM EFFORTS In two letters released this week, Members of Congress have promised to renew their efforts to reform US encryption policy when Congress returns in January. An open letter to the Internet Community from Senator Conrad Burns (R-MT), along with a letter from 20 Republican and Democratic members of both the House and Senate sent to Commerce Secretary Mickey Kantor on October 15, are attached below. The letters cap off an active year in which the Internet community made real progress towards reforming US encryption policy to promote privacy and security on the Internet. While the Administration continues to promote key escrow and export controls, a growing segment of Congress has recognized the importance of encryption policy reform to the viability of the Internet and the future of privacy in the information age. This growing bi-partisan support, along with an increasingly mobilized Net community, has resulted in several significant accomplishments: * Three bills designed to promote privacy and security on the Internet were introduced in the House and Senate: - The Burns/Leahy "Encrypted Communications Privacy Act" (S. 1587) - The Goodlatte/Eshoo "Security and Freedom through Encryption (SAFE) Act" (HR 3011), and - The Burns/Leahy/Pressler "Promotion of Commerce Online in the Digital Era (Pro-CODE) Act" (S. 1726). The bills, which would have relaxed export controls on encryption technology and prevented the government from imposing "key-escrow" schemes domestically, enjoyed broad bi-partisan support. * Congress held four hearings on encryption reform legislation, and heard testimony from privacy advocates, cryptographers, computer industry leaders, and others. These hearings provided a critical opportunity for the Internet community to make its case on the need for encryption policy reform. * Through online forums and the first ever cybercasts of Congressional encryption hearings, the voice of the Internet user community is finally beginning to be heard in Congress, and is helping to educate the Congress about the importance of encryption. * The Adopt your Legislator Campaign (http://www.crypto.com/) is linking Netizens with members of Congress to create a dialogue about the encryption issue. * Nearly 9000 Netizens have signed the online petition (http://www.crypto.com/petition) in support of encryption policy reform. * Leaders from the computer and communications industry joined with members of Congress, public interest organizations from across the political specturm, and the Internet community in Stanford California on July 1 to raise awareness about the need for encryption policy reform. * Other developments include progress on three ongoing legal challenges to the encryption export controls, efforts by privacy advocates to impact the encryption debate in the international encryption policies through the OECD, and the long awaited National Research Council Report which criticized current US encryption policy as "failing to meet the needs of an information age society." Despite these accomplishments, supporters of encryption policy reform still have a long way to go. In late October, the Clinton Administration announced yet another encryption policy initiative relying on export controls and "key-recovery" systems. As the Administration continues to push its plans to satisfy law enforcement concerns, the Internet community must be ready to work hard to protect privacy and security on the Internet. Fortunately, as a result of our efforts this year, we have strong and supportive allies in Congress. When Congress returns in January, expect a renewed effort to enact serious encryption policy reform legislation. With your help, we can ensure that the Internet develops into a secure platform for free expression, commerce, and privacy. WHAT YOU CAN DO NOW: Congress and the Administration are now focused on the elections. Help raise the voice of the Internet community and educate our elected officials about the importance of privacy and security on the Internet. * ADOPT YOUR LEGISLATOR - Join an innovative online campaign designed to help Netizens create an ongoing dialogue with their elected officials on critical Internet policy issues like encryption policy reform http://www.crypto.com/adopt/adopt.cgi?genre=crypto * SIGN THE PETITION - Add your name to the online petition and join the fight for privacy and security on the Internet. Nearly 9000 Netizens have signed on so far. http://www.crypto.com/petition/ ----------------------------------------------------------------------- (2) AN OPEN LETTER TO THE INTERNET COMMUNITY FROM SENATOR BURNS Senator Conrad Burns (R-MT), who along with Senator Patrick Leahy (D-VT) led the fight this year for the Pro-CODE bill, asked us to forward the following letter to the Internet community: X-POP3-Rcpt: jseiger@mailserver From: Conrad_Burns(a)burns.senate.gov Date: Fri, 18 Oct 96 17:49:32 EST To: jseiger(a)cdt.org Subject: To Interested Members of the Internet Community: I am writing to thank you for all your help and support of my effort this year to pass legislation to enhance privacy and security on the Internet. As you all know by now, the 104th Congress adjourned before it had a chance to act on S. 1726, the Promotion of Commerce Online in the Digital Era Act of 1996. The bill, which was co-sponsored by Senators Leahy (D-VT), Pressler (R-SD), Lott (R-MS), Wyden (D-OR) and many other Senators from both parties, would have encouraged the widespread availability of strong, easy to use privacy and security tools for Internet Users. Although the Senate was not able to act on Pro-CODE this year, our efforts have laid the groundwork for real reform of US encryption policy in the 105th Congress. And despite significant opposition from the administration, Netizens had a significant impact on the Congressional debate on the encryption issue. I am honored to have helped to arrange the first ever Cybercasts of Congressional hearings, and I enjoyed the many online discussions I had with Netizens. Together, we have helped to show the Congress that the Internet user community can and should have a voice in debates over critical Internet policy issues. Finally, just days before adjournment, the Administration announced yet another encryption policy initiative. The proposal continues to insist on key escrow as a condition for lifting encryption export controls, and raises numerous questions about privacy and competitiveness. This debate is not over by any stretch of the imagination. I intend to move forward on pro-encryption legislation soon after the 105th Congress begins in January. You can find out more about this issue by visiting my web site (http://www.senate.gov/~burns) You can also visit the Encryption Policy Resource Page (http://www.crypto.com/) and the Internet Policy Coalition page (http://www.privacy.org/ipc/) Set up by experts to provide resources on the encryption policy debate, these sites also contain information on how you can get more involved. Thanks again for all your support. Next year, with your help, we can reach a commonsense solution to the critical policy crisis on encryption. Sincerely, U. S. Senator Conrad Burns ----------------------------------------------------------------------- (3) BI-PARTISAN GROUP OF 20 MEMBERS OF CONGRESS RAISE QUESTIONS ABOUT ADMINISTRATION'S LATEST ENCRYPTION INITIATIVE Last week, a bi-partisan group of 20 members from both houses of Congress sent the attached letter to Commerce Secretary Mickey Kantor expressing their concerns about the Administration's latest encryption policy initiative (see http://www.cdt.org/crypto for details). The members, many of whom were co-sponsors of the Burns/Leahy Promotion of Commerce Online in the Digital Era "Pro-CODE" Act (S. 1726) or the Goodlatte/Eshoo Security and Freedom through Encryption "SAFE" Act (HR. 3011), called the latest administration effort "flawed" and pledged to continue to pursue legislation to reform US encryption policy. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congress of the United States Washington, D.C. 20515 October 15, 1996 The Honorable Michael Kantor Secretary Department of Commerce Washington, D.C. 20230 Dear Secretary: We write to express our serious concerns about the Administration's most recent policy announcement on export restrictions on encryption technology. First we agree with the October 4, 1996, New York Times editorial that characterized the Administration's plan as "needlessly restrictive and probably unworkable" and (though better than previous Administration proposal) "risks doing more harm than good." We recognize that this issue involves a careful balancing of commercial, consumer, law enforcement and national security considerations. However, the well-respected 1996 report by the National Research Council on this matter emphasized that U.S. law enforcement and national security would be enhanced -- not weakened -- by broader use of stronger U.S. encryption technologies both at home and abroad. Furthermore, the report stressed that efforts to control international trade in encryption technologies will only be effective if implemented on a comprehensive, multilateral basis. Unfortunately, the Administration's most recent encryption initiative shortchanges both U.S. business and law enforcement interests. The proposal is flawed for four reasons: it fails to recognize that top-down, government-imposed policies are doomed to defeat: export policies must be directly linked, or indexed, to advances in technology; export controls must be fully multilateral in order to be effective; and export control decisions will be further delayed by granting the FBI new veto authority over U.S. exports. We fear these defects will continue to leave U.S. companies at a disadvantage in the world market, leave users of U.S. encryption uncertain about the security of their information and leave U.S. law enforcement and national security agencies behind the cryptography-curve. Although we were not consulted in the formulation of this policy, we nevertheless hope that in the coming months you will work with us and industry, consumer and user groups to refine it further. In addition to conducting oversight hearing in the next Congress on the Administration's proposal, we also want to assure you that we will continue to pursue legislative solutions toward this end. Sincerely, [signed] Sen. Ron Wyden (D-OR) Sen. Conrad Burns (R-MT) Sen. Trent Lott (R-MS) Sen. Larry Pressler (R-SD) Sen. Lauch Faircloth (R-NC) Sen. Barbara Boxer (D-CA) Sen. Pete Domenici (R-NM) Sen. John Ashcroft (R-MO) Sen. Alan Simpson(R-WY) Sen. Patty Murray (D-WA) Sen. Don Nickles (R-OK) Sen. Larry Craig (R-ID) Sen. Craig Thomas (R-WY) Sen. Kay Bailey Hutchison (R-TX) Rep. Zoe Lofgren (D-CA) Rep. Sonny Bono (R-CA) Rep. Howard Coble (R-NC) Rep. Steve Chabot (R-OH) Rep. Bob Goodlatte (R-VA) Rep. Bob Barr (R-GA) ------------------------------------------------------------------------ (4) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by nearly 10,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (5) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.36 10/22/96 -----------------------------------------------------------------------

1 0

Interesting article on ATM in Wired (of all places)
by rcgraves＠ix.netcom.com 17 Dec '03

17 Dec '03

Since I ordinarily do nothing but bash the journal of hype and unreadable blue-on-orange type, I figured I should express appreciation for Steve Steinberg's "Netheads vs. Bellheads" article starting on page 145 of the October issue. The ATM v. real networks battle is one that is becoming increasingly important at gads of institutions, such as mine. In addition to economic efficiency, there are civil liberties reasons to favor the current packet-switched technology over circuit-switched bit-mangling. The nexus on this technical front isn't as tight as it is on the encryption front, but I'd urge people in positions of technical or budgetary responsibility to line up with the good guys, i.e., us netheads. You don't want an Internet controlled by ATM technology. It would make censorship, wiretapping, and other forms of nastiness by government and other armed thugs far too easy. I'm speaking only for myself, of course, and of course there are technical reasons I'd prefer to implement gigabit Ethernet as well. The leader "Why the net should grow up" in the October 19th issue of _The Economist_, whose net reporting has improved markedly with the addition of some new staff, may also be of interest. Some overlaps with the Wired article, though the writers probably weren't technically savvy enough to realize that they were talking about the same thing. More comments on that when I find time. -rich

2 1

How to get Winsock Remailer 1.3 to Remail?
by naphis＠alias.cyberpass.net 17 Dec '03

17 Dec '03

Hello! It could retrieve the messages that were supposed to be remailed but it wouldn't remail. Could someone please help me to interprete an extract from the debug.asc file to see what I have incorrectly? 10/19/1996 14:48:23 SMTP: Timeout during state 18 10/19/1996 14:49:15 SMTP: Server reports error 550 10/19/1996 14:50:18 SMTP: Timeout during state 18 10/19/1996 14:51:09 SMTP: Server reports error 550 10/19/1996 15:01:08 SMTP: Server reports error 550 Thank you. Naphisto

1 0

[Fwd: Re: Reno at FCBA]
by kwit＠iap.net.au 17 Dec '03

17 Dec '03

Erik E. Fair (Time Keeper) wrote: > all... > > Erik

1 0

Re: pgpmoose on q.net working; sorry; new issues. [moderation admin issue]
by Bradley Ward Allen 17 Dec '03

17 Dec '03

PGP message

1 0

ANother Timmy May clone
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Timmy-May-style pseudo-crypto: >From: Edgar Stahley <EStahley(a)tricryption.com> >Newsgroups: comp.security.misc >Subject: Finally, an easy Encryption System >Message-ID: <3269375D.469A(a)tricryption.com> >Date: Sat, 19 Oct 1996 16:17:33 -0400 >Organization: Tricryption >Lines: 14 >NNTP-Posting-Host: u029.comcat.com >Mime-Version: 1.0 >Content-Type: text/plain; charset=us-ascii >Content-Transfer-Encoding: 7bit > >What if an encryption program was really easy to use? > >What if you could send important documents securely over the >internet without having to enter any keys at all? > >What if this was possible because you and your group of >recipients could be the only ones in the world having access to >your very own customized encryption system? > >What if there was a $2000 contest to check it out? > > * (R) Edgar Stahley ES(a)tricryption.com >* TRICRYPTION - IBM file encryption. Fax/Phone: (215) 453-1452 > * Web site: http://www.tricryption.com

1 0

Re: Comments on binding cryptography (1)
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

For the last time I react on these (political) issues, and then I will gladly return to business. Our views should be clear by now. > So Bert, let's just call a spade a spade, eh? Since you readily agree > that organized criminals probably won't use binding crypto, I agree. > and that > TRP's will probably leak our info to spy "agencies" and so on, I don't agree. > it's public knowledge that the Justice Dept. does this sort of thing > here, so knowing that, are you still suggesting we trust them, simply > because you trust your government? I am not suggesting anything of the kind. I suggested we had a difference of opinion, and I can very well live with that. It's a matter for you to decide in the States, and for us to decide in the Netherlands/Europe. My only concern is that measures we take are compatible with foreign measures (mark compatible, not the same), and that the US is not pushing foreign states into measures they don't really want to take. I suggest you try and read what people write first, instead of skimming through a message and jumping to conclusions. Bert-Jaap

1 0

Re: Prof Shamir arrested
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

Jim Bell wrote: [many things on "fraud"] Excuse me if I don't react on this in detail. We have already explained it, and there it stands: fraud means playing a game without abiding by its rules. It's perfectly legitimate to establish a game and to introduse rules of the game with it. If you want to play the game, play by its rules, otherwise don't play it. If you play it while cheating, though, you must bear the consequences ("go directly to jail" ;-). Bert-Jaap --------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 466 8101 Center for Law, Administration and facs +31 13 466 8149 Informatization, Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------------------- Postbus 90153 | This world's just mad enough to have been made | 5000 LE Tilburg | by the Being his beings into being prayed. | The Netherlands | (Howard Nemerov) | --------------------------------------------------------------------- http://cwis.kub.nl/~frw/people/koops/bertjaap.htm ---------------------------------------------------------------------

2 1

Re: [SERDAR ARGIC] Ray Arachelian's role in massacare of 2,500,000 Moslems
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:08 PM 10/21/96 -0700, Sandy Sandfort wrote: >On Mon, 21 Oct 1996, Dr.Dimitri Vulis KOTM wrote: > >> You have to beg. You have to grovel. You have to prove yourselves >> worthy of the honor. > >So it IS intellectual dishonesty and cowardice. I thought so. >Is there anyone on the list who thinks Dimitri is a man? Emotionally: no Biologically: maybe (There is that unexplained trip to Sweden.) I think that he should look into Trepanning, Phrenology, or both opon his trip to the Bay area. (When and if he ever goes...) Actually Vulis has proved his colors over and over opon the net. That is why he gets so little respect here and elsewhere. Maybe he thinks that you are all planning some sort of welcome out of "Deliverance" or something... ("We're gonna make you squeal like a modem, boy!") Explains the request for banjo players on some of the other lists, however... --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: Prof Shamir arrested
by Alan Olsen 17 Dec '03

17 Dec '03

At 01:00 PM 10/22/96 +0300, Jüri Kaljundi wrote: > Mon, 21 Oct 1996, Rabid Wombat wrote: > >> Or is this the Avi Shamir who broke FEAL-8? > >Can you tell more of this? There is an Windows disk encryption utility >called Teamware Crypto that uses FEAL-8. This program is quite popular in >Europe, distributed and made by ICL Data. The attacks on FEAL are pretty lengthy. _Applied Cryptography_ 2nd edition by Bruce Schneier has a list of attacks on page 311. The Shamir attack is not the one to worry about. Matsui and Yamagishi have an attack that breaks it in 2^15 known plaintexts. If you do not have a copy, I can dig up the references on it. (It is too late/early for me to do it clearly at this point...) Hope that helps. --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

2 1