December 2003 - cypherpunks-legacy

Re: [local] Report on Portland Cpunks meeting
by Alan Olsen 17 Dec '03

17 Dec '03

At 04:40 PM 1/23/96 -0500, Perry E. Metzger wrote: > >Weld Pond writes: >> This begs the question, "How would you conduct an efficient key signing >> given what you have learned?" I am in the process of organizing one and >> would like to get input as to the best way that this should take place. > >The IETF key signing parties are the largest in existance -- about 100 >people exchange signatures. > >The way you handle it is this: {key signing stuff deleted for space] That was the basic format we used. The only difference was that the keys were collected before hand and distributed on disk. The biggest problems were due to unfamiliarity was to what to bring and procedure from an experience point of view. (Lack of key fingerprints were a problem.) The key signing rules were published, but many people attending did not read them. (They were part of an update announcement. Many people read the top part, saw nothing had changed and skipped the rest of it...) Now that we have done it once, it will be alot easier the next time. Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

2 1

Re: SS Obergruppenfuhrer Zimmermann (NOT!)
by Peter Trei 17 Dec '03

17 Dec '03

Patiwat Panurach asks: > On Tue, 23 Jan 1996, Duncan Frissell wrote: > > On the whole, the cypherpunks have gotten very favorable press for a group > > who's actions may render government policies irrelevant and possibly the > > governments themselves. > Would you call cypherpunks (as a group and as a philosophy) to be > influential? Do you think governments listen to us much? Are they forced > to listen to us? Any stuff to support this? Please give me your comments. Yes, I would say the actions of the people active on this list have had significant effectst. To give one example: Last summer, 'we' broke 40-bit RC4. Within a week or two, the US government started to discuss making 64-bit escrowed crypto exportable (not acceptable, but it's a change). In the private sector, the opinion in a lot of US firms was 'yeah, 40 bits may be weak, but marketing wants to have a single "secure version" of the product, so we'll sell the 40 bit version domestically and abroad - after all, 40 bits is only theoretically weak - no one's ever broken it." After the highly publicized SSL crack, it suddenly became a *lot* easier for engineers to argue for separate domestic versions with stronger encryption. I personally know of three firms where this occured, and I'm sure there are more. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

German home banking (fromn RISKS)
by stevenw＠best.com 17 Dec '03

17 Dec '03

---------------------------------------------------------------------- Date: Tue, 23 Jan 1996 17:32:56 +0100 From: Klaus Brunnstein <brunnstein(a)rz.informatik.uni-hamburg.d400.de> Subject: Homebanking NonSecurity demo A German private TV channel (SAT 1) displayed, Monday Jan.22 night (10 pm), a demonstration of how easily homebanking may be attacked in Germany. In this demo, a person used T-Online (a navigation tool similar to CompuServe) to send his ID, PIN, the amount to be transferred (500 DM) and the account to which to transfer, plus a transaction number (TAN) via telephone line. All these data were intercepted on a portable connected to the user's phone line in the basement of the building (indeed, most telephone boxes are rarely locked). Actions of the customer and the "hacker" were shown in parallel, so one could see all data (including PIN which was not displayed on the Customers' screen) on the hackers' display. Before the customer could start the booking process on the bank computer by sending the requestor, the hacker interrupted the telephone connection. As he now possessed all relevant "secret" information of the user, he now started an order to transmit 5,000 DM from his victim's account to another one, successfully (as the customers' vouchers proved. After the demo (about 10 minutes), a short interview (with the author of this report) discussed evident risks; it was made clear that software solutions are available since some time, to replace the old PIN/TAN structure with digital signatures and to encrypt sensitive data using asymmetric encryption. Risks? Presently, there are several risks in telephone-based homebanking. First, ALL sensitive information is transmitted in cleartext. Secondly, interception of line-based communications of German Telekom is easily possible at several sites, from the basement of a customers' house where lines from different customers are collected in a unit, to units collecting lines from several blocks, streets etc. Thirdly, in contracts between banks and customers, the latter will often have difficulties to prove that an order carrying their personal ID, TAN etc was NOT issued from them, esp. when there is evidence that the order came from the customers' telephone line (though not from his telephone :-). Customer protection (both technically and legally) therefore requires immediate action, as Chaos Computer Club commented in press. Interestingly, German banks offer enterprises a secure solution based on RSA-licensed encryption software. So far, this is NOT offered to private customers as it canNOT interoperate with T-Online. Financial institutions are discussing presently a solution (either with a chipcard including sort of DES or a solution using an RSA-implementation with 784 bit key, which may be distributed via diskettes) but it is unclear when this solution will be available. As long as such solution is not available, "every day may become payment day even for the most lousy hackers" as one German newspaper (TAZ) wrote. Klaus Brunnstein (Jan.23,1996) ------------------------------ ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

4 3

Free speech and written rights.
by James A. Donald 17 Dec '03

17 Dec '03

At 10:06 PM 1/24/96 +0800, Bruce Murphy wrote: > Which brings me to another point. At least [Americans] *have* a free > speech bit in your constitution. While it's generally considered a > right [in Australia], legally that's not really good enough. About twenty or thirty years ago, there was big debate on in Australia on whether Australia should have a bill of rights. The natural rights crowd popped up from obscurity and vigorously opposed a bill of rights. They successfully argued that if a bill of rights were written down on paper, these rights would then become mere creations of the courts. This same concern is voiced in Article nine of the American bill of rights. In my judgement, America is reasonably free despite having a bill of rights, rather than because of a bill of rights. The American nation derived its cohesion from the ideology of liberty, not from a race or religion. This is the reason America has a bill of rights, and this is the reason it remains somewhat free despite possessing a bill of rights. Despite this debate and referendum in Australia, the government has been sneaking some rights into the Australian constitution by various stratagems, and I think that this will have the effect of undermining liberty. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Associating Local Port Number to PID
by Karl A. Siil 17 Dec '03

17 Dec '03

Folks, I'm working on a program for UNIX (SVR4, Solaris 2.4) systems that needs to associate PID with local TCP/IP port number, so as to pass session keys accordingly to already running processes. This sounds like such an obviously needed association that someone must have done it already. Pointers to code would be best, but any references would be helpful (e.g., the appropriate /dev/kmem data structure(s), offset(s), etc.). If necessary, the program is allowed to be in any group (e.g., "sys" to get at /dev/kmem) and may even run as root, as a last resort. I see no reason for the latter, however. Running set-gid to "sys" is sufficient for netstat(1) and ps(1) and I think is the upper bound for process privilege that I would need. Thanks in advance. Karl

1 0

Re: [local] Report on Portland Cpunks meeting
by Pat Farrell 17 Dec '03

17 Dec '03

In message Wed, 24 Jan 1996 00:32:37 -0800, shamrock(a)netcom.com (Lucky Green) writes: > How do they verify that the person confirming the fingerprint is indeed > the person supposedly owning the key? It is pretty hard, that is one of the reasons the web-o-trust is broken. You can make it better by requiring the person to actually use the key, which proves that he/she has the passphrase. At the last key signing at the DC-area cypherpunks meeting, I told everyone my name was Boris Badanov. Even tho the key's userid said pfarrell(a)netcom.com. Carl Ellison suggests that the signature should have a much weaker meaning, roughly: "The person owning the secret key associated with this public key's tag has characteristic X." Obviously X could be "claims to be Pat" Thus if Lucky gives me a key, I don't know what his/her real name is, and don't care. All I have to do is see them actually sign something I give him/her with the key. Of course we need to rule out man-in-the-middle attacks. For me, I would buy off on watching the signing on a standalone laptop while I watch from accross the room. Interesting atack: Assume there is a chain of keys, with Lucky feeding keys to Klaus inside the laptop. I'd be signing what I thought was Lucky's key, but it was really Klaus'. Of course "Lucky" would have to have the secret passphrase for both Lucky's and Klaus' keys. It isn't clear to me if this is an important case. Equally questionable are tricks such as using an IR or wireless transmitter to send my test data to another computer so that the chain of MITM can be longer. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

"Concryption" Prior Art
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

I haven't read the supposed Concryption patent so I don't know what the claim structure is. But if they truly claim the right to do encryption and compression simultaneously, then I've got some prior art that should knock out such a broad claim. The paper is "A Redundancy Reducing Cipher" (Cryptologia, May 88). It's not very secure, but it does do some manner of encryption at the same time as compressing a file with a Huffman-like system. The journal is found in many university libraries so it should be easy to produce a solid counterclaim. If anyone has the plaintext to the Concryption patent (5479512), I would like to read it. -Peter

1 0

San Diego Cpunks Physical Meeting
by Chris Claborne 17 Dec '03

17 Dec '03

San Diego Area CPUNKS symposium .... will be in conjunction with USENIX "birds of feather" session titled "Remailers & Cypherpunk". Where: San Diego Mariott Hotel and Marina, 333 West Harbor Drive. Date : 1/25/96 Time : 6:30 - 8:30 SORRY for the late notice. I spaced the announcement. Hope you can join us. Thursday, January 25, 1996 Invitation to all Cypherpunks to join the San Diego crowd at this special session lead by our very own Lance Cottrell. Get the latest update of Lance Cottrell's anonymous e-mail server, "mixmaster", exchange keys, and discuss other topical subjects. If you are in to what's happening on the list, encryption, privacy, this is the place to be. The group may retire somewhere else after 8:30 to continue with other CP related issues, so join us. Don't forget to bring your public key fingerprint and two forms of identification. If you can figure out how to get it on the back of a business card, that would be cool. Drop me a note if you plan to attend. See you there! 2 -- C -- ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

Underground Radio
by John Young 17 Dec '03

17 Dec '03

For hams and other techno-libertines, The NY Times reports today on underground radio stations and bucking the FCC and global techno-tyrant-winner-takes-alls. http://www.nytimes.com/96/01/24/early/underground-radio.html

1 0

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 4:17 1/24/96, Timothy C. May wrote: >The usual issue: That if a foreign-originated product even appears to be a >standard (so far, none have been), and includes strong crypto, then the NSA >and other agencies will simply change the rules. Thus, if extremely strong >crypto from "Netscape-Zurich" starts to have a significant market presense >in the U.S., then some law will be passed to restrict it. I agree. The reason for enforcing ITAR is to keep good crypto of the *domestic* market. If ITAR no longer accomplishes that, new laws will be passed. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Articles re Crypto
by Tim Philp 17 Dec '03

17 Dec '03

FYI In the January issue of InfoCanada, the front page has what amounts to a press release on Digital Equipment's Digital Internet Personal Tunnel for Windows 95. There is also info on a companian product for Unix. I am trying to get some information on this. Has anyone heard of this technology? In the January 18th 96 issue of EDN, Pg 57 has an article about secure wireless designs. In this article they talk about securing devices such as garage-door openers, and keyless entry systems for cars and buildings. It is a little shy on cryptographic info, but they do talk about crypto applications for these products. =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

2 1

Guess what I found...
by Ian Goldberg 17 Dec '03

17 Dec '03

Guess what I found in my mailbox this morning: A cheque (that's check for those Americans out there) for $500 from Netscape Comm. Corp. It seems they decided to split a "Bugs Bounty" prize between Dave and me retroactively for the PRNG thing. :-) - Ian "This may turn out to be a good day..."

1 0

Re: Crippled Notes export encryption
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

At 11:50 PM 1/23/96, you wrote: >The problem is whether you can separate the functionality of what you're >exporting sufficiently from what you're contracting out that the exported >material isn't a "component of a cryptosystem"; it's tough to do a good bones >version of code if you're concerned about satisfying both the letter and >spirit of a law to avoid hassles with the government. On the other hand, >if you're as big as IBM or even MIT, sometimes you can do it.... So move 100% of the development overseas. Pick someplace where the labor is cheaper (maybe the former Soviet Union, but I don't know what their crypto export laws are like) and develop 100% of the product overseas. Put a notice inside each shrink-wrapped box that "This product was forced to be written overseas, costing American programmers their jobs, by the shortsightedness of Congress." 2048bit-Fingerprint: F8 A2 A5 15 56 42 9B 16 3F BD 57 0F 8A ED E3 21 No man's life, liberty or property are safe while the legislature is in session.

2 1

re: [local] Report on Portland Cpunks meeting
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 11:13 PM 01/23/96, Bruce Baugh wrote: >The nym signing is an idle thought of mine. I have a nym key which is, at >the moment, signed only by itself. I know friends of mine have nym accounts. >if we could assemble a group of folks whom I can trust enough to link the >nym and myself, it'd be nice to add some more signatures to the nym key, and >vice versa. I don't understand--what would signatures on a nym's key be good for? If I sign your key named "Bruce Baugh", I'm basically saying that I feel confident that this key really _does_ belong to Bruce Baugh. Others see my signature, and say "Jonathan, he's a groovy guy, if he feels confident that this belons to Bruce, well, he's probably gotten the fingerprint directly from Bruce in person, and I'm happy to use this key to send mail to Bruce." If, on the other hand, I sign "Toxic Avenger"'s key, then what benefit is this for third parties? Since Toxic Avenger is, by intention, _not_ linked to a real person, I'm not saying that I feel confident that this key really belongs to any particular real person. What am I saying?

3 2

Rutgers symposium on Copyright and NII 14-15 Feb 96
by Steven C. Perkins 17 Dec '03

17 Dec '03

Please forward as appropriate. Conference Program will be at "http://www.rutgers.edu/RUSLN/copyconf.html" this weekend. Roundtable Conference: Copyright Issues and the National Information Infrastructure Rutgers School of Law - Newark February 14-15, 1996 Rutgers School of Law - Newark is hosting an important conference dealing with major issues presented by the White Paper and electronic distribution of information products. Three roundtable sessions will engage 40-50 leading scholars, lawyers, corporate counsel, and government officials in a day-long discussion and debate of critical law and policy issues. The scheduling of this conference anticipates further policy debates and congressional hearings on pending proposals. It will join leading actors in an in-depth exploration of core issues through an exchange that identifies and addresses a diversity of interests and searches for greater mutual understanding and expansion of areas of agreement. Registration fee: $125 Registration deadline: February 10, 1996 (Walk-in registration permitted beginning at 8:30 AM.) Rutgers School of Law - Newark 15 Washington Street Newark, NJ 07102-3192 Attn: Assistant Dean Margaret C. Bridge For further information, call Assistant Dean Margaret C. Bridge at (201) 648-5094, or send email to Professor David A. Rice at drice(a)world.std.com. ------------------------------------------------------------- **********||||||||||\\\\\\\\\\*//////////||||||||||********** Steven C. Perkins sperkins(a)andromeda.rutgers.edu User Services Coordinator Ackerson Law Library http://www.rutgers.edu/lawschool.html Rutgers, The State University of New Jersey, School of Law at Newark http://www.rutgers.edu/RUSLN/rulnindx.html VOX: 201-648-5965 FAX: 201-648-1356 |||||||||||||||\\\\\\\\\\\\\||*||///////////////|||||||||||||||

1 0

Re: Hack Java
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:47 1/24/96 +0100, Christian Wettergren wrote: >(In my darker moments, I feel that the whole field of computer security >is in a major crisis. Ever heard of the Emperor's New Clothes? ;-)) We reduce the problem of an infected Java Interpreter to the previously unsolved problem of virus protection in general. I think it is possible to build highly virus resistant systems, but the cost in user retraining will be huge. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: Crippled Notes export encryption
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:28 1/24/96 -0800, Lucky Green wrote: >I agree. The reason for enforcing ITAR is to keep good crypto of the >*domestic* market. If ITAR no longer accomplishes that, new laws will be >passed. I think this is likely to be an oversimplification. While there are probably a number of people in e.g. FBI, DEA, DOJ who want to restrict domestic crypto, I suspect there are also a number of people in e.g. NSA who are sincerly interested in using SIGINT to protect the US from foreign threats and want strong domestic crypto as part of that protection. As always, public policy is a compromise between competing interests (INSIDE the beltway). However, the current policy is a holdover from the days when strong crypto was a closely held trade secret. Since this assumption is no longer true, the policy becomes more and more disfunctional every day. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

disk randomness
by Donald T. Davis 17 Dec '03

17 Dec '03

rich salz posted to this list a message i sent him about a portable way to gather disk-noise for a true rng. he also was kind enough to forward a reply to me from the list, because i wasn't subscribed at the time. the reply's author pointed out that my approach is not a practical one, and that NOISE.SYS gathers disk timings and other noise more efficiently, anyway. now that i'm subscribed, i'll answer on my own behalf: i agree that my algorithm isn't practical. in fact, that's why i agreed to rich's request that i let him post my message here. i don't recommend paging-timings to my clients, because it's not a workable approach for production-quality code. memory-paging's only virtue as a noise-source is that it's uniquely portable. i failed to emphasize this, in the message rich forwarded for me. the code needs no device-specific calls, and the only OS-specific call is the gettime() call. even with this virtue, i don't recommend it as a production-quality algorithm, unless the process that needs the rng is already memory-bound. i'm sorry that my original msg was unclear on this point; that's my fault, not rich's. by the way, i think the "interesting work" of mine to which rich referred, is my paper on disk randomness, which appeared in the crypto '94 proceedings. it presents work i did at mit from '88-9, and shows mathematically why disk-timings can contain true entropy: a disk's speed variations come from air turbulence, which now is known mathematically to be unpredictable in the long run. my coauthors were p.r. fenstermacher, a chaos-theory physicist, and r. ihaka, a statistician. -don davis, boston

1 0

Re: NSA says strong crypto to china??
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"perry(a)piermont.com" 9-JAN-1996 12:05:32.69 Alex Strasheim writes: > If this is true, it's great news. It would mean that the NSA is adopting > both cypherpunk analysis and tactics. Who would have thought? An NSA > remade in Tim May's image. I suspect that the NSA was thinking in our terms long before many of us were aware of cryptography. I actually think that in many cases, their behavior is perfectly rational. Their goals are merely different. If you are in SIGINT, I believe that the possibility of totally losing a valued intelligence tool must heavily weigh on your mind. Of course, they are hardly monolithic, and different groups at the NSA necessarily have different goals. Once SIGINT becomes much harder regardless of their previous attempts to stop it, I suspect that the NSA will become a friend and not an impediment. By that time, of course, the "we have to protect our people" types will be the only ones producing results and getting funding, and the "we have to gather information" types will have long ceased to produce. Thats probably a decade or more off, though. --------------- I suspect that the NSA can basically be divided into four groups: A. Those who are interested in protecting American individual liberties, and are thus (possibly potential) allies. This bunch may have a subgroup of those who already are allies, who have unfortunately been rather unsuccessful (or perhaps we simply haven't seen their successes). B. Those who realize about the potentials for individual liberty from cryptography, but believe that something else about America is more important. For instance, they may believe that the voters in a democracy should be able to institute whatever rules they like. Various left- and right-wing viewpoints are also possible here; the former would include worrying about lost tax dollars because of wanting big government, the latter would include concerns about pornography, etcetera. C. Those who are in the NSA because they want power, and strong cryptography's dissemination would hinder this. This group is likely to be concealed as one of the other groups. D. Those who haven't thought about it, and are simply following orders. I suspect that this is the largest group; while the overall level of intellect at the NSA may be higher than in the average population, the intelligence mindset of "need to know" may be keeping many people from realizing everything the NSA is doing. -Allen

1 0

None
by Mr. Nobody 17 Dec '03

17 Dec '03

In article <9601241720.AB13251(a)envirolink.org> Daniel Miskell <DMiskell(a)envirolink.org> writes: > Mr. Nobody writes: Dr. Nobody, to you. > >In article <Pine.LNX.3.91.960123192018.1008D-100000(a)zifi.genetics.utah.edu> > >zinc <zinc(a)zifi.genetics.utah.edu> writes: > >> i got this in the mail this morning. here's another blatant case > >> of illegal export. names and exact addresses removed to protect the > >> clueless. > > > >Why exactly did you post this message? I personally don't mind, but > >am just curious. > > Why exactly did YOU post this message? I personally dont mind, but am just > curious. I thought it was pretty clear from my message: curiosity.

1 0

Re: Crippled Notes export encryption
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> I can see two practical ways to build a netscape product outside > the US. The first is to export the source code for the Navigator > with the crypto code removed. All of the calls to crypto would > have to be removed as well. I've heard some people claim that the > government could come after us on the grounds that we were taking > part in a conspiracy to export strong crypto. Why not just print out all of the source code to Navigator (crypto and all) in a nice OCR font? Paper is exportable. Then you would 'only' have to scan it back in and debug it. andrew

1 0

Re: IPSEC == end of firewalls
by Rick Smith 17 Dec '03

17 Dec '03

Discussing firewalls, ses(a)tipper.oit.unc.edu (Simon Spero) writes: >What do you need as well as crypto before you can remove all firewalls? What firewalls do is they allow an independent group of people to track external network access and enforce rules over a large population of hosts. Given that just about any security installed on a workstation can be overcome (inadvertently or consciously) by someone with physical access to it, I doubt firewalls will ever go away entirely. Today's techniques will no doubt evolve and change in varous ways over time. But I'd be surprised if the function went away entirely. Until Netscape came out I suspected that desktop crypto wouldn't make the bigtime soon, simply because there are too many ways to do it wrong. Netscape has demonstrated that doing it wrong is no impediment to deployment. Organizations that want to do crypto well are probably going to concentrate crypto services in a few closely managed hosts to reduce the risk of messing things up. Rick. smith(a)sctc.com secure computing corporation

1 0

re: [local] Report on Portland Cpunks meeting
by Bruce Baugh 17 Dec '03

17 Dec '03

At 01:33 PM 1/24/96 -0500, Jonathan Rochkind wrote: >If, on the other hand, I sign "Toxic Avenger"'s key, then what benefit is >this for third parties? Since Toxic Avenger is, by intention, _not_ linked >to a real person, I'm not saying that I feel confident that this key really >belongs to any particular real person. What am I saying? Over time, some nyms take on a distinct identity of their own. In fact, some do it very quickly, a with the neo-Nazi twits now arguing in favor of rec.music.white-power over on news.groups, some with distinct "voices". The thought, therefore, as I imagine it would be "You don't know I am in person, but you can count on me to be who I am, with this style and set of views, and I say that this guy is another actual person with the same." Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

2 1

InfoWarCon Europe 1996 Updated Schedule
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

---------- Revised Short Draft DOI: 18 Jan 96 ---------- P L E A S E D I S T R I B U T E W I D E L Y InfoWarCon (Europe) '96 Defining the European Perspective Brussels, Belgium May 23-24 1996 Sponsored by: National Computer Security Association Winn Schwartau, President and CEO, Interpact, Inc. Robert David Steele, Chairman & CEO, Open Source Solutions Group May 22, 1996 17:00 - 20:00 Pre-Registration 18:00 - 21:00 Hosted Cocktail Party with Music Most conference speakers will be in attendance. Meet Mr. Schwartau and Mr. Steele. May 23, 1995 07:00 - 08:30 Registration 07:00 - 08:30 Sponsored Continental Breakfast PLENARY SESSIONS 08:30 - 09:00 Keynote Speech Major General William Robbins Director General of Information and Communications Services Ministry of Defence, United Kingdom (Invited) 09:00 - 10:00 "Information Warfare: Chaos on the Electronic Superhighway" Winn Schwartau, President and CEO, Interpact, Inc., USA 10:00 - 11:15 East Versus West: Military Views of Information Warfare Moderator: Robert Steele East: General Nikolai Ivanovich Turko, Information Warfare Expert Russia (invited) West: Captain Patrick Tyrell Assistant Director, Information Warfare Policy, Ministry of Defence, United Kingdom 11:15 - 11:45 Sponsored Break 11:45 - 13:00 Law Enforcement in Cyberspace: Cooperation is the Key Moderator: Winn Schwartau Miguel Chyamorro, (invited) Executive Assistant Director, Interpol Sweden Netherlands--Rotterdam Police (invited) 13:00 - 14:30 Lunch 13:30 - 14:00 Special Luncheon Presentation BREAKOUT SESSIONS 14:30 - 16:00 Breakout I: Threats to European Civil Prosperity Moderator: Winn Schwartau:) Private Businesses Germany, France, UK Breakout II: Information Warfare: Support for Conventional War Fighting Moderator: SHAPE - NATO (invited) Panel: US - Gen. Jim McCarthy USAF (Ret) Russia: Admiral Vladimir Semenovich Pirumov (Ret) Chairman of Scientific Counsel of the Russian Security Counsel (invited) Sweden - (Invited) 16:00-16:30 Sponsored Break PLENARY SESSION 16:30 - 18:00 "Hackers: National Resources or Merely Cyber-Criminals?" Co-Moderators: Mich Kabay, Ph.D., Director of Education, NCSA and Robert Steele, President, OSS, Inc. Panel: Rop Gonggrijp - Hactic and The Digital City Amsterdam, Netherlands Chris Goggans, co-founder Leagion of Doom, US CHAOS Computer Club, Germany (invited) "Frantic" Convicted French Hacker (invited) 18:00 - 21:00 Hosted Reception 21:00 - 23:00 "Dutch Dinners" for Birds of a Feather Rallying points will be provided. May 24, 1996 07:00 - 8:30 Sponsored Continental Breakfast 08:30 - 9:00 Keynote Speech "Efforts to Maximize Information As New Age Weapon" General Pichot-Duclos, France PLENARY SESSIONS 9:00 - 10:00 "Creating Smart Nations Through National Information Strategies: Intelligence And Security Issues" Robert David Steele, President, OSS, Inc. US 10:00 - 11:15 "The Convergence of Military and Commercial Vulnerabilities" Moderator: Winn Schwartau Panel: Bob Ayers, DISA, Department of Defense, US Dr. Leroy Pearce, Sr. Tech. Advisor, representing MajGen Leech, Asst. Dep. Minister, Defence Information Services, Canada Holland / Belgium Captain. Pat Tyrell, Ministry of Defence, UK 11:15 - 11:45 Sponsored Break 11:45 - 13:00 Societal Impact of Information Warfare Moderator: Winn Schwartau, Panel: The Croatian View: Pedrag Pale, Chairman InfoTech Coordinating Committee, Ministry of Science, Technology, and Informatics. General James McCarthy (ret) US 13:00 - 14:30 Lunch 13:30-14:00 Special Luncheon Presentation BREAKOUT SESSIONS 14:30 - 16:00 Breakout I: Legislation & Personal Privacy: A Global Electronic Bill of Rights? Moderator: Dr. Mich Kabay, NCSA Simon Davies, Electronic Privacy International, UK Breakout II: "Industrial Espionage: An Update" Moderator: Winn Schwartau Phillipe Parant, Diecteur, DST, France (invited) Miguel Chamorro, Exec. Director, Interpol (invited) Kroll Associates US 16:00 - 16:30 Sponsored Break PLENARY 16:30 - 18:00 Defining War in the Information Age "The New National Security" Brief comments by Winn Schwartau and Robert Steele - and then a lively interactive audience debate. 18:00 - 18:10 Closing Comments 18:00 - 20:00 No-Host Reception To obtain the latest edition of this program, send EMail to: euroinfowar(a)ncsa.com For more information about NCSA: WWW: http://www.ncsa.com CompuServe: GO NCSA EMail: info(a)ncsa.com Sponsorships for various InfoWarCon (Europe) 96 events are still available. To find out how to sponsor portions: Contact Paul Gates at the NCSA: pgates(a)ncsa.com To reach: Winn Schwartau: Winn(a)Infowar.Com Robert Steele: ceo(a)oss.net V 1.3/1.18.96-Short Peace Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

1 0

Re: Crippled Notes export encryption
by Alex Strasheim 17 Dec '03

17 Dec '03

> The usual issue: That if a foreign-originated product even appears to be a > standard (so far, none have been), and includes strong crypto, then the NSA > and other agencies will simply change the rules. Thus, if extremely strong > crypto from "Netscape-Zurich" starts to have a significant market presense > in the U.S., then some law will be passed to restrict it. But what would they restrict? The use of strong crypto between two domestic points, or strong crypto where one end is within the US and the other without? We already have the former -- wouldn't it be hard for them to take it away? Especially if the software already has a large installed base, which is your premise? I'm not denying that there are people in the NSA who would want to react that way, but I don't think they'd be able to pull it off. It is true that the National Security establishment has a lot of power and influence here. But there are other groups with power as well, and the security types don't have the ability to do whatever they want without regard to the opinions and interests of those other groups. I think America's commercial interests will carry the day. The NSA isn't capable of achieving its objective, which is to preserve passive surveillance. It doesn't matter what the rules are or what Congress passes. It's over. There are a lot of smart people in the NSA, and some of them have to know that. Big companies like Netscape, Sun, Microsoft, and IBM/Lotus, on the other hand, will almost certainly achieve their objectives if they win the political fight. They'll make buckets of money selling crypto software abroad. And if they lose the fight, they're going to be handing big opportunities to foreign competitors. Who's going to fight harder? You add to that the fact that impartial observers will say, for the most part, that Netscape's right and the NSA is wrong, and the tremendous interest world wide in creating a trustworthy net based infrastructure for commerce, and the NSA starts to look a good poker player with a bad hand. They used to say that "what's good for General Motors is good for the country." A lot of people still feel that way about our biggest companies. When they get their acts together and stare down the NSA in a block, it will all be over. I feel a little strange about constantly playing the corporate shill here. I'm not a corporate person, and all of the companies I talk about here would probably find me unsuitable for employment. I'm certainly not going to participate in the crypto profits that they'll realize. My interest in this isn't the same as Netscape's. But it's going to be Netscape that pushes this thing over the top. Crypto is a big tent issue. Some people want the restrcitions eased so they can make money, some are afraid of the government, some want to protect civil liberties, some love the math and technology, and others just want to thumb their noses at Mr. Freeh. I want to see censorship become technically infeasible. There's very little popular support for that position among the general public; everyone wants censorship as long as they agree with the censor. Arguing for crypto from the vantage point of a civil libertarian is pointless. Even here on cypherpunks the bill of rights doesn't get much respect. The point is that the only guy in the big tent with any clout at all is the corporate manager. When the kids get together on the street and protest net censorship, does anyone care? Is a militia movement argument going to play in Peoria? (I think those are counter productive -- at times I've been scared enough by them to re-examine my own position.) I agree with Noam Chomsky when he says that corporate interests dominate our politics, but I also agree with Milton Friedman when he says its for the best. We should focus our efforts on energizing corporate America for the fight. The best way to do that is to demonstrating to customers that exportable security is nothing more than snake oil under the current rules. Another way it is to explain to people -- journalists and managers alike -- exactly why the current rules are bad for business. Lets develop and popularize arguments against the NSA position, not radical or esoteric arguments, but the kind of arguments that sensible people who go to work and read the paper every day can repeat to one another when they talk about politics. If we can get this stuff onto the editorial page of the WSJ -- which is where it belongs -- we'll be in spitting distance of a victory.

1 0