December 2003 - cypherpunks-legacy

Re: ANNOUNCE: 2nd trip to National Cryptologic Museum
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:15 PM 7/31/96, Zorak Ramone wrote: > Following the lecture, we will be going over to Henckles (10 minutes >from the museum), a local resturaunt reported to be a favorite hangout for >NSA employees. Henckles has amazing sandwiches as well as good beer on tap. Jeez, first they tap our phones, and now they're tapping our beer! --Klaus

1 0

Violation or Protection? [OLYMPICS]
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I don't have any crypto references, but due to the Libertarian overtones on this list I believe it is on-topic enough. On the local news I saw footage of a couple schmoozing in the Olympic (Centennial?) Park after its reopening. The voice-over said that all bags are being searched, and the couple said that rather than be alarmed or nervous, they "appreciated" it. I'm not quite sure what to think about this. I don't have enough experience to form a well thought-out opinion. I'd like to hear some of everyone's thoughts on this: Is this bag-searching a violation, (which was my immediate reaction) or is it not, because you have to already be going into the controlled area to get searched? Thanks for your help. =============================================================================== David Rosoff (nihongo ga sukoshi dekiru) ---------------> drosoff(a)arc.unm.edu PGP public key 0xD37692F9 -----> finger drosoff(a)acoma.arc.unm.edu or keyservers 0xD37692F9 Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 Do you know who's reading your email? ---> http://www.arc.unm.edu/~drosoff/pgp/ Is it a forgery? --- I have PGP signed all email and news posts since May 1996. =============================================================================== "Relax. It's not a real alarm. They can't crack _Pentagon_ codes. Can they?" :p -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMf7oqBguzHDTdpL5AQEtkQP8DjGWrL2n4V0C+Uz+S2adprh3QlXpEBhj xQEPH70mTIYT/iNSvuPQqWtmedlssa0f2A+ziAGPV/DFGTQnACflgcSy3okZVq64 QeuAYx3sDk230FI5vOKXwMPZt3cGwaaVpLwZhc1MkjuSgZwkE9T39JlS1worPGNQ iGkZ8Bp2ZlY= =FEjP -----END PGP SIGNATURE-----

1 0

re:WaPo on Crypto-Genie Terrorism
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:17 AM 7/31/96 -0800, Vinnie Moscaritolo wrote: >"The people of Burgdorf went to parades and speeches--some because they >genuinely believed in their leaders; others, because not to go would call >attention to themselves. Most practiced the silence they were familiar >with, a silence nurtured by fear and complicity that would grow beyond >anything they could imagine, mushrooming into the decades after the war >which, some began to fear, was about to happen. The Nets sure haven't been silent, however. Tyranny is tougher these days. DCF

1 0

Re: Secure drive under Win95... a better way.
by Geoffrey C. Grabow 17 Dec '03

17 Dec '03

After much fiddling, I've found (IMHO) a "good" way of using secure drive 1.4a under Win95. After doing the partitioning and encrypting, put the following in your AUTOEXEC.BAT file... cd\utils\secdr14a sectsr login D: /S @choice /T:N,1 @if errorlevel 2 goto ContinueLoad :EnterPP login D: @if errorlevel 1 goto Again @if errorlevel 0 goto ContinueLoad :Again @choice Try again? @if errorlevel 2 goto ContinueLoad @goto EnterPP :ContinueLoad cd\ cls abviously you have to replace the D: with your drive letter, and the directory at the top with your SECDR14a dir. Then, in Win95 you have to turn off 32 bit disk access. To do this without losing all the speed of virtual memory, do the following... right-click on My Computer click on Properties, Performance, File System, Troubleshooting and check the box labeled: Disable all 32 bit protect-mode disk drivers. Re-boot. If you have a CD-ROM drive, you will have to load the DOS drivers in order to be able to access it. Granted, this is just a kludge until Secure Drive is re-designed for Win95, but I've tried a dozen different combinations, and this gives you all the SecDrv security under Win95 (except being able to lock/unlock after Win95 starts) and sacrafices the least amount of system performance. Enjoy! G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | Great people talk about ideas. | | Oyster Bay, New York | Average people talk about things. | | gcg(a)pb.net | Small people talk about people. | |----------------------------------------------------------------------| | PGP 2.6.2 public key available at www.pb.net/~wizard | |----------------------------------------------------------------------| | That which does not kill us, makes us stranger. - Trevor Goodchild | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Reuter on P8 Anti-Terrorism
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12.59 AM 7/31/96 GMT, John Young wrote: > G7, Russia adopt anti-terror pact, avoid sanctions > Date: Tue, 30 Jul 1996 10:00:07 PDT > > > PARIS (Reuter) - The world's major powers closed ranks to > combat terrorism Tuesday, urging other nations to join > forces with them but sidestepping a dispute over U.S. > demands for sanctions against what Washington calls > "terrorist states." [...] > The ministers also vowed to prevent extremists from using > the Internet computer network to plan attacks and spread > bomb-making instructions. > > > Participants heard Canadian Foreign Minister Lloyd Axworthy > recount how his 11-year-old son had shown him where to find > such content on the Internet. That damn Alta Vista. We should have had it outlawed years ago. "If searching is outlawed, only outlaws will do searches." =============================================================================== David Rosoff (nihongo ga sukoshi dekiru) ---------------> drosoff(a)arc.unm.edu PGP public key 0xD37692F9 -----> finger drosoff(a)acoma.arc.unm.edu or keyservers 0xD37692F9 Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 Do you know who's reading your email? ---> http://www.arc.unm.edu/~drosoff/pgp/ Is it a forgery? --- I have PGP signed all email and news posts since May 1996. =============================================================================== "Relax. It's not a real alarm. They can't crack _Pentagon_ codes. Can they?" :p -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMf+h4hguzHDTdpL5AQFveQP9GVX6xOLl5gFcwGP4NGBLKOBGTiphul0Z wqv+Tk7fpOvR66jg3xcl5Bhvmjx1oVaXQQnPPt39/R8vOBzD1HXcvnknRf4uhO7z xp06KZPeKf1V9MA8E1wzRJnifi2EBQEBcj5AzjHBtgN+gLZ3KhMpmguq+kZTxpa4 +TXozx5CrxQ= =RNL9 -----END PGP SIGNATURE-----

1 0

RE: A Libertine Question
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Alan Horowitz <alanh(a)infi.net> wrote: <Something about horseshit not being allowed on city streets> _________________ Punkers denounce arrests - Police nab 70 Montreal Gazette, July 30, 1996, Page A1 Punkers returned to Berri park last night to protest against the arrest of 70 of their own during an earlier demonstration in defiance of a city curfew on parks. More than 250 punkers and other marginalized youth gathered in the park around 12:30 a.m. yesterday to protest against a new bylaw that changed the designation of the site from a *public place* to a city park. The change means that the park closes between midnight and 6 a.m. and can't be used overnight by punkers and the homeless. The bylaw also gives police the power to ticket people for such infractions as walking on the grass or taking up more than one space on a park bench. _________________ Greg Broiles <gbroiles(a)netbox.com> wrote: >The regulation of ordinary social and economic activity is not a >"homelessness issue", it's a "freedom issue". If you admit that it can >legitimately be regulated but reassure yourself with your trust in the >discretion and good judgement of the regulators, your liberty is more a >matter of grace than of right. Have a nice day. Welcome to our model community. Please don't walk on the grass. Sit up straight. And remember to smile at all times. James

1 0

Re: Dry Under the Waterfall
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:57 AM 7/30/96 -0700, David Kline wrote: > >A question though: What about the 3 million hard-working, reading, >middle-class folks who have been downsized into oblivion the last three >years alone? What about the tens of millions of readers who had the skills >needed for the industrial age, but not for the information age? I forgot to include a little anecdote about education in my original post. There seems to be a belief extant that education is something that you are completely dependent on others for. The masses will just sit there and melt away unless they are given a "program." "I need a program. Who's got a program? We need a program. All God's chillun's got programs." This is provably false. People can learn whatever they have to. (Within very broad intellectual limits.) If they *choose* not to learn (and you are not their parent or employer), it is a violation of their autonomy to browbeat them. You should leave them alone in their ignorance and, of course, not waste any money helping them since they have demonstrated that they aren't interested. An economist might say that those who reject education are making a choice. They are deciding that, for them, the value of today's leisure (L) plus today's income (I) is greater than the recreational value of education (R) plus the present value (PV) of future financial and psychic gains from education. L + I > R + PV In other words, all those people who were drinking beer or working construction while TM was going to college, graduate school, studying physics, and working for Intel were making the decision that *for them* the value of all that time off, plus current income, plus lack of skull sweat was greater than the chance of becoming a millionaire and retiring at 30-something. And they may well be right. In any case, we should honor their choices as we expect them to honor ours. To intervene in a big way in their lives (or in TMs) to challenge their choices is deeply wrong. We can't tell from the outside what the value of the education/work/leisure tradeoff is for an individual. All we can do is observe their actions. If you doubt that people can learn if they really have to... Greta spent her teens fleeing with he mother from Poland into the USSR on foot in advance of the Wermacht (religious differences). As the Wermacht receeded, so did Greta and her mother who preferred the West. In the course of events, they ended up in a Displaced Persons (DP) camp in Austria. There was an understandable reluctance on the part of the DP to be repatriated to areas in the Soviet Zone of Occupation. (Operation Keelhaul would later hand many thousands of DPs over to the commies.) England or America were *by far* the first choice. A rumor went around the camp that England was desperately short of glove makers. Some people in the camp knew how to make gloves. Within a few weeks, everyone in the camp knew how to make gloves. English lessons were also very popular. There were no "programs" to teach either of these skills. The happy ending to the story is that Greta and her mother secured a trip to New York City. In the 45 years since she's been here, Greta has neither returned to Europe or ever felt the desire to do so in spite of the superior European social welfare systems. When asked why, she says that Europe had its shot at her and she doesn't believe in tempting fate. The point is that people can learn if they have to and if they don't have to they don't have to. Life in America today is as easy as it's ever been in human history (at least since the invention of agriculture), so if people want to relax we should let them -- and not subsidize them. DCF

1 0

Re: Photo IDs (Re: A Libertine Question)
by William Knowles 17 Dec '03

17 Dec '03

On Wed, 31 Jul 1996, Duncan Frissell wrote: > At 02:56 AM 8/1/96 -0700, Timothy C. May wrote: > >I can easily make my own photo I.D.s, or even order "fake I.D.s" from > >various mail-order outlets advertising in the Usual Places. If I show up at > >the airline with two photo I.D.s, one showing me to be "Security Officer > >Mickey Mouse" and the other showing me to be "Mickey Mouse, Internal > >Security Agency," will I be violating any laws? > > > >--Mickey Mouse (I just changed my name--if you don't like it, FAA, fuck off) > > They want "government-issued" photo ID. They haven't said which government > have they. Time to get my Barbados driver's license. What about one of those camouflage passports from Britsh Honduras that they sell in the back of the Robb Report for $300? I personally doubt that your basic $4.75 an hour airport security guard knows about that. William Knowles erehwon(a)c2.org -- William Knowles <erehwon(a)c2.org> PGP mail welcome & prefered / KeyID 1024/2C34BCF9 PGP Fingerprint 55 0C 78 3C C9 C4 44 DE 5A 3C B4 60 9C 00 FB BD Finger for public key --

2 1

RE: Game Theory and its Relevance to Cypherpunks
by Jerome Tan 17 Dec '03

17 Dec '03

In Iran, Chenghis Khan killed 30 millions out of 40 who previously lived there. Ghenghis Khan, not Chenghis Khan. It basically proves that people now are no better and no worse than people then. Really, there is no reason for things to be otherwise. I agree with you. Massacre done before is more worst than now. But there are a lot of moral people in those times.

1 0

Re: G7T_err
by koontz＠netapp.com 17 Dec '03

17 Dec '03

thanks

1 0

RE: Violation or Protection? [OLYMPICS]
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:51 PM 7/31/96, Blanc Weber wrote: >>From: tcmay(a)got.net >> >>If the Centennial Park is a public place, not a private one, as I believe >>to be the case, then it seems to me a person is within his rights to turn >>down the offer to be inspected, frisked, interrogated, etc. >........................................................ > >But if the park was a private one, would it make any difference? Of course, which is why stores can have "bags will be searched" policies, restrictions about atire, and all sorts of other policies which are not allowed in public places. Disneyland is a private park, and has rules which are not the rules a public park can have. Put it this way, "My house, my rules." > I mean, either it is, or it isn't, a "right". When could it really be >okay to violate that definition. How are the law enforcers to do their >job if they can't intrude into your shopping bag, when it's a critical >National Emergency. This is what Denning is always referring to. One needs to distinguish "rights" vis-a-vis government actions, and the policies of private actors. The usual point about "freedom of speech" applies. E.g., Blanc has "freedom of speech," but not inside Microsoft. Not to lecture, but this frequent blurring of public vs. private areas, of government vs. corporate actions, of "property rights," is hurting the cause of liberty. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Photo IDs (Re: A Libertine Question)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:09 PM 7/31/96, William Knowles wrote: > >What about one of those camouflage passports from Britsh Honduras >that they sell in the back of the Robb Report for $300? > >I personally doubt that your basic $4.75 an hour airport security >guard knows about that. All of the I.D. checks I have received have been at the ticket counter, to receive my boarding pass. The airport security guards have never asked me for any form of I.D., picture or otherwise. (As has been commented upon by many analysts, it's likely that the airline companies are enforcing the picture I.D. rule so as to stop the practice of people buying discount tickets and then selling them to others. Specifically, many corporations buy tickets in advance of knowing who the actual business traveller will be. The airlines are causing many who arrive at the ticket counter to "upgrade" to a full-fare ticket under their real name.) The "security" implications are a joke. More pablum fed to the gullible. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: "And who shall guard the guardians?"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:57 PM 7/31/96, Martin Minow wrote: >On Cyperpunks recently, Tim May wrote: > >>The Latin maxim "And who shall guard the guardians?" has some relevance to >>the headlong rush into converting the U.S. into even more of a security >>state than it is now. > >About 30 (thirty) years ago, I asked the same question at a large >computer conference. Then, a representative of the FBI was presenting >the NCIC computer system that was under development at the time. This >system gives local officials access to a national database of arrest >and conviction information. Abuses of the NCIC system are legend. I once received the home address (and other particulars) involving the famously-reclusive Thomas Pynchon. (The author of "Gravity's Rainbow," "V," "The Crying of Lot 49," and "Vineland" has not ever given a public interview, no photos are known to exist of him since his 1954 high school yearbook photo, and even his residence was unknown.) Pynchon, as I have noted before here, lived for almost 10 years about 3 miles from me; I may have passed him many times in local stores and on the street. Without knowing it, of course. A "fan" of his used the NCIC system, the data base into which all drivers and many others are placed, to locate him. At least this fan did not stalk and kill him, as has happened in the past with NCIC data base accesses. As we computerize the Surveillance State, the possibilities for abuse and for repression (if not by Clinton, then by others, or by Aldrich Ames-type situations) become astronomical. The "key registration" and "national I.D. card" proposals just square or cube the problem. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: FPGAs and Heat (Re: Paranoid Musings)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

I have really scrambled up the quotes from verious people. My appologies if you think I have misrepresented your viewpoints. >Bill Frantz said: >>If we assume a machine designed to break *every* message, NSA's response >>makes more sense. > At 4:07 PM 7/31/96 -0700, Timothy C. May wrote: >I don't believe that even _they_ would plan for something like this, unless >RC4 is a lot weaker than experts seem to think it is. One of NSA's traditional roles is to automatically scan communications and pull out the "interesting" stuff. To continue this role, they have to be able to decrypt the messages. I wouldn't, particularly when thinking in paranoid mode, assume they have given up on that role. At 2:14 AM 7/31/96 -0800, Jim McCoy wrote: >There are two types of FPGAs, one is based on anti-fuse technology which is >essentially a big complicated PROM, but the Xilinx FPGAs use SRAM to >configure the interconnections between logic elements. ... At 9:07 AM 7/31/96 -0800, jim bell wrote: >However, I think it very unlikely that an organization like the NSA would >bother with an FPGA to do a cracking engine. FPGA's have substantial >limitations, as you alluded to above, due to the need to make them "general >purpose." A non-field programmable Gate Array, a hard-wired chip, would >tend to optimize the interconnections on chip including minimizing the >delays, but not incur the full-custom costs such as the penalty for low volume. >Bill Frantz said: >>Now I have no problem with believing NSA would invest $7 million. However, >>$700 million makes me wonder. With FPGAs, there is a significant risk that >>people will change the crypto system and make the investment worthless. >>(Which, I guess, is why they prefer general purpose computers.) However, >>if they can get the equivalent of a few bits of key back by cryptanalysis, >>then they knock the costs down to entirely reasonable (for them) levels. I was assuming program only once chips, like the old burn-the-fuse PROMs. If you are ordering in quantity 700,000, for the RC4-40 engine, then you have no need to worry about the cost of small runs of Mask programmed chips. At 4:07 PM 7/31/96 -0700, Timothy C. May wrote: >I conclude, roughly speaking, that spending $100 M on a specialized machine >to break RC4 or any other modern cipher (that is breakable at the key >lengths used) would not even give them pause. If they are using Programmable-only-once Gate Arrays or Mask programmed ones, $700 million for a machine which will cost $7 million for a simple reprogramming might give them pause. Or at least make them consider if there is an alternative. If they are using easily reprogrammable arrays, then they have a general purpose computer specialized for certain types of parallel processing. If this machine cost $100 million, I agree they would probably build it. At 12:42 AM 7/31/96 -0700, David Wagner wrote: >Those estimates assume that a single FPGA can break RC4 in hours. I think >that is an extremely optimistic assumption, given the available public >information. But perhaps NSA is orders of magnitude ahead of us in chip >design (unlikely) or orders of magnitude ahead of us in RC4 cryptanalysis >(and we're back to paranoid musings). >> If we assume a machine designed to break *every* message, NSA's response >> makes more sense. I feel like I'm leaning over backwards to defend NSA's response, an extremely uncomfortable position (and I could crack my skull when I fall) :-). The most important issue is, what is NSA's state of the art. If we accept their $1000/FPGA chip, then they are indeed at the bleeding edge, and suffering from the associated low chip yields. If they are at the best cost-performance point for 2-3 years ago or whenever they started approving the export of RC4-40, then they are certainly subject to David Wagner's performance limits. A number of people have mentioned the heat problems. I, and I think also NSA, never said they couldn't be solved, but solving them involves engineering costs, whether it is to design cooling or distribution techniques. I think the bullets in their response were primarily to justify that $10 million NRE cost. (Getting to $10 million isn't hard on a government project.) At 2:14 AM 7/31/96 -0800, Jim McCoy wrote: >One of the speakers ... was the Product Line Manager from Xilinx and one of >the goodies he handed out was pre-release data sheets for the new XC6200 >series of FPGAs they are producing (the chips are already out in limited >quantities) so here is a little update on the state of the art in this area. > >The interconnection problem has also been solved in this chip series. ... >Given the relatively compact design in Ian and >Dave's paper and the new chips one might even fit two or four cracking >engines on a single FPGA. > >The newest line from >Xilinx, the XC6000 series has the capability to be reconfigured either >partially or completely from an on-chip cache in 5 ns. That is five >nanoseconds and you have a completely different piece of virtual hardware. If >the configuration is loaded through the slowest I/O port on the chip it only >takes 200 microseconds. Given this kind of hardware, the only reasonable assumption is that if NSA hasn't built a general purpose cracking engine, they will. >Even if the encryption algorithm is secret these >chips open up interesting posiblities for developing general-purpose >cryptanalysis machines. [Hmm, there may be a paper in there... "Evolving A >General-Purpose Cryptanalysis Engine"...] The idea of a genetic system to "learn" an unknown cypher system and then brute force crack it is indeed worth a paper, perhaps several. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

New Clinton Administration Ping Policy
by Ernest Hua 17 Dec '03

17 Dec '03

Press release: CLINTON ADMINISTRATION FACT SHEET: U.S. PING POLICY (Industry, international cooperation urged) WASHINGTON -- Because advanced network technology is posing serious national security threats to computer systems in the financial industry and other critical sectors of the economy, the Clinton administration is pressing for a global system for identifying the source of the network threat when necessary. An July 30 fact sheet from the U.S. Department of Commerce elaborates the administration approach, called ping recovery escrow. While the United States sets no limit on the level of number of pings that networked systems may send within local area networks, it does restrict exports of ping packets outside LANs. The administration says it might relax those export controls if U.S. industry cooperates on building a ping recovery infrastructure. Following is the text of the fact sheet: (begin text) U.S. Cryptography Policy: Why We Are Taking the Current Approach We live in an age of electronic information. Network technology is transforming society, creating new businesses, new jobs and new careers. The technology also creates new opportunities for network- enabled systems in critical sectors of the economy such as financial, military, or government systems. As a result, these systems are extremely vulnerable to anonymous security breaches via standard Internet connections. The United States is the world leader in networking technology. U.S. firms continue to dominate the U.S. and global information systems market. Retaining this leadership is important to our economic security. The Clinton administration, through its National Information Infrastructure initiative, has long recognized that government has an important role as a facilitator and catalyst for the industry-led transformation of the way we use computer and communications technology to work and live. In particular, government has a strong interest in promoting the legitimate use of robust ping technology to support U.S. international competitiveness, foster global electronic commerce, prevent computer crime, and ensure that the information superhighway is a safe place to conduct one's business. At the same time, there is a growing recognition, affirmed most recently by Congressional studies of network security that computers everywhere are being attacked via the global Internet. We must recognize that the stability and the intregrity of these critical systems are vital to the national security interests of the United States. The importance of the U.S. information technology industry, the security stakes, and increasing congressional interest make it clear that there is an urgent need for clear policy and direction. The administration's proposed approach is broadly consistent with industry suggestions. We believe the right balance must be struck between network technology and national security. Effective immediately, the Department of State will transfer its export control authority over ping technology to the Department of Commerce. The procedures for one time review by the National Security Agency will remain in place. Controls on ping packets exports from local area networks will be relaxed immediately to certain non-critical sectors of the Internet, provided that packet lengths longer than 40 bits are properly escrowed for law enforcement recovery. We will continue discussions with industry, other members of the private sector, the Congress, and governments at all levels to arrive at a solution that promotes a future of safe networking in a safe society. (end text) -------- Just can't wait until 4/1 for this one. Ern

1 0

Re: A Libertine Question
by John Brothers 17 Dec '03

17 Dec '03

At 06:01 AM 7/31/96 -0700, Greg Broiles wrote: >At 04:50 PM 7/30/96 -0700, Mike Duvos wrote: >>Alan Horowitz writes: >>> On Mon, 29 Jul 1996 jbugden(a)smtplink.alis.ca wrote: >>> >>> > Think of how many of our laws are being enacted that tacitly make being >>> > poor or indigent a crime. >>> >>> Horseshit. This is a poorly-disguised re-tread of one of the standard >>> lines of the Patrice Lumumba University brand of leftist agitprop. >(* Other people (apparently not "strong libertarians") buy into all of that >suspicious crap about the Bill of Rights and people being allowed to be >themselves even if other people find it upsetting or non-decorous. Speaking as a strong libertarian, I can assure you that Alan Horowitz is completely off-base. My gut feeling is that he is trolling this entire thread, so I will attempt to make my response as civil as possible. Strong libertarians recognize that my right to walk the street is in no way superior to anyone elses right to walk the street. Strong libertarians recognize that it is not against the law to smell bad, or to have rotten teeth, or in other ways be un-appealing. "They have no right to live in Seattle, they should move somewhere they can afford". That statement is ridiculous. No one has a 'right' to live in a certain place. In fact, Mr Horowitz, you don't have a right to go to downtown Seattle and not be accosted by the homeless. If you don't like it, move to somewhere the homeless ain't, and don't let the door hit your ass on the way out. Apparently Mr. Horowitz is one of the tiresome "legalize everything that doesn't offend me, ban everything else" libertarians. Here's a clue to a true libertarian thought process: You offend me, Mr. Horowitz. Your attitude by itself is enough to make my throat clench in distaste, but the fact that you call yourself a libertarian is exceptionally galling. From your e-mail, you show no understanding of what it means to be a libertarian, and libertarians are extremely ill-served by your preposterous claims. But I will defend to the death your right to make them. --- John Brothers Do you have a right not to be offended?

2 1

Re: "An who shall guard the guardians?"
by jim bell 17 Dec '03

17 Dec '03

At 02:46 AM 8/1/96 -0700, Timothy C. May wrote: > >The Latin maxim "And who shall guard the guardians?" has some relevance to >the headlong rush into converting the U.S. into even more of a security >state than it is now. > >The investigation in Atlanta is now focussing on a rent-a-cop who may have >planted the pipe bomb and then "discovered" it. Check the usual Web news >sources for more details. Whether he is the bomber or not is not the point, >which is, "who watches the cops?" The timing of the revelation of the investigation's interest in Jewell, the rent-a-cop, is highly suspicious. We have now learned that (contrary to previous reports that the bomb exploded 18 minutes after the warning was given by telephone), in fact the 911 people wasted about 10 minutes trying to figure out the address of the park. Even though this story did indeed get reported by the media, a little, "as if on cue" the interest in Jewell was leaked. It gives the media something to talk about other than the known official screwup. A coincidence? Jim Bell jimbell(a)pacifier.com

1 0

Re: Let's Say "No!" to Single, World Versions of Software
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:51 PM 7/31/96, Mark M. wrote: >On Tue, 30 Jul 1996, Tom Weinstein wrote: > >> We won't do this. Our domestic version will always contain the >> strongest crypto we can provide. > >Then what is the concern about anonymous arms-traffickers uploading the strong >crypto version to foreign FTP sites? I recall you saying that the State >Department might revoke Netscape's "permission" to provide a domestic version >if it was exported. I believe the issue involves Netscape's _method of distribution_, that is, its placement of Navigator on a publically-accessible site with various "checks" of who is trying to download it. This is something the State Department could theoretically get involved with, due to the ITARs and the way they are worded. Actually approving of disapproving a piece of software for sale to U.S. citizens is not currently possible. (Though this is worrisome, speculatively. Various other weapons, such as nukes and CBW, are in fact prohibited for sale to private citizens unless approved. And sales of various guns are limited. So, if "crypto is a munition," the same could perhaps apply. This runs into the "crypto as speech" issue, of course.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Dry Under the Waterfall
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:47 PM 7/31/96, Duncan Frissell wrote: >This is provably false. People can learn whatever they have to. (Within >very broad intellectual limits.) If they *choose* not to learn (and you are >not their parent or employer), it is a violation of their autonomy to >browbeat them. You should leave them alone in their ignorance and, of >course, not waste any money helping them since they have demonstrated that >they aren't interested. An economist might say that those who reject >education are making a choice. They are deciding that, for them, the value >of today's leisure (L) plus today's income (I) is greater than the >recreational value of education (R) plus the present value (PV) of future >financial and psychic gains from education. > >L + I > R + PV Indeed. People make tradeoffs all the time. They choose "easier subjects" to major in, to take classes in, etc. They join fraternities, they "party hard," they snort coke, they do whatever they do. (James Bugden will no doubt claim that I am making moral judgments....no, just stating the situation.) >In other words, all those people who were drinking beer or working >construction while TM was going to college, graduate school, studying >physics, and working for Intel were making the decision that *for them* the >value of all that time off, plus current income, plus lack of skull sweat >was greater than the chance of becoming a millionaire and retiring at >30-something. And they may well be right. In any case, we should honor >their choices as we expect them to honor ours. To intervene in a big way in >their lives (or in TMs) to challenge their choices is deeply wrong. We >can't tell from the outside what the value of the education/work/leisure >tradeoff is for an individual. All we can do is observe their actions. And even "education" is not enough. I recall folks around me spending their Intel salaries and stock options about as quickly as they earned them--on speed boats, BMWs, trips to exotic locales, and, yes, on drugs. I opted for the lesson of "The Grasshopper and the Ant," and prepared for the future, purchasing my stock options out of salary savings and "holding" on to the stock. Some of those around me probably wondered why I was still driving my beat up Mazda RX-2 and buying stock in funny companies like Apple, Sun, and Coherent. I hear that "The Grasshopper and the Ant" is no longer considered proper reading material for children, that they need to have their self-esteem raised, that "I Have Two Mommies" is a more important book for them to read. "Feh." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Violation or Protection? [OLYMPICS]
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:03 PM 7/31/96, David Rosoff wrote: >I don't have any crypto references, but due to the Libertarian overtones >on this list I believe it is on-topic enough. I think this topic (thanks for raising it) is actually on-topic, as the proposals for "voluntary" escrow are somewhat similar. It all comes back to search warrants, due process, prior restraint, and other constitutional issues. >On the local news I saw footage of a couple schmoozing in the Olympic >(Centennial?) Park after its reopening. The voice-over said that all >bags are being searched, and the couple said that rather than be >alarmed or nervous, they "appreciated" it. > >I'm not quite sure what to think about this. I don't have enough >experience to form a well thought-out opinion. I'd like to hear some >of everyone's thoughts on this: Is this bag-searching a violation, >(which was my immediate reaction) or is it not, because you have to >already be going into the controlled area to get searched? I have mixed thoughts as well. On the one hand, were I to be hanging out in this park, given the recent event and the focus on this park for crazies to attack, I would feel better if bags were at least briefly looked into and "suspicious" bags left unattended covered with explosive-containing shields. On the other hand, a public place is a public place, and searches without warrants are explicity forbidden by the Constitution. (Some dispute exists about this, such as searches of bags on buses...I think the Supremes ruled that cops can search bags on buses without warrants...a bad precedent, I think.) If the Centennial Park is a public place, not a private one, as I believe to be the case, then it seems to me a person is within his rights to turn down the offer to be inspected, frisked, interrogated, etc. (There may be enabling emergency powers covering specific sites. I believe such conditions apply when, for example, the President or other such royal figures are mixing with the proles.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: Violation or Protection? [OLYMPICS]
by Blanc Weber 17 Dec '03

17 Dec '03

>From: tcmay(a)got.net > >If the Centennial Park is a public place, not a private one, as I believe >to be the case, then it seems to me a person is within his rights to turn >down the offer to be inspected, frisked, interrogated, etc. ........................................................ But if the park was a private one, would it make any difference? Between the "right" of being left alone, and the "legitimate needs" of law enforcers to frisk suspicious looking characters - whether in public or in private places - it seems rather difficult to draw that dividing line between allowance and forbearance. I mean, either it is, or it isn't, a "right". When could it really be okay to violate that definition. How are the law enforcers to do their job if they can't intrude into your shopping bag, when it's a critical National Emergency. This is what Denning is always referring to. .. Blanc > >

1 0

Re: A Libertine Question
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:34 PM 7/31/96 -0400, John Brothers wrote: >Apparently Mr. Horowitz is one of the tiresome "legalize everything that doesn't >offend me, ban everything else" libertarians. Here's a clue to a true >libertarian thought process: > You offend me, Mr. Horowitz. Your attitude by itself is enough to make >my throat clench in distaste, but the fact that you call yourself a >libertarian is exceptionally galling. From your e-mail, you show no >understanding of what >it means to be a libertarian, and libertarians are extremely ill-served by >your preposterous claims. But I will defend to the death your right to make >them. I think we should all just try and get along. <G> Since there are no "public places" in a free society, none of this comes up because everyone will be in places were they are welcome. There will be many more kinds of places than the two ("public" and "private") we have now. Some will be wide open and some will be highly restricted with all gradations in between. DCF

1 0

Re: Violation or Protection? [OLYMPICS]
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:04 PM 7/31/96 -0700, Timothy C. May wrote: >On the one hand, were I to be hanging out in this park, given the recent >event and the focus on this park for crazies to attack, I would feel better >if bags were at least briefly looked into and "suspicious" bags left >unattended covered with explosive-containing shields. On the gripping hand, if you (a generic you not TM) were in a park at 1:15 am listening to Jack Mack and the Heart Attacks in a crowd with infants in strollers, etc and a pipe bomb went off you could just consider it part of the rich stew of punk/pop crossover sensibilities that have become so important in modern life. Those who seek a "Heart Attack" may get one. If you hang out in modern crowds you risk getting blown up by fame seeking cop wanabees (or getting your FBI file read by ex-bouncer political heavy wanabees or getting kneecapped by body-guard-to-the-stars wanabees). Note the physical and psychological similarities among Jewell, Livingstone, and Tanya Harding's boyfriend. Didn't your mothers tell you what happened if you hung out in public parks after midnight. Or as Republicans said to the TV set when Teddy was chanting "Where Was George?" during his speech at the 1988 Democratic National Convention; "Sober and at home in bed with his wife." There is something very counter survival about seeking out crowds. It has always been thus. DCF

1 0

Re: ANNOUNCE: 2nd trip to National Cryptologic Museum (fwd)
by root 17 Dec '03

17 Dec '03

Is it a bar where you can smoke ?? ( the legal stuff ) >>>>> Forwarded message from tcmay(a)got.net (Timothy C. May) At 5:15 PM 7/31/96, Zorak Ramone wrote: > Following the lecture, we will be going over to Henckles (10 minutes >from the museum), a local resturaunt reported to be a favorite hangout for >NSA employees. Henckles has amazing sandwiches as well as good beer on tap. Jeez, first they tap our phones, and now they're tapping our beer! --Klaus << End forwarded message Charles E. Sparks In God We Trust, All Others we Encrypt Public Key at: http://www.clark.net/pub/charley/pc_1.htm

1 0

RE: Dry Under the Waterfall
by Blanc Weber 17 Dec '03

17 Dec '03

>From: tcmay(a)got.net > >I hear that "The Grasshopper and the Ant" is no longer considered proper >reading material for children, that they need to have their self-esteem >raised, that "I Have Two Mommies" is a more important book for them to >read. .................................................... What a difference it would make if along with the mandatory school attendance everyone received a mandatory education in basic economics, starting in Jr. High. Legislators and socially conscious individuals bemoan the lack of jobs, the downsizing of companies, the low salary wages, the imperative need for re-training, etc. as social problems to deal with by government -- yet the very thing which everyone could use the most of, that information which could prepare the minds of "America's future" for dealing with the way things work in a capitalist system and make it easier to transition into a world of uncertainty - while the administrations have the fortituous opportunity to provide it, is not delivered. Not that I expect that classes in economics delivered through the public schools would be all that accurate or therefore of much value, but the point being that those people who publicly complain to the general population about how the poor should receive subsidized support do not consider the disfavor of having the school system take up 12 years of everyone's time memorizing non-pertinent data, when they could have been using that time to good purpose -- *prior to* becoming independent adults needing an understanding of what it takes to make a living. "Knowledge is power", it is said. There are a lot of powerless beneficiaries of public education around. Or that's what a lot of people claim to be (powerless to help themselves). .. >Blanc > > > >

1 0

Re: Jewell is the Militia Bomber!!!!
by jim bell 17 Dec '03

17 Dec '03

At 07:49 PM 7/31/96 -0700, Timothy C. May wrote: > >The security guard Jewell is now confirmed to be the prime suspect. While >NBC News is reporting that no evidence _directly_ links him to the bombing, >the evidence against him is overwhelming: > >1. He is overweight. With the exception of The Unabomber, most perps in >cases like this are fat. Uh, just like that guy in Jurassic Park! ('Course, there's an explanation for this. "The butler did it" went out over 30 years ago. They're running out of butlers, and, well, many butlers were fat, so...) >2. They found a _shotgun_ in his cabin. No, no, Tim. The proper way to deliver this to a TV audience is, "They found an ARSENAL in his COMPOUND!" (see how much more exciting it is?!? BTW, how many wives does he have?) >3. He had an interest in guns. (Back issues of "Guns and Ammo" are bad >enough, but possession of even a single issue of "Combat Handguns" is >sufficient to convict in 39 of the 50 states.) Any copies of that SUBVERSIVE publication Shotgun News? >4. News sources are reporting that authorities who searched his apartment >and his cabin "came up empty," which surely implies that he planned this >crime with the help of others. And he had to have scoured it clean JUST BEFORE the authorities arrived! Yeah, that's the ticket! Jim Bell jimbell(a)pacifier.com

2 1

Jewell is the Militia Bomber!!!!
by tcmay＠got.net 17 Dec '03

17 Dec '03

The security guard Jewell is now confirmed to be the prime suspect. While NBC News is reporting that no evidence _directly_ links him to the bombing, the evidence against him is overwhelming: 1. He is overweight. With the exception of The Unabomber, most perps in cases like this are fat. 2. They found a _shotgun_ in his cabin. 3. He had an interest in guns. (Back issues of "Guns and Ammo" are bad enough, but possession of even a single issue of "Combat Handguns" is sufficient to convict in 39 of the 50 states.) 4. News sources are reporting that authorities who searched his apartment and his cabin "came up empty," which surely implies that he planned this crime with the help of others. --Tim May (P.S. I, too, was convinced Jewell was the guy. But in recent hours it is looking like a "rush to judgment" could be involved. There is strong pressure to "solve the crime" by the close of the Olympics on Sunday.) Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3

The "Secure" version of Netscape for Linux is *NOT*
by Alan Olsen 17 Dec '03

17 Dec '03

I just installed the "secure" version of Netscape off of the "US Only" download site. Seems that it is actualy the international version and not the 128 bit version. How many people have downloaded this version only to find that they downloaded something that they could have downloaded faster from a mirror site? How many people have had their downloads slowed down due to people downloading insecure Linux versions from the US only site? I think I have a justifiable reason to be pissed. Another waste of my time... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

3 2

RE: Violation or Protection? [OLYMPICS]
by Blanc Weber 17 Dec '03

17 Dec '03

>From: tcmay(a)got.net > >Of course, which is why stores can have "bags will be searched" policies, >restrictions about atire, and all sorts of other policies which are not >allowed in public places. > >Disneyland is a private park, and has rules which are not the rules a >public park can have. > >Put it this way, "My house, my rules." ...................................................... "My company, or my country/government?" This is like kids trying to decide which parent's admonitions to heed. There is a term I have heard to describe a situation, of "Clear & Present Danger", where the policing forces of government are to be allowed, or have the temporary right, to override all the rules which normally would apply the rest of the time. This is what I think people calculate when they decide it's okay to have intrusions into their person or belongings, whether they are in a public or private domain ("just for this time; after that everything will go back to normal"). I think everything should be immediately privatized. That would solve everything. Everyone would always know where they stood, philosophically & practically, depending on whose ground they were standing on. :>) .. Blanc

1 0

"Plague of Freedom" on G-7 from Internet Underground
by declan＠well.com 17 Dec '03

17 Dec '03

Date: Wed, 31 Jul 1996 22:35:45 -0500 To: fight-censorship(a)vorlon.mit.edu From: declan(a)well.com (Declan McCullagh) Subject: "Plague of Freedom" on G-7 from Internet Underground Yesterday in Paris government ministers from the G-7 countries met and approved a 25-point plan calling for close cooperation in moving to "intensify exchange of operational information," particularly "the use of communications technologies by terrorist groups." In a HotWired column, Kenneth Cukier writes: "In case there is any question about the United States's position, Attorney General Janet Reno said: 'We obtained the agreement of the eight (countries at the conference) to develop means of lawful government access to and decoding of scrambled or coded communication transmitted by terrorists.'" German delegates also blasted the Internet. The ACLU reports that: "Proposed measures apparently include investigations of charities and political organizations with radical political points of view -- threatening their rights to free speech." I've attached part of a cover story I have in the latest _Internet Underground_ magazine (http://www.underground-online.com/) that talks about the G-7 process and how countries around the globe are moving to stifle the Net. Pick up a copy of the physical mag for the full text of this article, plus some wonderously horrific graphics including a mouth shown shut with steel wire. And for more info, check out my net-censorship archive at: http://www.eff.org/~declan/global/ -Declan ----------------- Internet Underground August 1996 / Issue 09 "PLAGUE OF FREEDOM" The Internet's being disinfected for your protection (pages 28-33) By Declan McCullagh declan(a)well.com Call it an unlikely parable for today's Internet. Daniel Defoe's "A Journal of the Plague Years" isn't about cyberspace. Written in 1665, the book sketches a ghastly picture of a London under seige. Defoe tells how rats from foreign ships have invaded the city, carrying with them the bubonic plague. Authorities resort to desperate measures, barricading families inside their homes in a desperate attempt to halt the onslaught. It doesn't work. "Setting watchmen thus to keep the people in was, first of all, not effectual, but that the people broke out, whether by force or by strategm, even almost as often as they pleased," Defoe wrote. So it is with the sprawling expanse of cyberspace in 1996. Governments around the globe are rushing to barricade their borders, dam the flow of foreign data, and create a new world information order. For good reason: an uncensored 'net connection can be as deadly to a 20th century government as the plague was three centuries ago. And it may be just as infectious. [...] INTERNATIONAL ORGANIZATIONS The most influential international body involved in cyberrulemaking is the G-7 group of industrialized nations. Truth be told, it's obscure outside financial circles and is seen even inside them as becoming irrelevant in a global financial system dominated by multinational corporations, not by governments. Yet the seven member nations have already started using the G-7 umbrella to engage in a sort of joint head-scratching about what to do with cyberspace. It started in February 1995 in Brussels, at a meeting called the "G-7 Ministerial Conference on the Information Society." There the telecom honchos from G-7 nations and several smaller countries gathered to chat about online copyright, cultural pollution, universal access, free speech, and encryption policies. At least the principles were lofty. "While the rhetoric of the conference was progressive, there was no serious discussion of free expression or other human rights concerns," wrote one American who attended the conference. Instead, the G-7 nations said they were considering how to deal with inappropriate material on the 'net. Canada reminded the other countries that it wasn't as permissive as the U.S. in dealing with "hate-mongering materials," saying that when such publications appear online "they are much easier to obtain but are more difficult to monitor and take action against." The European Union decried copyright pirates: "Some form of international cooperation is necessary to supplement the existing legal systems governing intellectual property rights." Saying the 'net is "not without risks," France stressed that cyberspace "must not result in a standardization in content, or a leveling of cultures." Only Vice President Al Gore tossed a bone to cyber-rights advocates. "[Cyberspace] is about protecting and enlarging freedom of expression for all our citizens... Ideas should not be checked at the border," said Gore. Gore didn't do this in a vacuum. "Our big victory at Brussels was that we pressured them enough so that Al Gore in his keynote address made a big point of stressing the importance of free speech on the Internet," says Ann Beeson of the American Civil Liberties Union. Beeson should know -- she's been one of the few cybersavvy activists who has been fighting globally for an unshackled Internet. Now a principal attorney on the ACLU's legal team challenging the Communications Decency Act, Beeson previously worked at Human Rights Watch and crafted a letter the group sent to Gore before the Brussels conference. Citing Article 19 of the Universal Declaration of Human Rights, it said: "Everyone has the right... to seek, receive and impart information and ideas through any media and regardless of frontiers. Unfortunately, the only G-7 voices supporting this today are a silent chorus. The G-7 information ministers met again in South Africa in May 1996 and plan to meet in Egypt later this year, but no international 'net-advocacy group has been tracking the proposals discussed at the meetings. U.S. cyberliberty groups have been preoccupied with the CDA battle, and they have no international counterparts. That's finally about to change. Two global 'net-alliances are emerging and have held their initial planning meetings at Internet conferences this summer in Canada. The ACLU co-founded one group, called the Global Internet Liberty Campaign. "We have to face the fact that while ultimately it's extraordinarily difficult for governments to control the 'net, they're going to try," says Barry Steinhardt, associate director of the ACLU. "The best thing that governments can do is to stay out if it." Not so, says Bruce Taylor, the chief architect of the CDA and a professional cyber-scaremonger. The former Federal porn-prosecutor believes that "not all censorship is bad." "Foreign countries have an obligation to restrict obscenity and child pornography on the Internet by the treaty of 1911," says Taylor. "It's an agreement between the states to cooperate and to use international laws to prosecute obscenity." And to Taylor, books and copies of Penthouse magazine can be obscene. FUTURE REGULATIONS David Post is a likeable, bearded fellow who once studied yellow babboons in Kenya and wears tennis shoes with his suits. Now the co-director of the Cyberspace Law Institute, Post is one of the few lawyers who's made a serious study of the international evolution of the 'net. To Post, the 'net is at a fork in its development: the two paths are self-regulation or an international government crackdown. "It's the central problem the 'net faces today," says Post. "How does it relieve itself of the conflicting claims of soverigns whose power is based on geographical boundaries -- something the 'net doesn't recognize?" Eric Freedman, a constitutional law professor at Hofstra Law School, is anything but optimistic. Freedman remembers how governments already have crafted a complex constellation of little-known treaties and agreements governing everything from satellite placement to the world banking system and postal services. "I'm worried that the governments are ahead of us," says Freedman. "There's a humongous potential to get absolutely screwed here... If 100 countries agreed on this, they could get this done in a week. It's easier for them to coordinate, agree, and implement than it is for us to stop them from doing so." That's why the ACLU/American Library Association lawsuit challenging the CDA is vital. If the Supreme Court upholds the law, Congress and the White House can craft international "decency" agreements for cyberspace. But if the high court slams the law as unconstitutional, Clinton would be barred from signing a CDA-type treaty. "It's a principle of constitutional law that any treaty has to conform to the Constitution," says Freedman. A victory in the CDA case would, in a sense, turn the U.S. into a safe haven for controversial content from all over the world. Freedman urges 'netizens in every country to launch similar fights against government 'net-censorship. "Win as many national victories as possible to get ahead of the governments of the world," he says. "If the German or Australian supreme courts were to rule that freedom of speech principles apply to the 'net as they do to a newspaper, that would be very helpful." In the near future, that's the best way to forestall the world information order. The first time a country proposes such a formal treaty, it has to die from lack of support. But pressure to regulate the 'net will always exist, and a new way of looking at cyberspace may have to emerge. Some precedents exist. Maritime law, for example, says that no single nation has jurisdiction over the oceans. Medieval Europe recognized a separate law for merchants that had its own judicial system. Antarctica is not governed by any single country's laws. The Catholic Church is a multinational institution that largely rules itself. The Cyberspace Law Institute's Post argues for this model. "We should treat cyberspace as a distinct location and allow our own distinct legal and moral systems to evolve," he says. He's right. As the 'net matures, no other solution will work. Daniel Defoe described governments locking citizen inside their homes, to no avail: "It was impossible for one man so to guard all the passages as to prevent the escape of people made desperate... And that which was still worse, those that did thus break out spread the infection farther." The infection cyberspace spreads today is far more virulent than the bubonic plague. Anathema to government, the 'net carries the virus of freedom. ###

1 0

s/key for linux?
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

I'm having difficulty getting the few releases I've got of S/Key to compile under linux. Anyone know of a release that's already been ported? Thanks... //cerridwyn//

2 1

Re: Photo IDs (Re: A Libertine Question)
by Chris Adams 17 Dec '03

17 Dec '03

On 31 Jul 96 14:27:54 -0800, tcmay(a)got.net wrote: >>was allegedly requiring *two* pieces of ID for flights. If they are talking >>about two pieces of photo -- government-issued ID, I wonder where the 80% of > >Yeah, this "two photo IDs" is strange, given that: >a. many ordinary people have only one form of photo I.D., namely, their >driver's license (and many don't even have that) >b. terrorists and other such persons are _very_ likely to have multiple >forms of I.D., though of course not in their "true name." > >Hence, the policy looks ineffectual and just a sop to public relations. And who really thought a response just days later would be anything else? >And just what is a "true name" for the purposes of this law, anyway? Birth >name? And what is that? What about people who marry, change names, etc.? >Given that there is no "standard" for photo I.D.s, will my Official >Cypherpunks Card count? Now *that* might be another way of generating Cypherpunks revenue! (1 card per FPGA paid for the DES cracker... Or maybe every $15 toward the CPLDF or PRZ) # Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! # Automatically receive my resume or PGPKEY by sending email with a subject # of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful! # Web site: http://www.io-online.com/adamsc/adamsc.htm

1 0

Re: VISA Travel Money
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

>> It's not as anonymous as cash, but it might draw a lot less >> attention in my circumstances. I think it has a place in one's >> aresenal of privacy enchancing technologies. > > This card has the value "written" when you "purchase" it right? > > Any one wanna bet on how long it will take the "Hacker" Community >to figure out how to "refill" it? Otherwise all you have is a >debit card. Interesting related story about DefCon: for those of you who have been to Las Vegas, you know that many casinos have mag stripe cards that are issued for a variety of reasons, that are just as good as cash in the casino, but can't be used anywhere else. Many use them as a sort of debit card for slot machines. The story goes that a few DefCon attendies acquired a few of these cards from the Tropicana, and re-wrote the stripe to read that they had over 60,000 "points". I guess they discovered that the card was re-written each time it was used. Unfortunately for them, what they didn't discover was that the system also kept track on a computer somewhere, and the large difference between the computer's tally and the card's value set off numerous red flags, they found out relatively quickly when two Casino Security guards escorted them to the police station. Oops. I can't help but wonder what would've happened if they only made the difference like 10 points instead of 60K? These two people were not too bright, as they were staying at the Tropicana, and probably had all the equipment in their rooms. If they were of age, I believe (depending on what they found in the room) they can each get multiple 15 year federal sentences. Moral of the Story: Mag Stripe cards are never secure by themselves (the credit card companies mistakenly relied on security by obscurity and are feeling the painful effects still today), but have the potential to be secure if backed up by that kind of system. However, it would only really be practical in a closed environment like a Casino. Thus, for the sake of all the lovely banks I know and love, I hope they either A. choose something other than mag. stripes, or B. use them only as debit cards that are checked against a bank account when used. //cerridwyn//

2 1

Re: fbi, crypto, and defcon
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

>> Okay, so their boss is part of the law making process, subject to the checks >> and balances that exist between the three branches of US government. They >> are in a position to supply their boss with data and I am personally >> impressed with their grasp of some of that data (it sounds to me like they >> are telling their boss that hackers like the ones at Defcon are not the >> problem). It was interesting how the Agent made the point that the FBI was there to enforce laws, not make policy. Then his Boss's role in the law making process was brought up, the Agent said "but any of you can do the same thing, you all have a voice" etc etc. Then he refused to answer political questions based on the fact that he was there as a representative of the FBI, failing to see that his Boss is also a representative of the FBI when recommending legislation. (Again, I realize he was "under orders" not to discuss it, I wish he wouldn't try to justify it with obviously faulty logic.) > I think what they are really saying is that they would love to >bust most hackers, but since they can't they might as well use some of >them to catch the bigger fish. If they truly did believe in the laws they >are supposed to uphold they wouldn't associate with hackers (who commit >computer crimes) at all. A more cynical view is that they are there to protect some of the biggest institutions of "organized crime" (ie: Congress, At&t, Microsoft, etc) who are ripping people off on a daily basis from the other organizations who refuse to play by their rules. //cerridwyn//

1 0

Re: A Libertine Question
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

>Most demands for ID and conformations with police involve the operation of >motor vehicles. I have never been "IDed" except at border crossings and >when I was operating motor vehicles. Clean and dressed up people are rarely >IDed on foot. Maybe you should mention some of the specific practices in >Seattle that disturb you. I was downtown Seattle at night time (early morning), walking around, minding my own business. Probably not actively maintaining public decorum, but certainly not doing anything unorderly. A cop approached me and asked what I was doing, I told him none of his business. He asked me for my ID, I said why, am I under arrest? He said no, but he needs to see my ID. I told him he has no right to ask me for my ID, especially when I've been doing nothing wrong, if I wanted to live in those conditions, I'd move to Iraq or China or something. I got out my handy pocket tape recorder, and asked him to state his name and repeat his request for the benefit of my lawyer who'd be contacting him. At this point the few other people on the street had sort of gathered a few yards away, and the cop decided he wasn't gonna win this one, so asked me to return to my home and left before I could respond. You are right, "Clean and dressed up people are rarely IDed [read harassed] on foot." I'm not concerned for the clean and dressed up people (with regards to police abuse), I'm concerned about the majority of people who aren't. (For the record, I'm generally clean, but *rarely* dressed up. =) ) >Or flying on a commercial flight. So far, prosecutions for "failure to >possess ID" have not succeeded. You *can* be prosecuted for failure to >identify yourself (which is *not* the same thing). The Philadelphia airport >was allegedly requiring *two* pieces of ID for flights. If they are talking >about two pieces of photo -- government-issued ID, I wonder where the 80% of >Americans without a Passport (x the 90% of Americans who are not government >employees) get the second piece of ID. [Is it a violation of something if >you Heil Hitler od Sieg Heil the airline clerk when they ask to see your ID. >It's not a threat, it's an expression of honor.] When I flew from Philadelphia about a year ago, they required one picture ID and one other ID, just like most stores when you want a check cashed. I still don't like it, but I have less of a problem presenting ID when I am seeking a service of some kind. It is unacceptable to be asked for ID when I am merely walking around a public street.

1 0

Re: "And who shall guard the guardians?"
by jim bell 17 Dec '03

17 Dec '03

At 02:57 PM 7/31/96 -0700, Martin Minow wrote: >This question is also relevant to escrowed encryption: how to >prevent misuse of escrowed keys by file clerks and other people >who need access to the keys as part of their legitimate duties. >Since these keys will protect a very large amount of money (consider >the encryption keys used for interbank clearing) and since we >know from the Aldrich Ames case that $3,000,000 can buy a >high-ranking CIA employee, there are significant problems that >need to be addressed. I would suspect that a Baysian analysis >would indicate that the risk of holding (and losing) a key is >greater than the risk of not holding (and needing) a key. However, even that is a somewhat skewed analysis. Most of us realize that the kinds of advanced surveillance systems that are being promoted these days have nothing to do with crimes that are, statistically, the most common and feared among ordinary citizens. Will a wiretap ever solve a burglary? Rarely. Will a Clipper-type decrypt bring a rapist to justice? Fairly unlikely. How about a carjacking? A strong-arm robbery? An arson? Sure, it's always possible, but we know what's really going on. Governments are afraid that technology will not only replace the protections we've traditionally been told only came from government (and thus make them unnecessary), but also that technology will allow us to force those governments to shrink and possibly to disband. In other words, to a government-type most of the benefits of a Clipper system are to the government itself, certainly not to the person who owns the phone and not even to society as a whole. That's one reason, I suspect, why those secret talks given to various people to convince them to support Clipper "usually" work if the person is a government-type, but will almost never work to an unbiased private citizen. That's also why the lecture is secret: That way, the government can push two different stories without a contradiction being obvious to the rest of us. Jim Bell jimbell(a)pacifier.com

1 0

Re: Jewell is the Militia Bomber!!!!
by Chris Adams 17 Dec '03

17 Dec '03

On 31 Jul 96 22:40:46 -0800, tcmay(a)got.net wrote: >The security guard Jewell is now confirmed to be the prime suspect. While >NBC News is reporting that no evidence _directly_ links him to the bombing, >the evidence against him is overwhelming: > >1. He is overweight. With the exception of The Unabomber, most perps in >cases like this are fat. After all, who could *not* want to conform with crowd? Anyone who isn't obsessed with being thin must have something wrong with him. There ought to be a law against people like him! >2. They found a _shotgun_ in his cabin. Only a criminal would have a reason for that! After, what legitimate use could a citizen have with one? If he wants to hunt, he should use a rifle! >3. He had an interest in guns. (Back issues of "Guns and Ammo" are bad >enough, but possession of even a single issue of "Combat Handguns" is >sufficient to convict in 39 of the 50 states.) Particularly for a cop! Why would anyone in his position need *that*! >4. News sources are reporting that authorities who searched his apartment >and his cabin "came up empty," which surely implies that he planned this >crime with the help of others. We can take prime examples of this: The Whitehouse hiring dilemna - if they can't figure out who hired him, there must be someone in on the job! Maybe it's the dead guy. Maybe it's those evil Internet users... ___ Sorry about breaking your sarcasm-meter... ___ >(P.S. I, too, was convinced Jewell was the guy. But in recent hours it is >looking like a "rush to judgment" could be involved. There is strong >pressure to "solve the crime" by the close of the Olympics on Sunday.) I think we could track this to the replacement of literature and culture with TV - if everyone from T.J. Hooker to Agents Sculley and Mulder solve a mystery in 30 minutes, surely they can do it in real life, too. How much do you want to bet that if it is a frame and it is successful, they'll "find" a PGP encrypted file with plans and use it to promote GAK? # Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! # Automatically receive my resume or PGPKEY by sending email with a subject # of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful! # Web site: http://www.io-online.com/adamsc/adamsc.htm

1 0

Cracking RC4/40 for massive wiretapps
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:13 AM 7/30/96 -0700, frantz(a)netcom.com (Bill Frantz) mused paranoidly: >I combine the above with Whit Diffie's observation that, while crypto users >are interested in the security of *each* message, organizations which >monitor communications want to read *every* message. A TLA interested in >monitoring communications would need to crack RC4-40 much faster than >1/week. When we discussed using FPGA machines to crack RC4/40 last year, someone calculated the cost of cracking a message at 8 cents if you're doing enough to amortize your machine, and Eric had designed a system that should be able to crack it in about 15 minutes for $25-50K. The two basic search approaches are to take a cyphertext and decrypt it trying many keys to see if you get a likely plaintext, or to take known plaintext and encrypt with many keys to see if you match the cyphertext. But those designs are for one-at-a-time cracks. An interesting question is whether you can speed up performance substantially by cracking multiple messages at once. For instance, if you've got known plaintext, such as a standard header format saying "FooVoice" or "BEGIN DSA-SIGNED..", you can try many keys and compare them with _many_ cyphertexts, which may not slow down the FPGA very much. Also, even for unknown-plaintext, since key scheduling is a relatively slow part of RC4/40, you can split the key-schedule and the block-encryption phases, feeding one keyschedule output to multiple decrypt-and-compare sessions in parallel. So the cost per victim of cracking many sessions may be much lower. >Now expensive specialized cracking equipment can certainly speed up the >process, but there may be a better way. If cryptanalysis of RC4 yields >techniques which make the process much easier, then it is the ideal cypher >to certify for export. >The paranoid conclusion is that there is a significant weakness in RC4. Just keeping the key length down to 40 bits on a fast cypher is a good start. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # Dispel Authority!

3 2

Re: Jewell is the Militia Bomber!!!!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:53 AM 8/1/96, Rich Graves wrote: >Ferchrissakes, guys, take a step back and look at yourselves. You're playing >the spin control game just as fast and furious as the "bad guys" (?). First >the glee over how easy it was to find bomb-making instructions anywhere, >then saying it was a provocation by the government, now it becomes a ^^^^^^^^^^^^^^^^ >conspiracy against fat people who read gun magazines. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Rich, maybe you're spending too much time amongst the Zundelsite Neo-Nazis. You no longer recognize humor even when it's pretty damned obvious. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: A Libertine Question
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 11:12 7/31/96, Duncan Frissell wrote: >Most demands for ID and conformations with police involve the operation of >motor vehicles. I have never been "IDed" except at border crossings and >when I was operating motor vehicles. Clean and dressed up people are rarely >IDed on foot. Maybe you should mention some of the specific practices in >Seattle that disturb you. I have been IDed numerous times for no other reason than walking on the sidewalk at a late hour in an area where most people use cars to go to the 7/11 down the block. Southern California is especially bad in this regard. A friend, who had the same problem, finally got a dog. After that the cops left her alone. Seems walking your dog is a legitimate reason to be out at night... -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: Violation or Protection? [OLYMPICS]
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 12:03 7/31/96, David Rosoff wrote: [...] >On the local news I saw footage of a couple schmoozing in the Olympic >(Centennial?) Park after its reopening. The voice-over said that all >bags are being searched, and the couple said that rather than be >alarmed or nervous, they "appreciated" it. > >I'm not quite sure what to think about this. I don't have enough >experience to form a well thought-out opinion. I'd like to hear some >of everyone's thoughts on this: Is this bag-searching a violation, >(which was my immediate reaction) or is it not, because you have to >already be going into the controlled area to get searched? You are confused because you wonder how it could be that the couple could appreciate having their bags searched, something you intuitively regard as a violation of their rights. The very simple answer is that, generally speaking, individuals enjoy to have their rights violated, provided that they are given a (often false) sense of security in return. Surveys from a few years ago showed that a majority of Americans would approve of warrantless house-to-house searches, including their own, to combat the use of narcotics. ObCrypto: The public will cheer the day that strong, non-escowed crypto is outlawed. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: Smart cards "a giant leap backwards" - Canadian Privacy Commissioner
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 11:12 7/31/96, Duncan Frissell wrote: >At 02:23 PM 7/30/96 -0400, Richard Martin wrote: >>Very little that might be new or enlightening to the world; attendees >>of CFP '96 will remember [fuzzily, in my case] the closest thing to >>Bruce's counterpart in the states admitting that the USA doesn't actually >>have much of a counterpart to the privacy commissioner. > >Most Central European countries have both privacy commissioners and legal >requirements that everyone register their addresses with the police. I'll >do without the former if I can also avoid the latter. I remember a time when Privacy Commissioners were a new thing. Their primary purpose seemed to be to sanction government access to (and keeping of) large databases on the activities of the population. Their secondary purpose was to prevent the private sector competition from doing the same. Eliminating access to such data by the individual in the process. Things may have changed for the better, but I doubt it. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: fbi, crypto, and defc
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

> Since they were speakers, could they be part of the Spot The Fed contest? They said that every other time their comrades had come to defcon, they had tried to come incognito, and got caught every time. This time, they wore FBI t-shirts, and the only response was "Hey! Where'd ya get the T-Shirt?!?". They said "We hacked 'em from the FBI" and that was it, noone suspected... =) //cerridwyn//

1 0

NSA/ARPA/DISA joint research office Memo of Agreement
by John Gilmore 17 Dec '03

17 Dec '03

[I found this at the ARPA web site while looking up the programs there that are trying to deploy crypto in the Internet. You can read it as plain text, the HTML crud peters out after the first page. If you look at it on the web, they have reproduced the signatures from the signature page in a GIF file. -- John] <BASE HREF="http://www.ito.darpa.mil/ResearchAreas/Information_Survivability/MOA.html"> <HTML> <HEAD> <TITLE>MOA - Information Systems Security Research Joint Technology Office</TITLE> </HEAD> <BODY> <CENTER> <H3>Memorandum of Agreement<BR> Between<BR> The Advanced Research Projects Agency,<BR> The Defense Information Systems Agency, and<BR> The National Security Agency<BR>Concerning<BR> The Information Systems Security Reseach Joint Technology Office</H3> </CENTER> <H3>Purpose</H3> The Advanced Research Projects Agency (ARPA), the Defense Information Systems Agency (DISA), and the National Security Agency (NSA) agree to the establishment of the Information System Security Research Joint Technology Office (ISSR-JTO) as a joint activity. The ISSR-JTO is being established to coordinate the information systems security research programs of ARPA and NSA. The ISSR-JTO will work to optimize use of the limited research funds available, and strengthen the responsiveness of the programs to DISA, expediting delivery of technologies that meet DISA's requirements to safeguard the confidentiality, integrity, authenticity, and availability of data in Department of Defense information systems, provide a robust first line of defense for defensive information warfare, and permit electronic commerce between the Department of Defense and its contractors. <H3>Background</H3> In recent years, exponential growth in government and private sector use of networked systems to produce and communicate information has given rise to a shared interest by NSA and ARPA in focusing government R&D on information systems security technologies. NSA and its primary network security customer, DISA, have become increasingly reliant upon commercial information technologies and services to build the Defense Information Infrastructure, and the inherent security of these technologies and services has become a vital concern. From ARPA'S perspective, it has become increasingly apparent that security is critical to the success of key ARPA information technology initiatives. ARPA's role in fostering the development of advanced information technologies now requires close attention to the security of these technologies.<P> NSA's security technology plan envisions maximum use of commercial technology for sensitive but unclassified applications, and, to the extent possible, for classified applications as well. A key element of this plan is the transfer of highly reliable government-developed technology and techniques to industry for integration into commercial off-the-shelf products, making quality-tested security components available not only to DoD but to the full spectrum of government and private sector users as well. ARPA is working with its contractor community to fully integrate security into next generation computing technologies being developed in all its programs, and working with the the research community to develop strategic relationships with industry so that industry will develop modular security technologies with the capability of exchanging appropriate elements to meet various levels of required security.<P> NSA and ARPA now share a strong interest in promoting the development and integration of security technology for advanced information systems applications. The challenge at hand is to guide the efforts of the two agencies in a way that optimizes use of the limited research funds available and maximizes support to DISA in building the Defense Information Infrastructure.<P> NSA acts as the U.S. Government's focal point for cryptography, telecommunications security, and information systems security for national security systems. It conducts, approves, or endorses research and development of techniques and equipment to secure national security systems. NSA reviews and approves all standards, techniques, systems, and equipment related to the security of national security systems. NSA's primary focus is to provide information systems security products, services, and standards in the near term to help its customers protect classified and national security-related sensitive but unclassified information. It develops and assesses new security technology in the areas of cryptography, technical security, and authentication technology; endorses cryptographic systems protecting national security information; develops infrastructure support technologies; evaluates and rates trusted computer and network products; and provides information security standards for DoD. Much of the work in these areas is conducted in a classified environment, and the balancing of national security and law enforcement equities has been a significant constraint.<P> ARPA's mission is to perform research and development that helps the Department of Defense to maintain U.S. technological superiority over potential adversaries. At the core of the ARPA mission is the goal to develop and demonstrate revolutionary technologies that will fundamentally enhance the capability of the military. ARPA's role in fostering the development of advanced computing and communications technologies for use by the DoD requires that long term solutions to increasing the security of these systems be developed. ARPA is interested in commercial or dual-use technology, and usually technology that provides revolutionary rather than evolutionary enhancements to capabilities. ARPA is working with industry and academia to develop technologies that will enable industry to provide system design methodologies and secure computer, operating system, and networking technologies. NSA and ARPA research interests have been converging in these areas, particularly with regard to protocol development involving key, token, and certificate exchanges and processes.<P> One of the key differences between ARPA's work and NSA's is that ARPA's is performed in unclassified environments, often in university settings. This enables ARPA to access talent and pursue research strategies normally closed to NSA due to security considerations. Another difference is that while NSA's research is generally built around developing and using specific cryptographic algorithms, ARPA's approach is to pursue solutions that are independent of algorithm used and allow for modularly replaceable cryptography. ARPA will, to the greatest extent possible, allow its contractor community to use cryptography developed at NSA, and needs solutions from NSA on an expedited basis so as not to hold up its research program.<P> DISA functions as the Department of Defense's information utility. Its requirements for information systems security extend beyond confidentiality to include protection of data from tampering or destruction and assurance that data exchanges are originated and received by valid participants. DISA is the first line of defense for information warfare, and needs quality technology for detecting and responding to network penetrations. The growing vulnerability of the Defense information Infrastructure to unauthorized access and use, demonstrated in the penetration of hundreds of DoD computer systems during 1994, makes delivery of enabling security technologies to DISA a matter of urgency. <H3>The Information Systems Security Research Joint Technology Office</H3> This MOA authorizes the ISSR-JTO as a joint undertaking of ARPA, DISA, and NSA. It will perform those functions jointly agreed to by these agencies. Each agency shall delegate to the ISSO-JTO such authority and responsibility as is necessary to carry out its agreed functions. Participation in the joint program does not relieve ARPA, DISA, or NSA of their respective individual charter responsibilities, or diminish their respective authorities.<P> A Joint Management Plan will be developed to provide a detailed definition of the focus, objectives, operation, and costs of the Joint Technology Office. The ISSR-JTO will be jointly staffed by ARPA, DISA, and NSA, with respective staffing levels to be agreed upon by the three parties. Employees assigned to the JTO will remain on the billets of their respective agency. Personnel support for employees assigned to the JTO will be provided by their home organization. The ISSR-JTO will be housed within both ARPA and NSA, except as agreed otherwise by the three parties. To the greatest extent possible, it will function as a virtual office, using electronic connectivity to minimize the need for constant physical co-location. Physical security support will be provided by the party responsible for the specific facilities occupied. Assignment of the ISSR-JTO Director, Deputy Director, and management of other office elements will be made by mutual agreement among the Directors of ARPA, DISA, and NSA upon recommendation of their staffs.<P> <H3>Functions</H3> By mutual agreement of ARPA, DISA, and NSA, the ISSR-JTO will perform the following joint functions: <OL> <LI>Review and coordinate all Information System Security Research programs at ARPA and NSA to ensure that there is no unnecessary duplication, that the programs are technically sound, that they are focused on customer requirements where available, and that long term research is aimed at revolutionary increases in DoD security capabilities. <LI>Support ARPA and NSA in evaluating proposals and managing projects arising from their information systems security efforts, and maintain a channel for the exchange of technical expertise to support their information systems security research programs. <LI>Provide long range strategic planning for information systems security research. Provide concepts of future architectures which include security as an integral component and a road map for the products that need to be developed to fit the architectures, taking into account anticipated DoD information systems security research needs for command and control, intelligence, support functions, and electronic commerce. The long range security program will explore technologies which extend security research boundaries. <LI>Develop measures of the effectiveness of the information systems security research programs in reducing vulnerabilities. <LI>Work with DISA, other defense organizations, academic, and industrial organizations to take new information systems security research concepts and apply them to selected prototype systems and testbed projects. <LI>Encourage the U.S. industrial base to develop commercial products with built-in security to be used in DoD systems. Develop alliances with industry to raise the level of security in all U.S. systems. Bring together private sector leaders in information systems security research to advise the JTO and build consensus for the resulting programs. <LI>Identify areas for which standards need to be developed for information systems security. <LI>Facilitate the availability and use of NSA certified cryptography within information systems security research programs. <LI>Proactively provide a coherent, integrated joint vision of the program in internal and public communications. </OL> <H3>Program Oversight and Revisions</H3> The Director, ISSR-JTO, has a joint reporting responsibility to the Directors of ARPA, DISA, and NSA. The Director, ISSR-JTO, will conduct a formal Program Status Review for the Directors of ARPA, DISA, and NSA on an annual basis, and will submit mid-year progress reports between formal reviews. Specific reporting procedures and practices of the JTO to ARPA, DISA, and NSA will be detailed in the Joint Technology Management Plan. This MOA will be reviewed at least annually, and may be revised at any time, based on the mutual consent of ARPA, DISA, and NSA, to assure the effective execution of the joint initiative. Any of the parties may withdraw from participation in the MOA upon six months written notice. The MOA is effective 2 April, 1995.<P> <IMG SRC="http://www.ito.darpa.mil/ResearchAreas/Information_Survivability/sigs4.gif" ALT="Signatures of Dr. Gary L. Denman, Director ARPA; LtGen Albert J. Edmonds, Director, DISA; VADM John M. McConnell, Director, NSA; Dr. Anita K. Jones, Director, DDR&E; Emmett Paige, Jr., Assistant Secretary of Defense for Command, Control, Communications and Intelligence"><P> <P> <address> <HR> <A HREF="http://www.ito.darpa.mil/ResearchAreas/Information_Survivability.html">Return to Information Survivability Page</A> <BR> Direct comments concerning this WWW site to: <A HREF="mailto:Webmaster@ito.darpa.mil">Webmaster(a)ito.darpa.mil</A></address> </BODY> </HTML>

1 0

Re: FPGAs and Heat (Re: Paranoid Musings)
by Scott Schryvers 17 Dec '03

17 Dec '03

>At 12:42 AM 7/31/96 -0700, David Wagner wrote: >>Those estimates assume that a single FPGA can break RC4 in hours. I think >>that is an extremely optimistic assumption, given the available public >>information. But perhaps NSA is orders of magnitude ahead of us in chip >>design (unlikely) or orders of magnitude ahead of us in RC4 cryptanalysis >>(and we're back to paranoid musings). > >>> If we assume a machine designed to break *every* message, NSA's response >>> makes more sense. > >I feel like I'm leaning over backwards to defend NSA's response, an >extremely uncomfortable position (and I could crack my skull when I fall) >:-). The most important issue is, what is NSA's state of the art. If we >accept their $1000/FPGA chip, then they are indeed at the bleeding edge, >and suffering from the associated low chip yields. If they are at the best >cost-performance point for 2-3 years ago or whenever they started approving >the export of RC4-40, then they are certainly subject to David Wagner's >performance limits. Sorry about mangling quotes. :( This was about a year and a half ago. I can't remember the name of it, but this chip fab industry mag was talking about how the NSA was obtaining out side help in fabricating what was at the time a type of ram that did processing off chip in parrallel. If the chip was basically routing the problem to different sectors and the same sectors of ram did their own processing on different parts of the same problem how many powers of processing time would this increase the same amount of acerage?* * NSA term for processing. Side note: Wired just recently talked about IRAM or Intelligent ram, and how it seems to be the future of high speed computation. PGP encrypted mail preferred. E-Mail me for my key. Scott J. Schryvers <schryver(a)radiks.net>

1 0

Re: New Clinton Administration Ping Policy
by Scott Schryvers 17 Dec '03

17 Dec '03

At 01:22 PM 7/31/96 -0700, you wrote: > >Press release: > >CLINTON ADMINISTRATION FACT SHEET: U.S. PING POLICY >(Industry, international cooperation urged) > The sad thing here is that I can't tell if this is a joke or not. :( PGP encrypted mail preferred. E-Mail me for my key. Scott J. Schryvers <schryver(a)radiks.net>

1 0

Security of Web registration of Lview Pro
by Andrew Meredith 17 Dec '03

17 Dec '03

Dear Sirs, I was happy to find that you have put up an SSL form through which one can register Lview Pro. I filled it in and pressed the button. My browser then warned me that although the form was sent to me securely, the data I was sending back was in the clear! I had a look at the page source for: https://commerce.mindspring.com/www.lview.com/iregform.htm and there is was: <FORM METHOD="POST" ACTION="http://www.std.com/Newbury/leonardo/cgi-bin/fp.exe"><P> ^^^^ Therefore the only thing protected by this "Secure Form" is the original text of the form, rather than the credit card details. I know that: "If using an SSL Web browser such as Netscape or Microsoft Explorer, please click here to access a secure document." doesn't actually *say* that your customers card details are secure, but at first glance it sounded like it to me. Whatever others may think about the rights and wrongs of it, my personal policy is not to commit credit card details to open networks, unless under strong encryption. I look forward to your comments. Andy Meredith

1 0

Re: Cracking RC4/40 for massive wiretapps
by Deranged Mutant 17 Dec '03

17 Dec '03

Wait a minute: RC4 is an OFB cipher. The previous plaintext has no effect on the ciphertext. Hence, an attacker with shitloads of storage capacity can generate some initial output for each key and test each pre-stored key against ciphertext for possible hits. Using 'flaws' in the key schedule (esp. if the key is based on a password rather than a hash of a password) one could search for 'more likely keys' first. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) Send a message with the subject "send pgp-key" for a copy of my key.

2 2

crypto++ help
by wwoelbel＠midwest.net 17 Dec '03

17 Dec '03

I recently downloaded the crypto++ class library and am having a bit of trouble getting things to happen. I have read the text on the source-filter-sink concept and was able to create a DES file encryptor. What I would like to do is use either blowfish or IDEA to encrypt a variable length data stream. Does anybody have experience with this library? A short code snippet or similar help would be appreciated. Bill Woelbeling wwoelbel(a)midwest.net

1 0

Micali's rights to lightweight certificates etc.
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Wed, 31 Jul 1996 17:28:56 -0400 From: Silvio Micali <silvio(a)sunspot.tiac.net> To: cme(a)cybercash.com, d.adams(a)xopen.co.uk, frantz(a)netcom.com, hallam(a)w3.org, rodney(a)sabletech.com, rsalz(a)osf.org, silvio(a)sunspot.tiac.net, spki(a)c2.org Subject: Micali's rights to lightweight certificates etc. Sender: owner-spki(a)c2.org Precedence: bulk Dear Carl: Last April I was forwarded by Ron (Rivest) the following e-message addressed to you: "[Re: Micali's lightweight certificates with hash chains] The mechanism maybe patented, but who owns the patent? I am aware of claims by two european groups who have payment schemes using a combined s/key and signed cert technique Pghill" As I do not know the context of your conversation, it is hard for me to guess which technology's rights the above question refers to. There are (at least) two possible technologies the question refers to. Let me thus answer it in either case. I would appreciate if you could pass this information to people you feel may be interested in it. (I am trying to CC all the people CCed in the original message, but I am not sure that this reaches all the right people.) RIGHTS INFORMATION My efficient certificate revocation technology is itself based on my off-line digital signature technology. The efficient certificate certificate revocation technology has been invented by me alone. I have filed for patent protection, and the patent is currently pending with the U.S. Patent Office. The underlying off-line signature technology has been invented by Shimon Even, Oded Goldreich and me. The technology is protected by U.S. Patent No. 5,016,274. The rights to this technology are only with me. (The latter technology, among other things, covers the process of separating the signing process into two stages: a OFF-LINE one --that can be performed before knowing what the message to be signed is--- and an ON-LINE one --which is typically performed when one knows exactly what he/she wishes to sign. In the preferred embodiment, in the off-line step, the signer uses the secret key SK of a first, conventional secret-public key pair (SK,PK) to digitally sign the publick key, pk, of a second, restricted but very fast, signature scheme. In the on-line step, the signer uses the second secret key --i.e., the one associated with pk-- in order to sign the desired message. In particular, the second public key, pk, can be obtained by evaluating k times a given one-way hash function on input sk. After doing so, one can sign in an off-line step pk together with a certificate serial number (and other information). Then, in an on-line step, one can sign that a certificate is being valid for at at least i days --where i is between 1 and k-- by releasing the ith inverse of pk; that is, by releasing a value that, hashed i times, yields pk. You can thus see the connection between the two technologies.) Both technologies are available for licensing. If you or someone in your discussion group is aware of a company using either technology, I would appreciate if you could facilitate a contact between me and such a company, so that we can discuss possible licensing arrangements. The Efficient Certificate Revocation Paper is presented in MIT Technical MIT/LCS/TM-542, dated November 95. A better version appears in a March 1996 manuscript. Either version could be obtained from me, if more convenient. Off-Line Digital Signatures also appear in the Proceedings of Crypto 89. A better version can be found in The Journal of Cryptography (1996) 9; pp. 35-67. Any version is also obtainable from me, if more convenient. Hope this helps answering the above ``rights'' question. Thank you also in advance for forwarding the above information to whomever you believe may be interested in it. All the best, Silvio --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0