December 2003 - cypherpunks-legacy

Re: Tools for Rendering Censorship Firewalls Ineffective
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:24 PM 9/30/96 +0200, Gary Howland <gary(a)systemics.com> wrote: >I would guess that most sites censoring http by IP would be doing so by >only censoring the http port. If the http servers were to be run on >other ports too (perhaps well known ports like DNS), then this would >make life a little harder for the bad guys. That's trivial - most web server software is happy to use ports other than 80 if you tell it to, and it's not uncommon to see web servers running on ports 8000 or 8080, especially if they're run by regular users rather than root (which you need for port 80 on many Unix systems.) Does anybody know if the German ISPs were blocking XS4ALL's IP address just on port 80, on all ports, or on all but 25? Using important well-known ports like DNS is inviting real trouble. Borrowing from other protocols such as Quote-Of-The-Day or supdup probably won't bother many people, though ports under 1024 may still require root's cooperation and may be looked at skeptically by firewalls. >I have some encrypted HTTP relay software if anyone is interested in >setting up a server. That could be interesting - do you have it on a web/ftp site? # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

2 1

Re: The Nature of the Cypherpunks List
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:11 PM 9/30/96 -0500, Travis Hassloch x231 <travis(a)evtech.com> wrote: >here here. 400 messages in less than a week, with no digest, no moderated >equivalent and no explanation for the "-ratings" list? >who has time for that? i'm interested in crypto but >i have a hard time believing any serious researcher could sift through all >the messages and still have time left to eat & breathe, much less code! ... >i am interested in any alternatives, cypherpunks readers... >other mailing lists that are serious about crypto, security, etc. >wasn't there talk at one time of a list for coders? Cypherpunks-announce(a)toad.com has one or two postings a month, mainly Bay Area cypherpunks meetings. cypherpunks-announce-request for info. You can read cypherpunks with a newsreader at nntp.hks.net ; use all your favorite newsreading tools to filter and organize it. You can get 5-10% of the volume from filtered lists from Ray Arachelian or Eric Blossom. (Ray's FCPUNX list is at either sunder(a)dorsai.org or sunder(a)brainlink.com if he's moved it. Send mail with Subject: help fcpunx There's a digested form of the list. It's free. Eric's at eb(a)comsec.com ; cypherpunks-light costs @20/year.) Coderpunks(a)toad.com is a lower-volume code-related-discussion-only list. Send mail to coderpunks-request(a)toad.com for help. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Inflation-index bonds and private e-currency
by Richard Fiero 17 Dec '03

17 Dec '03

E. Allen Smith wrote: > One of the attractions of privately-produced currencies is as a > hedge against inflation; this development may be a competitor to this > idea. On the other hand, this setup does have an unavailability in _time_ > of the money (more so than other, equal-security bonds of the same duration), > which may offset its greater spendability. > -Allen I don't get it. Why is this bond not saleable like any other? What "privately-produced currencies" are a hedge against inflation? If this bond is saleable like any other, why is the money unavailable? What means "greater spendability?" Is this assumed to be yet another government plot because it competes with other offerings and reduces the cost of borrowing? Respectfully. -- Richard Fiero --

1 0

Re: Another briefing in Atlanta on the NRC crypto report,... (fwd)
by Bill Stewart 17 Dec '03

17 Dec '03

I'm still waiting for a briefing from Dorothy Denning, Dave Maher, and the rest of the Clipper Chip review team on their findings and a final report :-) They released a preliminary report, saying that SkipJack was strong, and never did release a final report analyzing Clipper itself - the Clipper protocols, the chip itself, the master key loading system, or the master key handling procedures (or if they did issue a final report, they didn't advertise it widely...) Bill Stewart At 02:31 PM 9/30/96 -0700, Stanton McCandlish <mech(a)eff.org> forwarded: >Date: Mon, 30 Sep 96 10:26:00 EST >From: "CRYPTO" <crypto(a)nas.edu> >Subject: Another briefing in Atlanta on the NRC crypto report,... > >Subject: >Another briefing in Atlanta on the NRC crypto report, October 21, 1996 > Cryptography's Role in Securing the Information Society > A Public Briefing in Atlanta, Georgia > Monday, October 21, 1996, 1:30-3:30 pm > >There will be a public briefing in Atlanta, Georgia by the National >Research Council on this report. The briefing will be held at the >Manufacturing Research Center on the campus of the Georgia Institute of >Technology on Monday October 21, from 1:30 to 3:30. Dr. Herbert Lin, >director of the NRC study will conduct the briefing. Questions from the >audience will be entertained. For further information, please contact Dr. >Myron L. Cramer (404) 894-7292, <myron.cramer(a)gtri.gatech.edu> at the >Georgia Tech Research Institute. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

whitfield diffie
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Tue Oct 01 07:39:31 1996 what is w. diffie's email address? don't flame me, there's been worse stuff on this list... - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: http://www.rpini.com/crypto/crypto.html iQEUAwUBMlCulBFhy5sz+bTpAQEHmQf47TYvPVJnElmC5I0Vmx76VnqeVZfL9Mtn O2XjlFS4bu0R6zAacqwOE26ul/EpPfgUvw+ogU6IDlT+NpL2N2U4AdiQvbtjmRQ/ TWaDHYZfGEOA4x6eKrrTQNMxtRWgn2fcizuaB0xlRzQffuIprJfhJLLSx7Dolf9G IONtkf/NnEikjzaVoV4TGYhV+md9u5G76so2uCVZwv0cK+089sYBiapyV7mWlBPD z0rHmiobAReMLuzpPKBJqrC6F4qIJk0G8R+SH0GvUhVCuvmBFlLexkduHBuvGu7b znmWNjFCg+lXmgIYAQM3yrpGIA9aRqeiKF+psidrUDPkYcVkAHLR =rqds -----END PGP SIGNATURE-----

1 0

Re: RESPONSE FROM CYBERPROMO
by Dale Thorn 17 Dec '03

17 Dec '03

Mail AutoResponder wrote: > Version 9-30-96: > Cyber Promotions has started to implement stricter Terms of Service > policies WITH TEETH. We have just recently terminated several accounts for > abuse of our policies. (Updated TOS at end of message). [buncha text deleted] > If you would like to send a complaint about any account @cyberpromo.com or > @answerme.com or @omni.cyberpromo.com that has not been terminated, please > send email to: wallace(a)cyberpromo.com Ya' know, it's hard enough working 10 hours a day in a sweatshop, coming home to three kids and a cranky wife, the washer doesn't work, etc., and now I have to answer you? Please, just leave me alone. Don't send me anything. No free money. Nothing.

2 1

[CRYPTO] Cryptography of a sort [FAQ]
by Dale Thorn 17 Dec '03

17 Dec '03

Attached is FAQ, source code, and documentation for a program I've arbitrarily called "Cryptography Of A Sort" (COAS). If anyone is using that acronym for something which could conflict, I guess I'd have to change it.... The FAQ is self-explanatory. The source code contains an unoptimized routine or two; the line comments should take care of that. Following the source code is the user documentation. FAQ: 132 lines Source: 349 lines User doc: 60 lines I've been programming since Feb. 2, 1975, when I bought my first HP-65. 21.66 years and 30 or so personal computers later, I have an HP-48GX, a Win95 laptop, and an HP-200LX with an 85 mb flash card STAC'd 170 mb. I've done several national articles, the last in Dr. Dobb's, June 1991. I prefer languages which offer medium-to-high-level calls along with direct OS/BIOS/etc. access, although the HP-48 RPL is kinda fun.... FAQ for Cryptography Of A Sort (COAS) Author : Dale Thorn <dthorn(a)gte.net> Revised : 29 Sep 1996 [Source code and documentation follow this FAQ] Q: Is COAS an actual product? A: COAS is an encryption engine supplied in source-code format, which calls some commonly-available (and replaceable) functions included with commercial computer-language libraries, which in turn perform some of the rudimentary tasks required by the program. Public Key features are not currently supported in COAS, therefore, messaging applications are not as well supported as is local file encryption. Q: What are the main differences between COAS and other non-messaging-oriented crypto products? A: 1. COAS repositions bits based on multiple encoding passes using one or more Pseudo-Random Number Generators (PRNG's). Since COAS is provided only in source code format, and since the source code calls the PRNG function in the compiler library(s), COAS is actually independent of specific PRNG's. NOTE: PRNG limitations, as described in the popular literature, do not necessarily apply when repositioning bits in multiple passes, as opposed to modifying bits as is normally done in other software. Think of "brute force encryption" (more on this below). 2. COAS does not use a "key" as such, and thus does not "encrypt" the bits in a text bitstream. Instead, it uses an input value (text or numeric) as an entry point into a common PRN sequence. Since the entry point is a secret, and since bits are moved using random block sizes, from their original bytes into unrelated destination bytes, cryptanalytic attempts must necessarily begin with brute-force guessing as to the entry points in the PRN sequences, in order to associate the correct bits with their original bytes of text. Multiple encoding passes raise the number of guesses exponentially. 3. COAS source code is extremely small, the primary intent for which was to provide a sample encoding engine for local/personal computer files. Due to its small size and simplicity, the source code can be easily modified by casual users, who may add in their own custom routines. NOTE: It cannot be overemphasized, that crypto programs which have a widely-respected reputation must also be held suspect when A) The very nature of those programs is to deceive, -and- B) The source code is either not available, or is so complex as to discourage ordinary people from working with it. Q: But if COAS uses a common, ordinary PRNG, how can it possibly be secure? A: I can think of two arguments against using PRNG's: 1. Encoded text is easy to decode by brute force on most computers, -and- 2. Encoded text can be seen as having regular patterns when "viewed" from the vantage point of programs employing higher-dimensional mathematics. Addressing the former, a single-pass encryption of a text file using the typical PRNG might be breakable in as little as .000001 second on one of the larger, faster computers available, however, the same approach might require as many as 10^24 years if the number of encoding passes reaches ten or more. To simplify: try to guess the number I'm thinking between zero and 32,000. You can make 16 billion guesses per second, so it will take only .000001 second (on average) to get the correct answer. If you had to guess ten numbers correctly (and sequentially), it would require roughly (16,000^10) / 16,000,000,000 seconds, approximately 10^24 years. Addressing the latter, the ability to "view" the text as a lattice in a higher dimension is likewise diminished by the discontinuities inherent in multi-pass encoding, when bit-group sizes are determined dynamically by PRN's following the secret entry points into the PRNG sequences. Q: What about the possibility that two or more encryption passes could be decrypted in a single pass, as in the scenario where a third key K3 is functionally equivalent to two separate encrypting keys K1 and K2? A: Since COAS encoding is controlled through entry points into a PRNG's number sequences (adjacent encryptions may also use different PRNG's and/or bit-move logic), searching for a "key" or algorithm which can unpack two or more layers of coding will prove futile when all entry points into the PRNG's are different, and different PRNG's are used. A couple of points to consider: One, the output of the PRNG (or any number series) does not describe the bit move-to locations; those are determined by sorting the PRN's then moving the bits according to the sequence of the original array positions of the PRN's prior to sorting. Since some of the PRN's are duplicates, the original array positions relative to each other will be determined by chance, i.e., the vagaries of the sort process, etc. Two, since the bits are moved rather than modified, and since groups of bits vary in size, an attempt to find particular bits that belong to specific bytes after multi-move shuffling, using any compound key or algorithm in a single decoding pass, will certainly prove futile. Q: Since the personal computer implementation of COAS uses 16-bit integers to initialize (set entry points into) the PRNG's, would ten encryption passes be somehow equivalent to the use of a 160-bit key in conventional programs? A: If the conventional program used a 160-bit key in a manner similar to COAS, it would still have to: 1) move bits, not change them. 2) use an indirect method for specifying move locations. 3) model the processes used in COAS quite closely, since there's no straightforward mathematical approach that can duplicate the conditions described in the previous question and answer. Q: What's the difference between the techniques used by COAS and the use of a One-Time Pad (OTP)? A: The theory behind the OTP assumes that (unlike the use of a Public/Private key) subsequent encryptions using the same OTP key would reveal the nature of the OTP, i.e., any newly-encoded files and messages would share certain common identifiable characteristics which could be exploited to facilitate the decryption of all files using that pad. COAS, on the other hand, doesn't alter any of a file's bits, and therefore does not "add" its PRNG entry points' characteristics to a file other than shuffling bits in accordance with the original physical positions of PRN's which have been sorted by size. Q: Is it possible for anyone to alter the contents of files encrypted by COAS so that a person performing the eventual decryption would not realize that the file(s) were indeed altered? A: Less likely than incidental or brute-force decryption. Each bit is moved once in each encryption pass, and if any bits were moved or changed, that many bytes (or nearly as many, since bits are not moved in byte-divisible groups, so most will end up in unrelated bytes after encryption) would be affected, and the resulting bytes would not likely pass even the simplest checksum test. Q: Is COAS a "weak" product (cryptographically speaking), either because of limitations in its own internal algorithms, or in the commercial library functions it calls? A: COAS can be used in ways that produce weak encryption, which is really an advantage in encouraging beginners to get started, given its simple user interface. Whether it can produce "strong" encryption or not is a matter of opinion, where said opinion is not so much a function of the product's alleged weaknesses, as it is the fact that cryptography grew up from a long history of hand-ciphering and the mathematics attending that growth, and the obvious resistance to new paradigms in this field. While mathematical proof of encryption strength is highly desirable in most applications (some would argue essential in certain applications), I see things this way: Computer software of any kind, which cannot be analyzed by common persons (average programmers), whose innards cannot be exposed to the masses for whatever reason, should not be used where it could effect control over the lives of those people. Looking at it a different way, it's wise for any individual or group to evaluate the software that's available, and make their own judgements independently of "expert opinion" in the field. ******************************************************************************* ******************************************************************************* ******************************************************************************* /* CCRP.C Encrypt/Decrypt a DOS file */ /* By: Dale Thorn */ /* Version 2.9 */ /* Rev. 03.07.1996 */ #include "stdlib.h" #include "string.h" #include "stdio.h" #include "dos.h" #include "io.h" #include "ccrp.h" V main(I argc, C **argv) { /* command-line arguments (input file/offset) */ C cmsg[23]; /* initialize the User message string */ U ibit = 0; /* initialize the bit offset in cbuf */ U ibuf = 2048; /* set maximum file buffer length */ U idot; /* initialize the filename extension separator */ I ieof = 0; /* initialize the EOF flag */ U ilen; /* initialize a temporary length variable */ U indx; /* initialize a temporary loop variable */ I iopr; /* initialize the operation code */ U irnd = 0; /* initialize the randomizer seed */ L lbyt; /* initialize the file pointer variable */ L llof; /* initialize the file length variable */ L lrnd = 0; /* initialize the randomizer accumulator */ U _far *uvadr = 0; /* video display pointer */ struct _iobuf *ebuf; /* source file access structure */ C *cbuf = (C *)malloc(2048); /* initialize the file buffer */ C *ctmp = (C *)malloc(2048); /* initialize the temp buffer */ I *int1 = (I *)malloc(3074); /* allocate the sort index array */ I *int2 = (I *)malloc(3074); /* allocate the sort random number array */ I *istk = (I *)malloc(3074); /* allocate the sort stack array */ if (argc == 1) { /* a command line was not supplied */ ifn_msgs("Usage: CCRP(v2.9) filename [/e /d] [key]", 4, 24, 79, 0, 1); } /* display the usage message [above] and exit */ if (argc < 3 || argc > 4) { /* no. of parameters should be one or two */ ifn_msgs("Invalid number of parameters", 4, 24, 79, 1, 1); } /* display no.-of-parameters message [above] and exit */ if (argv[2][0] != '/') { /* slash preceding parameter missing */ ifn_msgs("Invalid operation parameter", 4, 24, 79, 1, 1); } /* display invalid-parameter message [above] and exit */ strupr(argv[1]); /* uppercase the filename */ strupr(argv[2]); /* uppercase the operation code */ if (argv[2][1] != 'D' && argv[2][1] != 'E') { /* invalid parameter */ ifn_msgs("Invalid operation parameter", 4, 24, 79, 1, 1); } /* display invalid-parameter message [above] and exit */ idot = strcspn(argv[1], "."); /* position of filename extension separator */ ilen = strlen(argv[1]); /* length of filename */ if (idot == 0 || idot > 8 || ilen - idot > 4) { /* filename tests bad */ ifn_msgs("Invalid filename", 4, 24, 79, 1, 1); } /* display invalid-filename message [above] and exit */ if (idot < ilen) { /* filename extension separator found! */ if (strcspn(argv[1] + idot + 1, ".") < ilen - idot - 1) {/* 2nd found! */ ifn_msgs("Invalid filename", 4, 24, 79, 1, 1); } /* display invalid-filename message [above] and exit */ } strcpy(cmsg, argv[1]); /* copy filename to message */ strcat(cmsg, " not found"); /* add "not found" to message */ ebuf = fopen(argv[1], "rb+"); /* open the selected file */ llof = filelength(fileno(ebuf)); /* filelength of selected file */ if (ebuf == NULL || llof == -1L || llof == 0) {/* length=0 or call failed */ fclose(ebuf); /* close the file */ remove(argv[1]); /* kill the zero-length file */ ifn_msgs(cmsg, 4, 24, 79, 1, 1); /* display message and exit */ } iopr = argv[2][1] - 68; /* operation code (1=encrypt, 2=decrypt) */ if (argc == 4) { /* a seed key was supplied */ ilen = strlen(argv[3]); /* length of optional seed key */ for (indx = 0; indx < ilen; indx++) { /* loop through the seed key */ irnd = argv[3][indx]; /* character at byte position */ switch (indx % 3) { /* select on byte significance */ case 0: /* least significant byte */ lrnd += irnd; /* add to randomizer accum. */ break; case 1: /* 2nd least significant byte */ lrnd += (L)irnd * 256; /* add to randomizer accum. */ break; case 2: /* most significant byte */ lrnd += (L)irnd * 65536; /* add to randomizer accum. */ break; default: break; } } irnd = (U)(lrnd % 32640) + 1; /* mod randomizer seed to <= 32640 */ } ifn_msgs("Please standby", 4, 24, 79, 0, 0); /* standby message */ srand(irnd); /* initialize the random number generator */ for (lbyt = 0; lbyt < llof; lbyt += ibuf) {/* proc. file in ibuf segments */ if (lbyt + ibuf >= llof) { /* current file pointer + ibuf spans EOF */ ibuf = (U)(llof - lbyt); /* reset maximum file buffer length */ /* cbuf = "" /* deallocate file buffer */ /* cbuf = space$(ibuf) /* reallocate file buffer */ ieof = 1; /* set the EOF flag ON */ } fseek(ebuf, lbyt, SEEK_SET); /* set file-read position */ fread((V *)cbuf, 1, ibuf, ebuf); /* read data into the file buffer */ while (1) { /* loop to process bit groups in cbuf */ ilen = (rand() / 26) + 256;/* buffer seg. bit-len.: 256<=ilen<=1536 */ if (ibit + ilen > ibuf * 8) {/* current bit-pointer+ilen spans cbuf */ if (ieof) { /* EOF flag is ON */ ilen = ibuf * 8 - ibit; /* reset bit-length of buffer segment */ } else { /* EOF flag is OFF; adjust file pointer */ fseek(ebuf, lbyt, SEEK_SET); /* set file-write position */ fwrite((V *)cbuf, 1, ibuf, ebuf);/* save curr. buffer to file */ lbyt -= (ibuf - ibit / 8);/* set file ptr to reload from ibit */ ibit %= 8; /* set ibit to first byte of <new> cbuf */ break; /* exit loop to reload cbuf from lbyt */ } } /* encrypt or decrypt the current segment [below] */ ifn_cryp(int1, int2, istk, cbuf, ctmp, (I)ibit, ilen, iopr); ibit += ilen; /* increment ibit to next bit-segment */ if (ibit == ibuf * 8) { /* loop until ibit == length of cbuf */ fseek(ebuf, lbyt, SEEK_SET); /* set file-write position */ fwrite((V *)cbuf, 1, ibuf, ebuf);/* write current buffer to file */ ibit = 0; /* set ibit to first byte of <new> cbuf */ break; } } } ifn_msgs("Translation complete", 4, 24, 79, 0, 1);/* disp. message & exit */ } I bitget(C *cstr, I ibit) { /* get a bit-value from a string */ I ival; /* initialize the bit value */ switch (ibit % 8) { /* switch on bit# within character */ case 0: /* bit #0 in target character */ ival = 1; /* value of bit #0 */ break; case 1: /* bit #1 in target character */ ival = 2; /* value of bit #1 */ break; case 2: /* bit #2 in target character */ ival = 4; /* value of bit #2 */ break; case 3: /* bit #3 in target character */ ival = 8; /* value of bit #3 */ break; case 4: /* bit #4 in target character */ ival = 16; /* value of bit #4 */ break; case 5: /* bit #5 in target character */ ival = 32; /* value of bit #5 */ break; case 6: /* bit #6 in target character */ ival = 64; /* value of bit #6 */ break; case 7: /* bit #7 in target character */ ival = 128; /* value of bit #7 */ break; default: break; } return ((cstr[ibit / 8] & ival) != 0); /* return value of target bit */ } V bitput(C *cstr, I ibit, I iput) { /* put a bit-value to a string */ I ival; /* initialize the bit value */ I ipos = ibit / 8; /* position of 8-bit char. in cstr */ switch (ibit % 8) { /* switch on bit# within character */ case 0: /* bit #0 in target character */ ival = 1; /* value of bit #0 */ break; case 1: /* bit #1 in target character */ ival = 2; /* value of bit #1 */ break; case 2: /* bit #2 in target character */ ival = 4; /* value of bit #2 */ break; case 3: /* bit #3 in target character */ ival = 8; /* value of bit #3 */ break; case 4: /* bit #4 in target character */ ival = 16; /* value of bit #4 */ break; case 5: /* bit #5 in target character */ ival = 32; /* value of bit #5 */ break; case 6: /* bit #6 in target character */ ival = 64; /* value of bit #6 */ break; case 7: /* bit #7 in target character */ ival = 128; /* value of bit #7 */ break; default: break; } if (iput) { /* OK to set the bit ON */ if (!(cstr[ipos] & ival)) { /* bit is NOT already ON */ cstr[ipos] += ival; /* set bit ON by adding ival */ } } else { /* OK to set the bit OFF */ if (cstr[ipos] & ival) { /* bit is NOT already OFF */ cstr[ipos] -= ival; /* set bit OFF by subt. ival */ } } } V ifn_cryp(I *int1, I *int2, I *istk, C *cbuf, C *ctmp, I ibit, I ilen, I iopr) { I indx; /* initialize the for-next loop counter */ for (indx = 0; indx < ilen; indx++) { /* loop through ilen array elements */ int1[indx] = indx; /* bit offsets from current ibit offset */ int2[indx] = rand(); /* random number values for sort function */ } ifn_sort(int1, int2, istk, ilen - 1); /* Quicksort by random no. array */ memcpy(ctmp, cbuf, 2048); /* copy data buffer to temp destination buffer */ if (iopr) { /* encrypt operation */ for (indx = 0; indx < ilen; indx++) { /* loop thru ilen array elements */ bitput(ctmp, indx + ibit, bitget(cbuf, int1[indx] + ibit));/*encrypt*/ } } else { /* decrypt operation */ for (indx = 0; indx < ilen; indx++) { /* loop thru ilen array elements */ bitput(ctmp, int1[indx] + ibit, bitget(cbuf, indx + ibit));/*decrypt*/ } } memcpy(cbuf, ctmp, 2048); /* copy temp destination buffer to data buffer */ } V ifn_msgs(C *cmsg, I iofs, I irow, I icol, I ibrp, I iext) {/* display msgs */ io_vcls(7); /* clear the screen */ io_vdsp(cmsg, 4, iofs, 7); /* display the user message */ if (ibrp) { /* OK to sound user-alert (beep) */ printf("\a"); /* sound the user-alert */ } if (iext) { /* OK to exit the program */ io_vcsr(5, 0, 0); /* relocate the cursor */ fcloseall(); /* close all open files */ exit(0); /* return to DOS */ } else { /* do NOT exit the program */ io_vcsr(irow, icol, 0); /* 'hide' the cursor */ } } V ifn_sort(I *int1, I *int2, I *istk, I imax) { /* array Quicksort function */ I iext; /* initialize the outer-loop exit flag */ I ilow; /* initialize the low array pointer */ I irdx = 0; /* initialize the sort radix */ I isp1; /* initialize the low stack pointer */ I isp2; /* initialize the top stack pointer */ I itop; /* initialize the top array pointer */ I iva1; /* initialize array value from low stack pointer */ I iva2; /* initialize array value from low stack pointer */ istk[0] = 0; /* initialize the low array pointer */ istk[1] = imax; /* initialize the top array pointer */ while (irdx >= 0) { /* loop until sort radix < 0 */ isp1 = istk[irdx + irdx]; /* set the low stack pointer */ isp2 = istk[irdx + irdx + 1]; /* set the top stack pointer */ irdx--; /* decrement the sort radix */ iva1 = int1[isp1]; /* get array value from low stack pointer */ iva2 = int2[isp1]; /* get array value from low stack pointer */ itop = isp2 + 1; /* set the top array pointer */ ilow = isp1; /* set the low array pointer */ while (1) { /* loop to sort within the radix limit */ itop--; /* decrement the top array pointer */ if (itop == ilow) { /* top array pointer==low array pointer */ break; /* skip to next radix value */ } if (iva2 > int2[itop]) { /* value @low pointer>value @top pointer */ int1[ilow] = int1[itop]; /* swap low and top array values */ int2[ilow] = int2[itop]; /* swap low and top array values */ iext = 0; /* initialize outer-loop exit flag */ while (1) { /* loop to compare and swap array values */ ilow++; /* increment the low array pointer */ if (itop == ilow) { /* top array pointer==low array pointer */ iext = 1; /* set outer-loop exit flag ON */ break; /* skip to next radix value */ } if (iva2 < int2[ilow]) { /* value @low ptr.<value @low ptr. */ int1[itop] = int1[ilow]; /* swap top and low array values */ int2[itop] = int2[ilow]; /* swap top and low array values */ break; /* repeat sort within the radix limit */ } } if (iext) { /* outer-loop exit flag is ON */ break; /* skip to next radix value */ } } } int1[ilow] = iva1; /* put array value from low stack pointer */ int2[ilow] = iva2; /* put array value from low stack pointer */ if (isp2 - ilow > 1) { /* low segment-width is > 1 */ irdx++; /* increment the sort radix */ istk[irdx + irdx] = ilow + 1; /* reset low array pointer */ istk[irdx + irdx + 1] = isp2; /* reset top array pointer */ } if (itop - isp1 > 1) { /* top segment-width is > 1 */ irdx++; /* increment the sort radix */ istk[irdx + irdx] = isp1; /* reset low array pointer */ istk[irdx + irdx + 1] = itop - 1; /* reset top array pointer */ } } } U io_vadr(I inop) { /* get video address (color or b/w) */ rg.h.ah = 15; /* video-address function */ int86(0x10, &rg, &rg); /* call DOS for video address */ if (rg.h.al == 7) { /* register A-low is 7 */ return(0xb000); /* return b/w address */ } else { /* register A-low is NOT 7 */ return(0xb800); /* return color address */ } } V io_vcls(I iclr) { /* clear screen function */ I irow; /* initialize the row number variable */ C cdat[81]; /* initialize the row data buffer */ memset(cdat, ' ', 80); /* clear the row data buffer */ cdat[80] = '\0'; /* terminate the row data buffer */ for (irow = 0; irow < 25; irow++) { /* loop thru the screen rows */ io_vdsp(cdat, irow, 0, iclr); /* display each <blank> screen row */ } } V io_vcsr(I irow, I icol, I icsr) { /* set cursor position [and size] */ rg.h.ah = 2; /* cursor-position function */ rg.h.bh = 0; /* video page zero */ rg.h.dh = (C)irow; /* row number */ rg.h.dl = (C)icol; /* column number */ int86(0x10, &rg, &rg); /* call DOS to position cursor */ if (icsr) { /* cursor-size specified */ rg.h.ah = 1; /* cursor-size function */ rg.h.ch = (C)(13 - icsr); /* set cursor-begin line */ rg.h.cl = 12; /* set cursor-end line */ int86(0x10, &rg, &rg); /* call DOS to set cursor size */ } } V io_vdsp(C *cdat, I irow, I icol, I iclr) { /* display data on screen */ I ilen = strlen(cdat); /* length of string to be displayed */ I iptr; /* byte-counter for displayed string */ U uclr = iclr * 256; /* unsigned attribute high-byte value */ if (!uvadr) { /* video pointer segment not set */ FP_SEG(uvadr) = io_vadr(0); /* set video pointer segment */ } FP_OFF(uvadr) = irow * 160 + icol * 2; /* set video pointer offset */ for (iptr = 0; iptr < ilen; iptr ++) { /* loop thru displayed string */ *uvadr = uclr + (UC)cdat[iptr]; /* put data to video memory */ uvadr++; /* increment video display pointer */ } } ******************************************************************************* ******************************************************************************* ******************************************************************************* New CCRP documentation - changes as of 28.02.1996 ----------Command---------- ------------------Output------------------- CCRP Usage parameters. CCRP filename /e Encrypt each byte in 'filename' so that the data cannot be seen, or, if the file was an executable file, it cannot be executed. CCRP filename /d Decrypt (restore) each byte in 'filename'. CCRP filename /e key Encrypt or decrypt 'filename', but add an CCRP filename /d key additional factor (a key, or a password) to the encryption and decryption. NOTE 1: The key/password (if used) must be a contiguous string of characters with no blank spaces between any characters. NOTE 2: If a key is entered for encryption, the same key must be entered for decryption. NOTE 3: Encryption may be performed 2 or more times in sequence before decryption, using a different key each time, for additional encryption security. In such case, the decryption steps must be performed in the reverse order (last encryption/first decryption). NOTE 4: Encryption and decryption are mere complementary processes, so that if the decryption step were performed first, followed by encryption, the end effect would be the same. WARNING(!) Encryption changes the contents of a file, and if you cannot perform the decryption process properly, including the use of keys/passwords, you won't be able to recover the file at all. Normally, before making changes to a file, you are advised to make a backup copy of the file, but since the purpose of encryption is to make the file unreadable and unusable, to have a usable backup copy of the file on the same computer, or even in the same area that the computer is located in, wouldn't suit the primary purpose of encryption. NOTES: If maximum security is the objective, you might want to encrypt a file several times (in several passes) with a different encryption key each pass, using different programs, and mixing the encryption/decryption order (OK as long as different keys are used). Examples: ENCRYPT.BAT (encrypt the file; see Note 4 above concerning the /d switch) bcrp filename /d Little_Miss_Muffet_Sat_On_Her_Tuffet ccrp filename /e The_Quick_Brown_Fox_Jumped_Over_The_Lazy_Dog bcrp filename /e We_Have_Met_The_Enemy_And_They_Are_Us ccrp filename /d Let_Him_That_Hath_Understanding_Count_The_Number_Of_The_Beast DECRYPT.BAT (decrypt the file; see Note 4 above concerning the /e switch) ccrp filename /e Let_Him_That_Hath_Understanding_Count_The_Number_Of_The_Beast bcrp filename /d We_Have_Met_The_Enemy_And_They_Are_Us ccrp filename /d The_Quick_Brown_Fox_Jumped_Over_The_Lazy_Dog bcrp filename /e Little_Miss_Muffet_Sat_On_Her_Tuffet

2 1

Export laws don't just affect crypto
by Lucky Green 17 Dec '03

17 Dec '03

The recent posts about GPS made me research the state of the art of GPS receivers. Seems they are getting pretty good. Two pounds, sub-meter accuracy, attitude determination, all at altitudes up to 60,000 feet and speeds up to 1,000 nmph. But what really caught my eye was the fine print at the bottom of the spec sheet: "Higher altitude and velocities up to 25,000 nautical miles-per-hour options are available in the U.S." I gather from this that as long as you are in the US, you are welcome to use this technology for applications that require larger than 1,000 nmph speeds. Seems the software industry is not the only industry that's suffering from silly export control laws. --Lucky

5 5

Re: The John Doe rebellion
by paul.kathro＠insignia.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- azur(a)netcom.com (Steve Schear) wrote: >Eventually, Does could arrange to exchange IDs (if their ages and >descriptions matched) and even credit cards (again assuming equivalence) to >really monkey wrench things. An interesting idea, but how are you going to exchange fingerprints? As far as I can see, the only tangible effect that this scheme would have is to accelerate the call for detailed biometric data (perhaps retinal scans or even DNA profiles) as proof of identity. I'm not sure that we'd want to encourage that... - -- Paul. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMlDQ2ioZzwIn1bdtAQFK8gF/Tugc4AuM+mlkbr663brkmqrPoR86xdu6 WNo5KzQnU6Sb7ywDz83Jq67+NkYMAErx =Y9tO -----END PGP SIGNATURE-----

1 0

Re: What about making re-mailers automatically chain?
by Greg Broiles 17 Dec '03

17 Dec '03

Removing knowledge of the path from the sender is a plus. This prevents anyone, even the sender, from being able to give up any useful info even if under court order. <<<< Why is information about the path useful (or harmful) once the sender is identified? Once the sender is identified, if they're subject to questioning, they can be asked to identify the destination of the message(s). Introducing indeterminacy into the middle of the route won't prevent them from answering questions about the other endpoint. >>>> Adding "random" traffic is helpful 'cause many people (including myself) use pre-fab anon scripts and therefore use the same anon paths all the time (I should stop that). This opens those messages up to some analysis and the possibility of the sender being revealed. <<<< Now I see why you want this. Isn't this the sort of feature which should be added to client software, not remailers? That way, all clients can get as much or as little security as they need. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

Re: RESPONSE FROM CYBERPROMO
by Deana Holmes 17 Dec '03

17 Dec '03

On 30 Sep 96 at 23:44, Dale Thorn wrote: > Mail AutoResponder wrote: > > Version 9-30-96: > > Cyber Promotions has started to implement stricter Terms of Service > > policies WITH TEETH. We have just recently terminated several accounts for > > abuse of our policies. (Updated TOS at end of message). > > [buncha text deleted] > > > If you would like to send a complaint about any account @cyberpromo.com or > > @answerme.com or @omni.cyberpromo.com that has not been terminated, please > > send email to: wallace(a)cyberpromo.com > > Ya' know, it's hard enough working 10 hours a day in a sweatshop, coming > home to three kids and a cranky wife, the washer doesn't work, etc., and > now I have to answer you? > > Please, just leave me alone. Don't send me anything. No free money. > Nothing. Argh. I got this email as well. I thought at first that it had been sent to the cypherpunks mailing list, but it was actually sent directly to me (at least that's what the headers indicate). So now I have to go through the *hell* of trying to get my name off Sanford Wallace's mailing list. I wonder how long it will take? Deana Deana M. Holmes April 1996 poster child for clueless $cientology litigiousness alt.religion.scientology archivist since 2/95 mirele(a)xmission.com

1 0

Re: DIMACS Abstracts
by Will French 17 Dec '03

17 Dec '03

> From: (John Young) > http://jya.com/dimacs.txt (80 kb) > Sorry, no E-mail of this one. Unless, of course, one sends "send http://jya.com/dimacs.txt" in the body of a message to agora(a)dna.affrc.go.jp. Will French <wfrench(a)interport.net>

1 0

RE: Unsubscribing Cypherpunks
by Mullen Patrick 17 Dec '03

17 Dec '03

This message should be mailed to majordomo(a)toad.com _______________________________________________________________________________ From: barina man on Tue, Oct 1, 1996 4:27 To: cypherpunks(a)toad.com unsubcribe cypherpunks(a)toad.com ------------------ RFC822 Header Follows ------------------ Received: by mail.ndhm.gtegsc.com with SMTP;1 Oct 1996 04:26:51 -0400 Received: from toad.com by delphi.ndhm.gtegsc.com with SMTP; Tue, 1 Oct 1996 8:24:04 GMT Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id WAA05035 for cypherpunks-outgoing; Mon, 30 Sep 1996 22:00:27 -0700 (PDT) Received: from genesis.bssc.edu.au (genesis.bssc.edu.au [203.16.225.2]) by toad.com (8.7.5/8.7.3) with SMTP id WAA05020 for <cypherpunks(a)toad.com>; Mon, 30 Sep 1996 22:00:06 -0700 (PDT) Received: from 7545HMW60219 [172.24.2.175] (HELO BSSC.student) by genesis.bssc.edu.au (AltaVista Mail F1.0/1.0 BL18 listener) id 0000_0054_3250_a551_127f; Tue, 01 Oct 1996 15:00:01 +1000 Message-Id: <1.5.4.32.19961001050008.006b2df4(a)172.24.1.5> X-Sender: westo(a)172.24.1.5 X-Mailer: Windows Eudora Light Version 1.5.4 (32) Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Tue, 01 Oct 1996 15:00:08 +1000 To: cypherpunks(a)toad.com From: barina man <westo(a)bssc.edu.au> Sender: owner-cypherpunks(a)toad.com Precedence: bulk

1 0

Wiretap and FTC/FCC net-regulation legislation, from HotWired
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 1 Oct 1996 05:57:17 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Congress' wiretap and FTC/FCC net-regulation bills, from HotWired http://www.netizen.com/netizen/96/40/index1a.html HotWired The Netizen "Sure, Walter Scott" by Declan McCullagh (declan(a)well.com) Washington, DC, 30 September When Parade, that ever-so-offline Sunday magazine, announces that Iranian terrorists use the Internet and unbreakable encryption to plan bombings, you know that anti-Net fearmongering has outgrown the Beltway and is gunning for Middle America. On the page facing an advertisement for a gilded 18-inch porcelain cherubim (US$97.96, if you must know), columnist Walter Scott wrote yesterday that Iranian terrorists have "stopped using the phone" in favor of the Internet. Then he quoted an unnamed "expert on international terrorism" who claims that terrorists have outsmarted the spooks: "Just when we thought we had outsmarted them, they caught on and started using codes on the Internet.... There's so much crazy screwball stuff on the Internet that it's practically impossible to track down and isolate the terrorists." Scott did not return phone calls. Small wonder, with fantastic columns like Scott's, that in the waning days of the 104th Congress our elected representatives have failed to do the right thing by the Net. A conspicuous lack of congressional spine made it almost inevitable that Capitol Hill would cave in to the demands of the White House and the Justice Department over the weekend and agree to yank portions of the FBI's national wiretap plan that limited the snooping powers of the Feds. On Saturday, this Digital Telephony slush fund cleared the House as part of an elephantine six-agency spending bill and the Senate approved it today. Earlier this month both the House and Senate declined to act on bills that would lift the encryption export embargo. Supporters of the measures were outflanked by Nebraska senator Jim Exon's intra-committee maneuvering and the anti-terrorism rhetoric of Jamie Gorelick, the deputy attorney general. Gorelick said last week at a hearing before the House Judiciary Committee that the DOJ is "concerned about the proliferation of unbreakable encryption" that might fall into the hands of "terrorists, organized crime, and foreign intelligence agents." (She doesn't like to admit that PGP is already available around the world.) True, some of the more Net-friendly legislators have tried to help. Senator Conrad Burns (R-Montana) emerged as a champion of netizens' privacy rights with his encryption bill, Pro-CODE. Representative Rick White (R-Washington) introduced a bill that would let ISPs give free online time to political candidates - but even though the House passed the bill last Thursday, the Senate will not. In another kind of congressional schizophrenia, one measure would give the Federal Trade Commission authority to regulate the Internet - while another bill blocks the Federal Communications Commission from even thinking about it. White attached an amendment to the FCC Modernization Act - an act that completely denies the commission jurisdiction "with respect to content or other regulation of the Internet or other interactive computer services." The House Republicans passed it over the objections of the Dems on 12 September, but it's still stuck in committee. White had tried to insert this amendment in the 1996 Telecom Act, but it was sliced out. Now he's trying again. "He believes that the federal government gets a little overzealous in regulation," says Connie Correll, White's press secretary. "We're dealing with a new medium that people aren't too familiar with." An FCC policy analyst says the commission "doesn't want to regulate the Net" but that "White's language would be a mistake." The analyst, who wished to remain anonymous, said: "For example, would the FCC be barred from creating regulations to protect privacy online, or from preempting state laws and regulations that criminalize online indecency?" Then late last week, Representative Bob Franks (R-New Jersey) coughed up his own Net-regulation bill. It's designed to respond to the outcry over the Lexis-Nexis P-TRAK database by halting the spread of Social Security numbers. Inexplicably, it does that by letting the FTC "examine and investigate" ISPs and issue "cease and desist" orders against them if they serve as an SSN-distribution conduit. I called up Frank DiStefano from Franks' office. "Why hold ISPs liable?" I asked him. "In June, the FTC itself decided to hold off from Net regulation.. If someone is giving out another person's personal information, why not let the courts decide if he's violating the law?" "OK, you've convinced me," said DiStefano. He said the reason the FTC provisions were in the bill was "to make a point" and his office "would work on this over the recess." No doubt - until Parade calls for the FTC to crack down on narco-terrorists selling Social Security numbers online. --- Some links: Linkname: Brock Meeks on FEC reform, Rep. White's bill URL: http://www.netizen.com/netizen/96/18/index5a.html Linkname: Democrats vote in committee to let FCC regulate Net URL: http://www2.eff.org/pub/Legislation/Bills_by_sponsor/white_fcc_ noregulation_1996.vote ###

1 0

RE: Signs of Trouble in D.C.
by Scobbie, Jason 17 Dec '03

17 Dec '03

>>>Signs of unrest in the nation's capital. > >>>These signs began to appear all over yesterday. > >>>WARNING >>>THIS AREA HAS BEEN >>>DECLARED A DRUG FREE ZONE I can attest to the ignorance of the govt. of DC. Having spent 18 months in Arlington (US ARMY), I have seen many acts of total ignorance by the govt. One can only speculate on not only how Marion Berry has regained his power, but to what extent some one has to go before being banded not only a criminal but also no longer welcome in the public sector... Jason Scobbie ________________________ > Drink more Bud >

1 0

NYT on New GAK
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, October 1, 1996, pp. D1, D2. Accord Near On Computer Security Codes 'Key' System Required For Law Enforcement By David E. Sanger Washington, Sept. 30 -- After several years of debate between the computer industry and American intelligence agencies, President Clinton has decided to permit American computer companies to export more powerful data-scrambling software but only if they establish a system that will enable keys to the code to be obtained by law enforcement officials with a court warrant. Administration officials, speaking on the condition of anonymity, said Mr. Clinton reached his decision late last week and that Vice President Al Gore would announce it on Wednesday or Thursday. Several big computer companies, led by the I.B.M., have agreed to the new system, but many others, which have opposed past proposals by the Administration for data- scrambling policies, are likely to object. Many American computer and software executives have long argued that United States export controls on the most sophisticated data-privacy technology put American industry at a disadvantage versus products sold by their foreign competitors. But the Clinton White House, like previous Administrations, citing national security issues and fears of foreign terrorists or criminals, is loath to permit the export of some of the most powerful data-scrambling software. The reason has chiefly been that intelligence agencies feared such equipment would be used by foreign terrorists, drug cartels and other criminals to hide transactions and communications. Now, in a compromise, according to two senior officials in the Administration who have been deeply involved in the new policy, American companies will be permitted on Jan. 1 to export software that encrypts, or scrambles, data using "keys" -- lengthy numeric codes -- that are up to 56 bits long. Until now, companies have been prohibited from selling products abroad that have keys longer than 40 bits. Mr. Clinton has also decided to move the authority for exporting the encryption software from the State Department, which has had export-licensing authority because the technology has been classified as munitions, to the Commerce Department, which controls the export of products that have both commercial and military use. Industry officials have long urged that change, betting the Commerce Department would be more inclined to give a higher priority to American competitive interests. But starting in two years, American companies choosing to export the more sophisticated software would have to set up what the industry is calling a "key recovery" system. That system would enable intelligence officials and law enforcement agents, armed with court warrants, to go through a lengthy multi-step process that would give them the mathematical key to decoding scrambled communications. The approach replaces the Administration's earlier proposed "key escrow" system in which the Government would have been the repository of the numeric keys -- leading to fears of potential Government abuse, or a reluctance by legitimate foreign users to buy the software. Under the new plan, the keys may be held by third-party companies. And large institutions, like banks may be allowed to hold their keys in escrow -- assuming they pass some kind of Government certification. Still, the success of the system will depend on large part on the Administration's efforts to persuade other countries to adopt the same "key recovery" system, allowing their intelligence agencies and justice systems to cooperate in trailing criminals across national borders. But Mr. Clinton's aides acknowledged today that this process has just begun, and so far only England and France have expressed much enthusiasm. "It is going to take a while to persuade people that their data is safe under this system, that it protects privacy, and yet that we can use the system to trace terrorists or drug dealers," one senior Administration official said. Officials at I.B.M., which is expected to announce on Wednesday the creation of an industry consortium to aid in establishing the "key recovery" system, said today that no single entity would hold the entire key. Instead, it will be divided up across several companies that would handle any given message, much the way the launching officials in nuclear missile silos each had only part of the key instructions needed to begin a nuclear attack. If the C.I.A., for example, obtained a court order to decode a message, it would have to go to several groups with its warrant to piece together the key. "We believe that this solves the, biggest weak point in the previous plans, where one entity held the key," said an I.B.M. official familiar with the company's announcement. But these steps are not likely to silence all the critics. "There is still a perception that the U.S. is trying to extend its intelligence capability by setting standards around the world," said Marc Rotenberg, director of the Electronic Privacy Information Center. There are other potential holes in the system. Customers in the United States will be free to buy encryption software of any complexity -- as they can today -- with keys that are much longer than 56 bits and are nearly impossible to break. That means terrorist groups or drug dealers could still buy such software and sneak it out of the country, or even transmit it over computer networks. "There is nothing we can do about bright students or Joe Terrorist who use sophisticated encryption systems to communicate with each other," one senior administration official said. "But when they brush up against legitimate groups, especially banks," the official said, "then they are more likely to be dealing with a system" where law enforcement could use the key recovery system to decode the communications. On Capitol Hill, several bills had been pending that would lift all export controls on encryption software, but the legislation did not move as the current session of Congress wound down. In Congressional testimony last week, Jamie S. Gorelick, Deputy Attorney General, said lifting all export controls would "undermine our leadership role in fighting international crime and damage our own national security interests." [End]

1 0

Clipper III on the table
by Omegaman 17 Dec '03

17 Dec '03

Here we go again...from today's NYTimes...Clipper III ---------------------------------------------------------------------- -------- > Clinton Ready for Exports of Data Codes > > By DAVID E. SANGER > > WASHINGTON -- After several years of debate between the > computer industry and U.S. intelligence agencies, President > Clinton has decided to permit U.S. computer companies to export more > powerful data-scrambling software, but only if they establish a system > that will enable keys to the code to be obtained by law-enforcement > officials with a court warrant. <snip> > Several big computer companies, led by IBM, have agreed to the new > system, but many others, which have opposed past proposals by the > administration for data-scrambling policies, are likely to object. <snip> > But the Clinton White House, like previous administrations, citing > national security issues and fears of foreign terrorists or > criminals, is loath to permit the export of some of the most > powerful data-scrambling software. > > Their reason has chiefly been that intelligence agencies feared such > equipment would be used by foreign terrorists, drug cartels and > other criminals to hide transactions and communications. <snip> > Now, in a compromise, according to two senior officials in the > administration who have been deeply involved in the new policy, on > Jan. 1, U.S. companies will be permitted to export software that > encrypts, or scrambles, data using "keys" -- lengthy numeric codes > -- that are up to 56 bits long. (ooooo. 16 extra bits!) > Clinton has also decided to move the authority for exporting the > encryption software from the state department, which has had > export-licensing authority because the technology has been > classified as munitions, to the commerce department, which controls > the export of products that have both commercial and military use. <snip> > But starting in two years, U.S. companies choosing to export the > more sophisticated software would have to set up what the industry > is calling a "key recovery" system. > That system would enable intelligence officials and law-enforcement > agents, armed with court warrants, to go through a lengthy multistep > process that would give them the mathematical key to decoding > scrambled communications. > The approach replaces the administration's earlier proposed "key > escrow" system in which the government would have been the > repository of the numeric keys -- leading to fears of potential > government abuse, or a reluctance by legitimate foreign users to buy > the software. <snip> > Still, the success of the system will depend in large part on the > administration's efforts to convince other countries to adopt the > same "key recovery" system, allowing their intelligence agencies and > justice systems to cooperate in trailing criminals across national > borders. > But Clinton's aides acknowledged Monday that this process has just > begun, and so far only England and France have expressed much > enthusiasm. <snip> > Officials at IBM, which is expected to announce on Wednesday the > creation of an industry consortium to aid in establishing the "key > recovery" system, said Monday that no single entity would hold the > entire key. > Instead, it will be divided across several companies that would > handle any given message <snip> > There are other potential holes in the system. Customers in the > United States will be free to buy encryption software of any > complexity -- as they can today -- with keys that are much longer > than 56 bits and are nearly impossible to break. > That means terrorist groups or drug dealers could still buy such > software and sneak it out of the country, or even transmit it over > computer networks. > "There is nothing we can do about bright students or Joe Terrorist > who use sophisticated encryption systems to communicate with each > other," one senior administration official said. > "But when they brush up against legitimate groups, especially > banks," the official said, "then they are more likely to be dealing > with a system" where law enforcement could use the key recovery > system to decode the communications. > Copyright 1996 The New York Times Company ----------------------------------------------------------------- me -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

1 0

Re: e$: NSA Fluffy FUD?
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Sep 30, 1996 17:56:39, 'Robert Hettinga <rah(a)shipwright.com>' wrote: >Anyway, has anyone *else* seen this apocryphal NSA paper yet? Is it on the web? >I'm sure (he said, volunteering someone else's services unasked yet again) that >someone like John Young would be interested in seeing that fax... You bet, and begging for it. Fax: 212-799-4003 (USfA)

1 0

Re: Clipper III on the table
by Jon Lebkowsky 17 Dec '03

17 Dec '03

At 08:51 AM 10/1/96 +0000, Omegaman wrote: >Here we go again...from today's NYTimes...Clipper III >---------------------------------------------------------------------- >-------- > Clinton Ready for Exports of Data Codes > > By DAVID E. >SANGER > > WASHINGTON -- After several years of debate between the > >computer industry and U.S. intelligence agencies, President > Clinton >has decided to permit U.S. computer companies to export more > >powerful data-scrambling software, but only if they establish a system >> that will enable keys to the code to be obtained by law-enforcement >> officials with a court warrant. ... That URL is http://www.nytimes.com/library/cyber/week/1001code.html -- Jon Lebkowsky http://www.well.com/~jonl jonl(a)hotwired.com

1 0

RE: Utah as a Religious Police State [RANT]
by Moroni 17 Dec '03

17 Dec '03

The mountain is not for the public . Not even mormon public. The records are.The mountain merely contains dup0licates of everything so in the event of a nuclear devastation the church could paste things together again. People can submit whatever they wnat to the records including wills and trusts and stuff ,but that has nothing to do with the gentile community at large . i can only think of the microfilms containing a gentile will if that gentile wanted one.

1 0

mormons questions
by Moroni 17 Dec '03

17 Dec '03

I have no desire to make this a mormon list so any additional questions can be answered by me at 1-717-343-2365. Intelligent questions only. moroni

1 0

GAK Rat Pack
by jya＠pipeline.com 17 Dec '03

17 Dec '03

C|NET, October 2, 1996, 1:45 p.m. PT Computer alliance supports encryption policy By Alex Lash An alliance of 11 software and hardware companies has just announced its formation to develop key-recovery solutions for electronic encryption, a crucial component of the Clinton administration's latest plan to loosen the export of encryption technology. Announced yesterday, the administration's plan gives exporters of encryption or encrypted software a two-year window starting January 1, 1997, to build what the administration calls "key recovery" into their products. IBM, Apple Computer, Atalla, Digital Equipment, Groupe Bull, Hewlett-Packard, NCR, RSA Data Security, Sun Microsystems, Trusted Information Systems, and United Parcel Service have banded together to develop systems that will give the government what it wants, which is access to suspicious encrypted messages, so that compliant software companies will be able to get export licenses for hard-to-crack encryption codes. "Export controls are a fact of life," RSA President Jim Bidzos said today. "In an imperfect world this technique will at least allow you to take advantage of what governments around the world will allow." RSA's presence in the alliance is not only a coup for the government but a big surprise, as Bidzos has been one of the most vocal opponents of the Clinton administration's key escrow efforts. He has even accused the government of offering software companies special "sweetheart" deals to gain support for its encryption regulation plans. A key-recovery plan not only satisfies the government's desire for court-ordered access to encrypted messages, but also sets off alarm bells for privacy advocates and civil libertarians. Some within the U.S. software industry also claim they won't be able to sell encrypted products overseas if customers know the U.S. government has access to a skeleton key. "While some companies might choose to cast their lot with the government's key-escrow policy, the marketplace is likely to reject the approved products," said David Sobel, legal counsel for the Electronic Privacy Information Center. "Users want strong security, not guaranteed government access to their communications." However, the concept of key recovery is not anathema to companies that acknowledge that firms and folks using encryption to secure electronic transactions and communications will need backup copies of their keys, just as homeowners keep an extra house key under a flower pot. Under the new government plan, a company that promises to participate in key recovery will receive a six-month license to export up to 56-bit DES encryption. When the promise is fulfilled and the government can get access to the decryption keys, the 56-bit limit is lifted. If by the end of the two-year grace period the company has not fulfilled its promise to implement a key-recovery scheme, the 56-bit limit is dropped back down to the current 40-bit limit. "The fact that 56-bit DES [a type of encryption] will be available from significant sources is going to jump-start electronic commerce," said Ken Kay, executive director of the Computer Systems Policy Project, a public policy group comprised of 12 computer industry CEOs. Now that the details are out and endorsements are coming in, executive action is expected in the next two to three weeks, according to one senior administration official. President Clinton will soon sign an executive order that transfers jurisdiction over encryption export licenses from the State Department to the Commerce Department, a move that the computer industry has asked for in the past because they see Commerce as a more sympathetic agency. At the same time, Commerce will announce a new set of streamlined rules to grant companies a "fast track" to an export license if they comply with key recovery, the official said. Commerce plans to begin licensing on January 1. But the new plan will also give the Justice Department a voice in the licensing process, a detail that angers privacy advocates and software companies alike. "The transfer from State to Commerce has been called for for a long time, but a small tweak is that the FBI now has veto power," said Peter Harter, legal counsel to Netscape Communications. "Domestic law enforcement shouldn't have a seat at the table." Harter acknowledged that Netscape has not ruled out key recovery but said that the market must show demand for it. The administration has said it hopes to introduce a bill next spring that would encourage the build-up of key recovery by establishing laws on the conduct of third-party key holders. But it will not try to mandate key recovery through legislation. "I think we have a critical mass of companies willing to work with us," said Heidi Kukis, spokesperson for the Vice President's office. "That would make legislation to mandate key recovery very unlikely." Another fear is that the administration is using export limits to control domestic use of encryption. While Gore directly stated yesterday that domestic use of encryption will remain unregulated, the double standard for domestic and international products might discourage U.S. companies from developing two different versions, leaving U.S. and Canadian customers with the same products that the federal government has deemed safe to ship overseas. "We obtained and intend to hold the administration to its assurances that export controls would not be used to control domestic use," said Kay of the CSPP. "The CEOs have told the administration that if they want to do domestic controls, they should do it frontally through the democratic process and introduce legislation." [End]

1 0

Re: active practice in America
by Marc J. Wohler 17 Dec '03

17 Dec '03

At 12:39 PM 9/30/96 -0800, Tim May wrote: >As for the historical reasons for the "conspiracy to not take seriously the >civil rights of an aggrieved minority" nonsense, isn't it about time to >roll back such laws? Whatever the putative justification for such things >might have been 30-40 years ago, this is now, that was then. "this is now, that was then" This is the same same argument used by those who wish to revise and limit the First Amendment. mjw

1 0

Where to find some papers on the the information economy?
by Donald Weightman 17 Dec '03

17 Dec '03

The "World Economy Survey" in the Current ECONOMIST makes some interesting points about the intractabilty of the information-based economy to traditional manufacturing-based econometrics, which looks at things like industrial outputs as the basis for forecasting, and, not least, macroeconomic policy. The gist of it is that the older measures overweight the more traditional transactions -- production & sale of widgets and ingots -- and undercount digital economic activity -- writing code, for example -- because no one knows how to measure the latter. The implications for the political control of cybercommerce are pretty striking -- how can a government control -- using the traditional blunt instruments like fiscal and monetary policy -- sectors it cannot see, measure, or quantify? Anyway, the ECONOMIST Survey cites a couple of papers I'd like to see: Charles Goldfinger; "The Intangible Economy and its Implications for Statistics and Statisticians". Eurostat -- ISTAT seminar, Bologna, Feb. 1996 Danny Quah; "The Invisible Hand and the Weightless Economy". LSE Centre for Economic Performance, occasional paper No. 12, April 1996. I ran some Web searches with null results. Does anyone know how I can get these quickly? Thanks, and apologies if the cross-posting is burdensome. Don Weightman dweightman(a)radix.net

1 0

LEO_rat
by jya＠pipeline.com 17 Dec '03

17 Dec '03

10-1-96. WaPo: "U.S. to Ease Encryption Restriction." Page One lead. Sources at IBM say scientists there have devised a scheme that uses several steps to encrypt information and the keys for unlocking it. Law enforcement officials authorized to unscramble information would not get a key for unlocking a message but instead the instructions for how to break open a specific encrypted message. ----- http://jya.com/leorat.txt LEO_rat ----- For an earlier report on IBM's LEO-rat, see http://jya.com/ibmgak.txt

1 0

Re: ASAP letter on e-cash
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Forbes, ASAP, October 7, 1996, p. 18. Bankrupt the Bureaucrats! Eugene Ludwig's principal concern ["The Money Changers," August 26] is not counterfeiting, theft, or fraud: Those crimes have victims, and regulators are never concerned with victim crimes. As comptroller of currency, he is worried sick about tax evasion (i.e., avoidance) and money laundering because he knows that technology like Chaum's Ecash could put him and his entire bureaucracy out of their cushy jobs, regardless of the actions of the executive branch or Congress. Counterfeiting a $100 bill, even one of the new ones, is easier than counterfeiting one of David Chaum's Ecash payments, and the previous level of government "concern" regarding offshore counterfeiting of $100 bills is instructive here (they let it go on for years!!). Some in government have gotten a clue by osmosis, such as Senator Conrad Burns (R-Mont.), but the damage is already done. My solution: Vote Libertarian! Jim Ray liberty(a)gate.net [Right E-steamed Cypherpunk]

1 0

DES CRACKING SCREENSAVER, was: Can we kill single DES?
by azur＠netcom.com 17 Dec '03

17 Dec '03

>On Wed, 2 Oct 1996, Frank Andrew Stevenson wrote: > >> DES CRACKING SCREENSAVER >[...] >>the screensaver itself can simply display a rotating globe, >> where the different densities of global usage is given in colour shades, >>showing >> an inverse sunclock of sorts. I think such a concept might give the >>DES-cracking >> screensaver a critical mass. Suggest you make it a plug-in module to one of the popular screen savers (e.g., After Dark). I'd run it. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Voice: 1-702-655-2877 Sacred Cow Meat Co. | Fax: 1-702-658-2673 7075 W. Gowan Road, #2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

Crypto Boundries
by ratak 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Tue Oct 01 12:38:37 1996 Hello All... A few questions here... The idea of a Crypto programming division has been tossed around over here, and was wondering... Does anyone have any serious hard facts on what crypto is allowed in which countries? How about Crypto development within Canadian Boundaries, are there any limits/concerns? Are any of the Crypto systems subject to different laws i.e 3Des/IDEA/MD5/Blowfish etc.? Later ___________________________________________________________________ GarGoyle Securities - -Intrusion Assessment Systems - -Security Consultation/Education/Curriculum Development - -Project Management/Research/Analysis World Wide... - -Member of CITDC (Canadian International Trade Development Council) - -Email 1: <ratak(a)escape.ca> Jason E.J. Manaigre - -Email 2: <ratak(a)GargSec.mb.ca> - -Email for PGP key with phrase 'Get Public Key' as Subject - -2048 PGPKey iD E2 FA 30 E5 F5 AD EC F3 00 9A 9D 33 59 FC DF AD ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMlFXIfqtmO8M92GRAQF2tgf/aZ1bATXGeE8jK309T1gcnl25cogE0I0a pO1hAtgtBedSO56XBas0bwhJD5tWeNuR46uQNKNH3hX7MeJN1wAKGg5o7sBsf4k0 J1ApRTXt2DsbELkYdIkcMVsTf1W40AimormYDKq2DPqSg7b9C1n1vQe/uDkDxDN3 aT/MOl7YLH1d31TffF7zwOLmcs1d0qZ8n0w//QcGwOI9l1Q2i0hc98DW6qYwdpJG Zg+rZzt7jWJxICufh43AABs3j1X7FBsN+g0zBVrLmBK+I55/cHoxAg0uK+b1umTJ eetc2GyjtO3H7uzpFDBZLJ3bTamm9nyA6fmYgjKm0dXpfYPlR5UBpw== =BjRl -----END PGP SIGNATURE-----

1 0

How might new GAK be enforced?
by Timothy C. May 17 Dec '03

17 Dec '03

Now that the shoe is dropping on "Clipper III" (or "Clipper IV"), the "voluntary, for export, key escrow system," how might it be enforced? Some possibilities: 1. Make GAK the "easiest and safest" use even within the United States. Do this by aggressively pursuing, harassing, and prosecuting anyone who lets non-U.S. persons, even within the United States, have access to export-controlled software. (I had not fully appreciated the ramifications of the ITARs for software distributed _within_ the U.S. until the Bernstein matter unfolded. Export-controlled software is not supposed to be sold to various classes of foreign persons, including visitors, students on certain types of visas, and others. Mostly such rules have been ignored, with large software stores like CompUSA, Fry's, Egghead, etc., simply selling export-controlled software to anyone with the money. Their are _stickers_ on some software items warning against export, but these are ignored in sales. A few high-profile prosecutions of large resellers could spread FUD wide and far, triggering a "GAK-only" policy on sales of crypto products. The outcome of the Bernstein hearing could thus be critical.) 2. Attempt to make illegal the _interoperability_ with non-GAK software. Or, attempt to make illegal interoperability with a product which would have been illegal to export. Thus, if Alice, in the U.S., uses a crypto product to communicate with Bob, in a foreign country, and it "would have been illegal" for Bob to legally receive the product, then Alice is presumed to be breaking some law (maybe "conspircacy"...I'm not a lawyer) by sending messages Bob can read. This is just vague speculation. But I think the government must be thinking how they can finesse this point, how they can stop the current "crypto anarchy" (in a different sense than I use it), where "rogue users" in foreign countries are unreachable by U.S. law. The easiest way, of course, is to go after U.S. persons or companies who intercommunicate with these rogue users. (Else what's to stop Giant Corporation from using Non-GAKked software within the U.S., which is perfectly legal (under the "voluntary" system), but then "happening" to have their foreign branches and customers obtain "bootleg" versions at their end? All it takes is a single copy to get out, and be duplicated a zillion times. Voila, interoperability, with the only "crime" being the first export...which is essentially impossible to stop, for so many reasons we mention so often. Conclusion: Government must make this very mode illegal, perhaps by making it a conspiracy to thwart the export laws....) Any other ideas on how the government plans to enforce GAK, to make GAK the overwhelmingly-preferred solution? --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 6

San Diego CPunk Physical meeting Thursday
by Christian Claborne 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- <<<<< NOTE! I have a new address!!! >>>>>> This Thursday!!! San Diego Area CPUNKS symposium Thursday, Oct. 3, 1996. Invitation to all Cypherpunks to join the San Diego crowd at "The Mission Cafe & Coffee Shop". We discuss cryptography and other related subjects, have the special cypherpunk dinner, and unwind after a long day at the grind stone. Don't forget to bring your public key fingerprint. If you can figure out how to get it on the back of a business card, that would be cool. If you want the suspicious crowd there to sign your key, bring two forms of ID. Michelle is going to bring her PGP fingerprint in for signature. Can you believe it? Hopefully Lance Cottrell will give us an update on Mixmaster and what's going on at San Diego's best ISP. You can also get the scoop on the latest development of my job situation (hint, some people are getting free eats from me on Thurs). Place: The Mission Cafe & Coffee Shop 3795 Mission Bl in Mission Beach. 488-9060 Time:1800 Their Directions: 8 west to Mission Beach Ingram Exit Take west mission bay drive Go right on Mission Blvd. On the corner of San Jose and mission blvd. It is located between roller coaster and garnett. It's kind of 40s looking building... funky looking (their description, not mine) They serve stuff to eat, coffee stuff, and beer + wine. See you there! New guy, bring your fingerprint. Drop me a note if you plan to attend... NOTE: My primary e-mail address has changed to use my own domain. You can reach me at "claborne(a)cyberthought.com". Permanently replace any other address that you may have for me. I am currently not subscribed to the CP list since my current internet connection is slow (I can't afford anything right now :) 2 -- C -- -----BEGIN PGP SIGNATURE----- Version: 4.0 Personal Edition iQEVAgUBMlFWioP1MBWQ+9udAQFx4wf/XYFLdsCzyCuIAHyswaKLxZWVgbj8lZiZ 0uxh1kv6SY0BW1UVrz5Fi9mkqcfy8D1t70VZj2BfxsEcVPSWKoaBaZA/NJaKyt29 UYHleHz00bkzesSKyJpZ6TSGFgG765okgG3xI3Q/93IbgiZxDzbmYvDGGsYLO9FY 0RSageZaeSALZgZxCQkG64EwChTqolJgBPpLS8Fv3kDEM96aA6d2zfip6nhgSYYR +omBwcmGU2Y+kG+LAtV7YxAm7VFHSPy5FvmETcDDWH8+IbSECGgtJIvFFanIxk1F LmJjgjfzgr9vpM/3CAuX4ar/WrffLuyZxGXH49fWDzht9o4ayb94xw== =jEwG -----END PGP SIGNATURE----- ... __o .. -\<, Claborne(a)CYBERTHOUGHT.com ...(*)/(*)._ Providing thoughts on your computing needs. http://www.CYBERTHOUGHT.com/cyberthought/ PGP Pub Key fingerprint = 7E BF 38 3F 24 A7 D1 B0 54 44 96 AA 10 D0 5D 51 Avail on Pub Key server. PGP-encrypted e-mail welcome! Dreams. They are just a "screen saver" for the brain.

1 0

[ADVICE] Dimitri Vilus`s personal attacks
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Hmm...never heard that one before. Care to produce > a reference? > > (Or am I supposed to be ignoring this guy when he > makes ridiculous claims?) I shouldn`t take any notice, he`s a loon who posts rants, lies, off topic rubbish and personal attacks to the mailing list. just ignore him, hopefully he`ll soon realise he`s not wanted and leave... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Clipper IV Proposal
by Dave Banisar 17 Dec '03

17 Dec '03

FYI, The Clipper IV Proposal is now up at the EPIC Web site at: http://www.epic.org/crypto/key_escrow/clipper4_statement.html Dave _________________________________________________________________________ Subject: Clipper IV Proposal _________________________________________________________________________ David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * HTTP://www.epic.org Washington, DC 20003 * ftp/gopher/wais cpsr.org

1 0

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

News Release (Smart Card Forum): Friday, September 27, 1996 Consumers Can Be Confident in Smart Card Security TAMPA, Fla. -- Two scientists at Bellcore announced a theoretical model for penetrating the security of smart cards and other tamperproof devices. It is important to point out that this is just a mathematical theory. The Smart Card Forum does not believe that this theoretical attack presents a real-world risk. Multiple techniques are used together to make the entire system secure. And good systems are designed so that they cannot be attacked successfully at a single point. Even if a single card could be compromised, though unlikely, it would not compromise an entire system nor allow the production of counterfeit cards. That is not to say that Bellcore's work is not useful. In fact, the Smart Card Forum encourages this type of healthy speculation because of the importance of ensuring that all security issues be considered, analyzed and resolved as early in the product design as possible. For a smart card product to be successful, consumers must have confidence in its security. The Bellcore research should not be perceived in any way as diminishing the security of smart card products consumers are now using. The smart cards used in North American stored value trials today are not vulnerable to this theoretical attack. The Smart Card Forum The Smart Card Forum is a non-profit, multi-industry membership organization promoting the widespread acceptance of multiple application smart card technology in North America. Its primary mission is to bring together in an open forum, leaders from both the private and public sectors to address topics associated with the development and evolution of smart card technology applications. The Forum was established in September 1993 and currently has more than 225 corporate and government members including: Chase Manhattan, Citibank, Bellcore, MCI, MasterCard, Visa, IBM, Microsoft, Mobil Oil, Schlumberger, Gemplus, Delta Airlines, U.S. Postal Service, the Federal Reserve, U.S. Department of Treasury and U.S. Department of Defense. Dow Jones: Friday, September 27, 1996 Chase Says Findings Won't Halt NYC Smart Card Plan A potential security flaw in electronic cash cards found by Bellcore scientists will have no effect on a pilot program to test the cards in New York City early next year, a leading bank involved in the program said. Chase Manhattan Corp. (CMB) spokesman Ken Herz - speaking on behalf of a consortium that includes Citicorp (CCI), Visa International and MasterCard International Ltd. - said Bellcore's warnings won't hinder the roll-out of the pilot program. ''The industry is well aware of the vulnerabilities of the system,'' Herz said, adding that the consortium members have discussed the potential problems ''for months now.'' Herz said the consortium is planning to test the cards during the first quarter of 1997 with about 50,000 Chase and Citicorp customers on the Upper West Side of Manhattan. American Banker: Friday, September 27, 1996 Why Intuit Pulled Plug on Home Banking Processing By DREW CLARK Intuit Inc., which boasts of being able to turn on a dime, proved it could with its decision to get out of the processing of home banking transactions. An acquisition that looked so smart just two years ago turned into an albatross. When 40 top executives gathered at Mountain View, Calif., headquarters last month to determine the fate of Intuit Services Corp., the answer quickly became evident. As was announced last week, Checkfree Corp. agreed to buy the unit for $228 million in stock. "We have always anticipated this change, but we did not anticipate that it would come so fast," said Intuit executive vice president William H. Harris. Intuit bought the Downers Grove, Ill., processor, then known as National Payment Clearinghouse Inc., for $6.8 million in 1994. Overnight, Intuit established itself as the leader in handling transactions emanating from PC-based financial management programs. By this year, though, bankers have been complaining loudly about service quality and worrying aloud that Intuit wants to control their relationships with users of its popular Quicken software. Complicating matters for Intuit, as it was dealing with rapid growth in transaction volume this year, was a flurry of new entrants -- banks as well as software companies -- into the home banking market. The Intuit executives knew they had to take action. Should they add to the more than $30 million already spent on Intuit Services, or cut their losses and refocus on the core software business? "We put up on a board a list of the highest priorities that we wanted to address," Mr. Harris said. "The list was overwhelming." Besides home banking and bill payment, the company envisioned itself connecting customers to mutual funds, insurance, and tax preparation as well as facilitating bill presentment and electronic commerce. It became obvious to the executives that ownership of Intuit Services was not helping them to meet those priorities. "By the end of the process, there was close to complete unanimity," said Mr. Harris, who reports to chief executive William V. Campbell. "A number of people changed or modified their points of view. There were those who argued we could innovate faster by continuing to do every part of the chain." Once they decided to sell Intuit Services, the software company's leaders moved on the issue of openness. "We needed many people to help us," Mr. Harris said, "and one of the ways to get other people to help us was to open up our system." Along with the announcement of the sale, Intuit said it would decouple its financial software from the back-end processing network to be owned by Checkfree. No longer would banks be forced to use the facility for back-end processing and bill-paying work. Under a new regime called OpenExchange, Intuit promised to release software specifications by the end of the year. Banks and other financial institutions will be able to offer customers on-line access to Intuit products regardless of their payment processor. Mr. Harris said the decision "frees us up to concentrate on the front-end software and allows us to find appropriate partners" for back-end processing. But he added, "one of the disadvantages of an open approach is that you depend upon your partners." "This decision underscores the trend toward open standards in on-line financial services," said Marc Singer, a consultant with McKinsey & Co. in San Francisco. "It also illustrates the importance of collaborating to compete. In an uncertain environment you have to stake out positions and continually revisit them." Securities analysts also praised the evaluation of Intuit Services Corp. as "a drag on earnings. Intuit wants to hold on to the lead, and this will make Intuit more appealing to the large banks," said Steve Higgens of Bear Stearns & Co. in San Francisco. Although Intuit's move toward open software came just a week after the bank-owned Integrion Financial Network emphasized its own "open standards," Intuit officials insisted that the timing was coincidental. Quicken 6.0 for Windows is scheduled for release in October. The 1997 version will be the first to comply to the OpenExchange standard, Mr. Harris said. "We've done a lot in a hurry." He expressed no regret about the company's two-year experiment in payment processing, saying Intuit technicians had learned much by establishing back-end connections to banks and bringing many customers into the home banking field. "When we purchased National Payment Clearinghouse, the only viable way to connect securely with large numbers of consumers was through a private network and on a central hub," said Mr. Harris. "That was true one year ago, and probably even six months ago," he added. "It was now time for us to adjust our connectivity strategy and embrace the open approach." Intuit now hopes OpenExchange will be its gateway to the Internet. The company plans to implement Internet connections for on-line investment activities next spring and for on-line banking and bill payment next fall. "Today," said Intuit chairman Scott Cook on the day the sale and OpenExchange were announced, "rapid advances in safety and reliability of the Internet make it the central focus of our overall connectivity and business strategy." OpenExchange is akin to other protocols being developed by Intuit competitors. But unlike Microsoft Corp.'s Open Financial Connectivity and Visa Interactive's ADMS (Access Device Message Specification), OpenExchange will also transmit nonbanking financial information. Intuit hopes thereby to encourage sales of its investment, tax, payroll and accounting software. American Banker: Monday, September 30, 1996 Bad News for High-Tech Lending: Borrowers Prefer People By Edward Kulkowsky About 97% of all homeowners prefer to apply for mortgages in person, according to a survey by the Mortgage Bankers Association. The finding suggests that there might be tough sledding ahead for lenders considering alternative marketing channels for mortgages, such as the Internet, phone, and video conferencing. The survey uncovered other consumer preferences that could be useful to lenders. "The findings are expected to help mortgage lenders more precisely target current homeowners to refinance, as well as help them retain their own current borrowers," said David Lereah, the MBA's chief economist. "Further, the information contained in the study provides investment bankers and institutional investors with an analysis of which types of mortgages are likely to refinance, in order to better predict prepayment speeds on mortgage-backed securities." The MBA said the final report and a data tape of the complete study, "Mortgage Refinancing Practices and Decision-Making Dynamics," is available for purchase. The tape provides extensive demographic data that can be sorted and stratified by 169 fields, according to the announcement. All 1,500 respondents originated or refinanced a loan between January 1991 and March 1996. The survey found that borrowers had limited loyalty to their current lender. About three-quarters of the 1,500 respondents to the survey were willing to consider lenders in addition to their present provider. About 80% of those who plan to remain in their homes more than five years said they would refinance if rates fell by one to two percentage points. More than half reported having refinanced their original mortgages, motivated primarily by attractive rates and lower fees. Other key findings: * Some 80% of those who refinanced now have fixed-rate loans. * About three-quarters of those who did not refinance already had fixed- rate loans, and two-thirds have loans with rates of 6.6% to 8%. * About a third of those who refinanced took out loans larger than their outstanding balances. * About half of the respondents said "too much paperwork" was the major difficulty in the refinancing process. The study was sponsored by the MBA, Citicorp Mortgage Inc., First Union Mortgage Corp., First Chicago NBD Mortgage and Norwest Mortgage Inc. and was conducted by R.S. Carmichael & Co., a market research company. News Release (Microsoft): Monday, September 30, 1996 Survey Shows Americans Struggle with Financial Fitness Experts look to PCs and Personal Finance Software for Better Money Management Results from the recent Money '97 Financial Fitness Survey reveal the average American's state of financial fitness falls well below expert guidelines. Microsoft Money '97 personal finance software commissioned the telephone survey of more than 1,000 respondents, in conjunction with the release of the latest version of the software package, to gain a better idea of how Americans are currently managing their personal finances. Some financial experts point to the online revolution as a promising part of the solution to America's woes. Studies show that over 750,000 households are already using online banking, with projections for a staggering 13 million by the year 2000. Computers and personal finance software are dramatically improving America's potential to gain control of their money management. For so long, so many have struggled to face the numbers, dreaded the monthly reconciliations and wondered whether they were really saving enough. But help is here in a way generations before never imagined. With a PC and personal finance software, people can now sit in the comfort of home and use online banking to pay bills electronically, reconcile check registers, transfer funds, and so much more. This new technology opens up a whole new world of financial ease and control for household money managers. Survey Reveals Persistent Trouble Spots Conducted by Opinion Research Corporation of Princeton, NJ, the Microsoft Money '97 Financial Fitness Survey compares American's personal finance management practices with the advice of leading personal finance experts in four key areas: 1) Budgets, Tracking & Categorizing; 2) Savings & Investments; 3) Credit Cards & Banking; 4) Retirement & Big Ticket Items. In all four fitness categories, the survey shows that many Americans struggle with common problem areas. For example: On Budgeting Experts say a solid, categorized budget is the foundation for financial fitness, however: * only 37% of Americans follow a categorized spending plan, while 42% simply pay bills and allocate what's left. Another 17% say they just don't budget at all. On Saving The advice "Pay yourself first!" is a familiar battle cry among financial experts, however: * more than half the Americans surveyed (56%) admit they do not set aside a fixed amount or percentage from each paycheck. Regarding those all-important personal emergency funds, experts say we should have a minimum of two months living expenses on hand, however: * among households with children between 12-17 years, a distressing 51% have either no funds tucked away or only enough to cover 2-4 weeks in a crisis. On Credit Paying high interest on credit card debt can negate gains of other good investments, however: * among the 76% who have credit cards, more than half don't pay off their balance each month, needlessly incurring finance charges and further debt. Planning for the Future It's important to know early on what we'll need for the big ticket items like college or our own retirement fund. However: * on college tuition, among households with children under 12 yrs, a surprisingly high 71% could not correctly estimate the cost of sending a child to one year of state university 15 years from now ($22,000). * on inflation, only 18% of Americans were able to correctly identify how much today's dollar will be worth in 20 years (38 cents). The Easy Way To Manage Money "The Money '97 survey does signal some troubling financial fitness problems," says personal finance expert and best-selling author Neale S. Godfrey ("Money Doesn't Grow On Trees," "A Penny Saved," "From Cradle to College"), "But it's my job to tell people, 'it's okay,' and where to go from here." Godfrey and other experts advise would-be money managers to start by getting the right tools and getting organized. Says Godfrey, "I use Microsoft Money to help people manage their money on a day-to-day basis and to see their complete financial picture. Then, they continue using it to keep finances in shape." Jack B. Root, President of Successful Money Management Seminars (SMMS) notes, "By computerizing personal finances, the formerly unfit will soon be able to determine exactly where their money's going. They'll have the understanding needed to set long term goals, make strategic decisions and stay in control." Microsoft Money '97 is an excellent task-based tool for tackling the most common financial fitness problems. Money '97 is quick and simple to learn, and helps the user work from categorized budgets, track finances, easily manage accounts and pay bills electronically (no more checks!). Even for the well-disciplined home finance manager, the online banking feature of Microsoft Money '97 can be a real time-saver and expand options. The user can easily download statements, balance accounts and transfer funds from home. In the Money '97 Financial Fitness Survey, nearly a quarter (22%) of respondents admit they reconcile their checking account to a bank statement (when notified of insufficient funds) only occasionally or never. But even for the many who reconcile regularly, studies show all but one percent are doing it the tedious manual way. Online banking allows people to access statements and reconcile checks at the touch of a button. Money '97 Launches National Financial Fitness Campaign To help America set out on the road to recovery, Money '97 is launching a national Financial Fitness Campaign. The multi-tiered program kicks off with free, open to the public Financial Fitness Events in New York, Chicago and San Francisco. Regional survey results and Money '97's campaign for change led the mayors of all three cities to declare "Financial Fitness Day" on the date the event comes to town. Participants will have a chance to take a financial fitness test, have their most pressing fitness problems diagnosed, and meet with financial experts for advice and information. The Money '97 training team will also be out in full force helping event-goers learn how to computerize their finances. Download Trial Version of Money '97 Free at MoneyZone Americans will have easy access to the tools needed to get started on their own financial fitness program. Beginning September 30th you can download a trial version of Money '97 for free (connect charges apply). Just go to Microsoft MoneyZone on the World Wide Web at www.microsoft.com/moneyzone. MoneyZone also links users to product support, a complete list of Money '97 ONLINE bank partners and a wealth of other personal finance management information. Additionally, working with Money '97, Successful Money Management Seminars (SMMS), will conduct ongoing seminars across the country to help Americans improve their financial management skills. Founded in 1975, Microsoft (Nasdaq: MSFT) is the worldwide leader in software for personal computers. The company offers a wide range of products and services for business and personal use, each designed with the mission of making it easier and more enjoyable for people to take advantage of the full power of personal computing everyday. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Hey, there's a camera in that palm tree!
by lcs Mixmaster Remailer 17 Dec '03

17 Dec '03

LANGHORNE, Penn., Sept 30 (Reuter) - Digital Descriptor Systems Inc said on Monday that it had received the first $140,000 phase of a proposed $1.4 million contract from IBM. The money is to be used by the Bahamas for the installation of imaging identification systems. The first segment of the imaging program will be installed in the Bahamas by the end of this year. Digital Descriptor, in a three-year partnership with IBM to create a program needed on a country-wide basis by the government of the Bahamas, manufactures and markets imaging systems for municipal and private criminal enforcement markets.

1 0

This list is a joke
by Dave Temple 17 Dec '03

17 Dec '03

When I subscribed to this list, I thought it would have decent communication on worthwhile topics. I've come to realize though that 75% of the messages I receive are from people whining like 4 year olds. I am making a huge assumption in saying that most of the people on this list are adults. It is time to start acting like it. Please take my name off of this list.

6 5

The Impact of Cybercommunications on Traditional Financial Services
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

http://www.ctr.columbia.edu/citi/cybercom.html http://www.ctr.columbia.edu/citi/cybcompap/ravi.htm Abstract: This paper presents a framework that provides a conceptual understanding of electronic commerce-based financial services. The paper then discusses some of the research issues that need to be addressed in this emerging area. Systematic research o n online financial services is virtually non-existent. Most of the early work consists of anecdotal evidence from individual companies, usually in the form of trade journal articles which have no empirical basis. Clearly there is a need for industry-acade mia collaboration to understand the online financial services area better. There is also a need to develop methods and tools for measuring the effectiveness of these services. Traditional effectiveness measuring methods will be of limited use in cyberspac e as banks enter an era in which financial products are treated as information commodities and banks are in competition with non-banks to serve customers with the best bundle of information _______________________ Regards, An oral contract isn't worth the paper it's written on. -? Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Sen. Leahy's Statement on Clipper 3.1.1
by jseiger＠cdt.org 17 Dec '03

17 Dec '03

STATEMENT OF SENATOR LEAHY ON THE ADMINISTRATION'S NEW ENCRYPTION INITIATIVE October 1, 1996 The timing of the Administration's announcement on encryption, within hours of the Congress' likely adjournment, is unfortunate. The Administration needs to work with Congress to develop a consensus on a national encryption policy that takes account of the privacy, law enforcement and competitiveness concerns of our Nation's citizens and businesses. Taking unilateral steps will not resolve this issue, but instead could delay building the consensus we so urgently need. This issue simply cannot by resolved by Executive fiat. While technology should not dictate policy, particularly when our public safety and national security interests are at issue, any policy we adopt must protect our privacy. As the Administration and industry rush to find an alternative to unbreakable encryption, they should take heed that any solution which fails to protect the Fourth Amendment and privacy rights of our citizens will be unacceptable. That is why, with bipartisan support, Senator Burns and I introduced legislation in March that set out privacy safeguards to protect the decoding keys to encrypted communications and stringent legal procedures for law enforcement agencies to get access to those keys. In this plan, the Administration is directing the resources of our high-tech industry to develop breakable, rather than unbreakable, encryption. But no one is yet clear about who will be legally allowed to break into encrypted messages, and under what circumstances. These are questions that have to be answered not only with our own government but also with foreign governments. The weakest link in a key recovery system may be the country with the weakest privacy protections. Internet users, who can send messages around the globe seamlessly, do not want the privacy of their encrypted communications to be at the mercy of a country that ignores the Fourth Amendment principles we enjoy here. These are significant privacy and security concerns not answered by the Administration's plan. Even without reading the fine print, the general outline of the Administration's plan smacks of the government trying to control the marketplace for high-tech products. Only those companies that agree to turn over their business plans to the government and show that they are developing key recovery systems, will be rewarded with permission to sell abroad products with DES encryption, which is the global encryption standard. Conditioning foreign sales of products with DES on development of key recovery systems puts enormous pressure on our computer industry to move forward with key recovery, whether their customers want it or not. Internet users themselves -- not the FBI, not the NSA, not any government regulator -- should decide what encryption method best serves their needs. Then the marketplace will be able to respond. The Administration is putting the proverbial cart before the horse, by putting law enforcement interests ahead of every one elses. But that is not the only catch in the Administration's plan. Permission to export DES will end in two years. Allowing American companies to sell DES overseas is a step long overdue. Given the fact that a Japanese company is already selling "triple DES", one might say this step is too little, too late. Threatening to pull the plug on DES in two years, when this genie is already out of the bottle, does not promote our high-tech industries overseas. Does this mean that U.S. companies selling sophisticated computer systems with DES encryption overseas must warn their customers that the supply may end in two years? Customers both here and abroad want stable suppliers, not those jerked around by their government. The most effective way to protect the privacy and security of our on-line communications is to use encryption technology. Every American should be concerned about our country's policy on encryption since the resolution of this debate will affect privacy, jobs and the competitiveness of our high-tech industries.

1 0

White House Statement on Clipper 3.11
by abd＠cdt.org 17 Dec '03

17 Dec '03

Included below for your viewing pleasure is the Administration's latest encryption proposal, released at a White House briefing this afternoon. This statement, and more information including CDT's forthcoming analysis of the proposal, are available at: http://www.cdt.org/crypto http://www.crypto.com Alan Davidson, Staff Counsel 202.637.9800 (v) Center for Democracy and Technology 202.637.0968 (f) 1634 Eye St. NW, Suite 1100 <abd(a)cdt.org> Washington, DC 20006 PGP key via finger ---------------- THE WHITE HOUSE Office of the Vice President FOR IMMEDIATE RELEASE CONTACT: 456-7035 TUESDAY, October 1, 1996 STATEMENT OF THE VICE PRESIDENT President Clinton and I are committed to promoting the growth of electronic commerce and robust, secure communications worldwide while protecting the public safety and national security. To that end, this Administration is consulting with Congress, the information technology industry, state and local law enforcement officials, and foreign governments on a major initiative to liberalize export controls for commercial encryption products. The Administration's initiative will make it easier for Americans to use stronger encryption products -- whether at home or abroad -- to protect their privacy, intellectual property and other valuable information. It will support the growth of electronic commerce, increase the security of the global information, and sustain the economic competitiveness of U.S. encryption product manufacturers during the transition to a key management infrastructure. Under this initiative, the export of 56-bit key length encryption products will be permitted under a general license after one-time review, and contingent upon industry commitments to build and market future products that support key recovery. This policy will apply to hardware and software products. The relaxation of controls will last up to two years. The Administration's initiative recognizes that an industry-led technology strategy will expedite market acceptance of key recovery, and that the ultimate solution must be market-driven. Exporters of 56-bit DES or equivalent encryption products would make commitments to develop and sell products that support the key recovery system that I announced in July. That vision presumes that a trusted party (in some cases internal to the user's organization) would recover the user's confidentiality key for the user or for law enforcement officials acting under proper authority. Access to keys would be provided in accordance with destination country policies and bilateral understandings. No key length limits or algorithm restrictions will apply to exported key recovery products. Domestic use of key recovery will be voluntary, and any American will remain free to use any encryption system domestically. The temporary relaxation of controls is one part of a broader encryption policy initiative designed to promote electronic information security and public safety. For export control purposes, commercial encryption products will no longer be treated as munitions. After consultation with Congress, jurisdiction for commercial encryption controls will be transferred from the State Department to the Commerce Department. The Administration also will seek legislation to facilitate commercial key recovery, including providing penalties for improper release of keys, and protecting key recovery agents against liability when they properly release a key. As I announced in July, the Administration will continue to expand the purchase of key recovery products for U.S. government use, promote key recovery arrangements in bilateral and multilateral discussions, develop federal cryptographic and key recovery standards, and stimulate the development of innovative key recovery products and services. Under the relaxation, six-month general export licenses will be issued after one-time review, contingent on commitments from exporters to explicit benchmarks and milestones for developing and incorporating key recovery features into their products and services, and for building the supporting infrastructure internationally. Initial approval will be contingent on firms providing a plan for implementing key recovery. The plan will explain in detail the steps the applicant will take to develop, produce, distribute, and/or market encryption products with key recovery features. The specific commitments will depend on the applicant's line of business. The government will renew the licenses for additional six-month periods if milestones are met. Two years from now, the export of 56-bit products that do not support key recovery will no longer be permitted. Currently exportable 40-bit mass market software products will continue to be exportable. We will continue to support financial institutions in their efforts to assure the recovery of encrypted financial information. Longer key lengths will continue to be approved for products dedicated to the support of financial applications. The Administration will use a formal mechanism to provide industry, users, state and local law enforcement, and other private sector representatives with the opportunity to advise on the future of key recovery. Topics will include: evaluating the developing global key recovery architecture assessing lessons-learned from key recovery implementation advising on technical confidence issues vis-a-vis access to and release of keys addressing interoperability and standards issues identifying other technical, policy, and program issues for governmental action. The Administration's initiative is broadly consistent with the recent recommendations of the National Research Council. It also addresses many of the objectives of pending Congressional legislation.

1 0

Re: How might new GAK be enforced?
by Rick Smith 17 Dec '03

17 Dec '03

Tim May asks: : Any other ideas on how the government plans to enforce GAK, to make GAK the : overwhelmingly-preferred solution? The problem seems somewhat analogous to the software copy protection problem and maybe the enfocement will be similar: make "examples" of a few high profile offenders who are exchanging blatantly un-GAKed traffic with foreigners. This assumes they fine tune the law to make such behavior illegal without having to prove you yourself exported the stuff to them. Wonder what the Supremes will say to that. But that's not the end of the story. If there is lots of GAK encrypted traffic flowing about, then encrypted traffic in general is no longer noteworthy. So as long as your traffic looks like GAK, you won't be hassled until they try to read your traffic. So it's possible that products will appear that use pseudo-GAK protocols -- they look just like their GAKed cousins but the GAK fields contain plausiable garbage instead of keys. It could even turn out to be a vendor "quality control" thing -- oops, the GAK was supposed to work but... You couldn't do that with Clipper (except via Matt Blaze's brute forcing of the LEAF checksum) because the crypto wouldn't decrypt a packet with an invalid LEAF checksum. Since it was a sealed hardware module, implementers had no choice but to play by those rules. There's no such enforcable limitation on commercial software implementations. Rick.

1 0

new mailing list: solving spam problem
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

a new list dedicated to trying to solve the problem of spam just popped up, and may be of interest to some here-- ------- Forwarded Message Date: Mon, 30 Sep 1996 16:01:08 -0400 (EDT) From: Chris Rapier <rapier(a)psc.edu> To: ietf(a)IETF.CNRI.Reston.VA.US Subject: Anti-Spam BOF Mail List I've decided to take some initiative and set up a real mailing list for the discussion on spamming. I would like to see us take some sort of action at the next IETF and maybe get some rough ideas about what is and/or isn't possible in dealing with this problem. If you would like to join the mailing list send mail to majordomo(a)psc.edu with subscribe spam-list [prefered address] in the body. If you have any problems subscribing let me know. Also, this mailing list superceeds the one I set up and announced around an hour ago. Anyone who has alrteady sent requests to that mailing list will be added to this new one. Chris Rapier Senior Sysadmin/Cabin Boy 2nd Class Pittsburgh Supercomputing Center MI 230B ------- End of Forwarded Message

2 2

White House crypto proposal -- too little, too late
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 1 Oct 1996 14:56:21 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: White House crypto proposal -- too little, too late I just got back from the White House, where Gore's office held a roundtable plugging the administration's long-awaited and already widely-derided Return of Clipper proposal. Gore announced that jurisdiction over crypto exports would move to the Commerce Dept; that the export embargo on 56-bit DES would be lifted in part for two years only; that to be approved for export firms must submit a detailed proposal describing how they will move towards key escrow; that the new regulations would go into effect on January 1. The true problem with this plan is that 56-bit DES is woefully inadequate. But much of the media coverage I've read of the plan doesn't even mention that. Take Elizabeth Corcoran's article, which ran above the fold on the front page in today's Washington Post. (It's what almost certainly prompted Gore's office to move the announcement to today rather than hold it later this week.) The thrust of the article is that the administration's new proposal balances the needs of privacy, business, and law enforcement. But it doesn't. The Feds, foreign governments, and determined attackers can crack anything encrypted with 56-bit DES -- the strongest crypto that can be exported under the plan. This vital fact appears nowhere in the Post article. That's why Bruce Schneier, author of Applied Cryptography, recommends against using DES in favor of a more secure algorithm. According to Schneier: "A brute-force DES-cracking machine [designed by Michael Wiener] that can find a key in an average of 3.5 hours cost only $1 million in 1993." More recently, in January 1996 an ad hoc group of renowned cryptographers including Matt Blaze, Whitfield Diffie, Ronald Rivest and Schneier, released a report going even further. They said: "To provide adequate protection against the most serious threats - well-funded commercial enterprises or government intelligence agencies - keys used to protect data today should be at least 75 bits long. To protect information adequately for the next 20 years in the face of expected advances in computing power, keys in newly-deployed systems should be at least 90 bits long." What's even more disturbing is what the administration might do next. After the roundtable broke up, I chatted with Michael Vadis, one of the assistant deputy attorneys general who oversees national security issues. He said an international consensus is forming that terrorists can use crypto; therefore crypto must be controlled. The U.S. is certainly pushing this line at the OECD talks. "But it just takes one country to decide to export strong crypto," I said. "You're missing something," said Vadis. "What?" I asked. "Unless you're talking about import restrictions." "Exactly," he said. -Declan ******* Some background: Linkname: Brock Meeks on White House plan -- 6 Sep 96 Filename: http://www.muckraker.com/muckraker/96/36/index4a.html ******** http://www.washingtonpost.com/wp-srv/WPlate/1996-10/01/041L-100196-idx.html U.S. TO EASE ENCRYPTION RESTRICTIONS Privacy Advocates Wary of Proposal For Software Exports By Elizabeth Corcoran Washington Post Staff Writer Tuesday, October 1 1996; Page A01 The Washington Post The Clinton administration is cutting off an emotional four-year-old debate with the computer industry over the export of information-scrambling technology with a plan that it says will help U.S. companies boost sales overseas and still allow law enforcement agencies to unscramble messages, officials said yesterday. President Clinton has decided to sign an executive order that changes the rules restricting the overseas sale of the technology, the officials said. Although the full details of the plan had yet to be revealed, privacy advocates and some industry executives contended that it would be difficult to put into practice. Under current rules, companies can sell only relatively easy-to-crack scrambling technology. Under the plan, they would get permission to export somewhat more sophisticated versions of the software and hardware, which prevents eavesdroppers from looking at information. The issue has caused enormous friction between the government and computer industry and privacy groups, which contend that keeping any restrictions in place will harm the protection of personal information everywhere and slow the development of on-line commerce, which relies on keeping credit card numbers and other sensitive information secure. The administration counters that it has come a long way in meeting such objections. However, last night some companies and privacy advocates were still worried that the constraints will leave U.S. companies at a disadvantage abroad and will not ensure that individuals will be able to protect their communications. The government's plan preserves what has been its unnegotiable cornerstone since the debate began in the early day of the Clinton administration -- that law enforcement officials must have the means for peeking at encrypted information when they are properly equipped with court authorization. Earlier versions of the plan tightly limited what kinds of technology could be sold abroad. They also called for makers of encryption technology to deposit "keys" with approved third parties so that law enforcement authorities could decode material. The new plan doesn't specify who would have the keys. Last night, several companies, led by International Business Machines Corp., said they have a technical plan that they believe could comply with the new rules on keys. [...] Industry officials say they ultimately want to be able to use the most sophisticated encryption technology available. "It's really critical to doing business around the world," said an IBM source. "But governments exist. It's a balancing act . . . to satisfy the needs of the governments and make sure that markets and individuals trust the integrity of what's being sent over the networks." [...]

8 7

Re: Export laws don't just affect crypto
by jim bell 17 Dec '03

17 Dec '03

At 12:32 PM 10/1/96 -0400, Perry E. Metzger wrote: > >Lucky Green writes: >> > Umm, so are you violating ITAR if you *use* these GPS-guided missiles >> >> No you aren't. A little known provision in the ITAR excempts exports >> by missile. Seriously. > >Well, not quite -- it exempts exports by space launch, but I think >thats intended for things like satelite launchings and not for things >like missile attacks against other countries... If ITAR exempts exports by missile, does that mean that we merely have to make a model rocket, put a floppy containing PGP in the payload compartment, and shoot the thing over the wall into Mexico, or into Canada? Jim Bell jimbell(a)pacifier.com

1 0

[SPAM] Timmy May has no life
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I suppose one of the reasons why Americans are so stupid is that so many of them are of English origin. How does one donate to the IRA anyway? >Comments: Authenticated sender is <paul(a)fatmans.demon.co.uk> >From: paul(a)fatmans.demon.co.uk >To: "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> >Date: Mon, 30 Sep 1996 17:40:49 +0000 >Mime-Version: 1.0 >Content-Type: text/plain; charset=US-ASCII >Content-Transfer-Encoding: 7BIT >Subject: Re: [SPAM] More "fuckhead" fan mail from Timmy "peteur" May >Priority: normal >X-Mailer: Pegasus Mail for Windows (v2.31) >Message-Id: <844193577.12916.0(a)fatmans.demon.co.uk> > > >> berserk >> Timmy May has gone . Has he been eating speed? >> bananas > >What? speak English motherfucker. > >> >> What has Timmy been smoking? > >I assume you are referring to me here, my name is Paul Bradley and >you can go fuck a kokonut dude. > >> >> ]From paul(a)fatmans.demon.co.uk Sun Sep 29 19:03:40 1996 >> >> ]Received: by bwalk.dm.com (1.65/waf) >> >> ] via UUCP; Sun, 29 Sep 96 19:14:06 EDT >> >> ] for dlv >> >> ]Received: from disperse.demon.co.uk by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via SMTP; >> >> ] id AA25790 for dlv(a)bwalk.dm.com; Sun, 29 Sep 96 19:03:40 -0400 >> >> ]Received: from post.demon.co.uk ([(null)]) by relay-2.mail.demon.net id ac16129; >> >> ] 29 Sep 96 15:59 BST >> >> ]Received: from fatmans.demon.co.uk ([158.152.120.223]) by relay-3.mail.demon.net >> >> ] id aa09441; 29 Sep 96 15:54 BST >> >> ]Received: from fatmans.demon.co.uk by fatmans.demon.co.uk with SMTP >> >> ] id AA843903697 ; Sat, 28 Sep 96 09:41:37 +0000 >> >> ]Comments: Authenticated sender is <paul(a)fatmans.demon.co.uk> >> >> ]From: paul(a)fatmans.demon.co.uk > >As you can see my sending is authenticated and the reply path is to >my host (fatmans.demon.co.uk) the message has passed through >post.demon.co.uk/disperse.demon.co.uk and on to psi.net, Tim May is >at got.net. > >> >> ]I am not Tim May, Check out the return path if you don`t believe me, >> >> ]if you still don`t here`s my PGP public key signed by the EFF, they >> >> ]don`t sign keys here and there without checking ID`s... > >>Fuckhead. > >Fraid not dude, this thread is getting distinctly boring, cut the >shit, if you have something to say say it, don`t keep spewing shit >without warning, but really it`s only to be expected from you. > > > > Datacomms Technologies web authoring and data security > Paul Bradley, Paul(a)fatmans.demon.co.uk > Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org > Http://www.cryptography.home.ml.org/ > Email for PGP public key, ID: 5BBFAEB1 > "Don`t forget to mount a scratch monkey"

1 0

Can we kill single DES?
by Peter Trei 17 Dec '03

17 Dec '03

Since it looks like the US government will be allowing the export of 56 bit espionage-enabled software, it's time to kill single DES. As some of you will recall, a while back I wondered aloud about the feasibility of brute-forcing DES on general purpose machines, ala the RC4-40 crack last year. Unlike many cypherpunks, I actually write code (:-). I took Phil Karn's DES386 as a starting point, and modified it to run effiiciently on the Pentium. The code I've written will run 14 round DES (all that is required for a key test app) at 254,000 crypts/sec on a 90 MHz Pentium. Allow about 10% overhead for key scheduling (there are some tricks to speed this up), and we're still at about 250,000 keys/sec on a 100MHz Pentium (I'm using a nominal 100 MHz Pentium as my 'unit' of cpu power). On a Pentium, it runs entirely in the L1 cache. The code will also run on a 486, but at less than half the number of crypts/sec for the same clock speed. On this type of processor, it would still take 9133 years to exhaust a 56 bit key space. On the other hand, on 20,000 processors of this power it would take less than 6 months. If the target is encrypted in a chaining mode with an unknown 8 byte IV, the time more than doubles. Clearly, this goes far beyond the number of cpus available to the members of this list (though well within the power of most governments and many corporations) The best idea I've heard for recruiting this many cpu cycles is to create a screen saver which does DES-cracking while machines are idle. Another incentive is to offer a cash prize to the person(s) who find the key. Yes, I KNOW that a hardware based cracker is a LOT more efficient, but between the up-front cost and the difficulty of design and production, it's less likely to get done. (Still if someone wants to buy me a nice FPGA board, I'll see what I can do). If you're interested in volunteering machines to do a key search, please read to the end. Questions for general discussion: 1. Is this a good idea? What will happen if DES becomes perceived as insecure? 2. What is the probability of success required to make it worth doing? 3. What would be the consequences of failure? 4. What other platforms than NT/Win95/Pentium should be considered? I could write a Unix demon version, but unless it's tailored for the cpu, a lot of efficency is lost (The aggregate number of idle cycles available for testing is the crucial number). 5. What's a good target? Ideally, we need a plaintext/ciphertext pair, encrypted in Single DES ECB mode. Preferably from a commercially available program, in which a single key is used for a great deal of traffic over a long period. I would strongly prefer, however, that the target key be a *test* key - I don't want to compromise anyone's actual security. We need a target which is both convincing and realistic. 6. What other incentives can be used to recruit machines? ------------------------------ If you're interested in volunteering cycles: RESPOND ONLY TO ME (trei(a)process.com) NOT TO THE LIST. The last thing we need is a hundred 'I'll help' messages on the list. Assume that the program will be a Win95/NT screen saver or Unix deamon. Think about how many machines you could get it to run on (maybe you can talk other people into installing it as a screen saver or background task) I have not written the screen saver yet. I will not do so unless it looks like we'lll get enough machines, so nothing is likely to happen for a couple of months at least. I need to estimate how many cpu cycles will be available: Calculate: Number of Pentiums * Hours available/week * MHz + (Number of 486's * Hours available/week * MHz * 0.30) For, Alphas, MIPS, Motorola, PowerPC etc, running UN*X, MAC, etc, just report how many cpus, their speed, and OS - I'll need help to get versions for other platfoms. 64 bit processors like the Alpha can run this stuff *fast*. Send the aggregate numbers to me. I'll also need to know how many machines are directly on the Internet and could thus query a key-space server, and how many would need some other mechanism to get keyspace and report results. If you're volunteering machines which are outside of the US/Canada, please note the fact: ITAR may be an issue here. I'll summarize to the list. Peter Trei trei(a)process.com

4 5

Press Release
by Peter D. Junger 17 Dec '03

17 Dec '03

Press Release Plaintiff Seeks Summary Judgment in Cleveland Case Challenging Licensing of ``Exports'' of Cryptographic Information Government Argues That Law Professor Cannot Challenge Regulation Requiring Him to Get Permission Before Teaching and Publishing Because He Did Not Apply for That Permission Oral Argument in Junger v. Christopher Set for Wednesday, November 20 Cleveland, Ohio, Tuesday, October 1, 1996 For Immediate Release For More Information Contact: Raymond Vasvari (216) 522-1925 Gino Scarselli (216) 291-8601 Or see URL: http://samsara.law.cwru.edu/comp_law/jvc/ Cleveland, Ohio, Oct. 1 -- Lawyers for Professor Peter D. Junger today filed a brief and a motion for summary judgment in Junger v. Christopher, the case challenging the licensing of the communication of ``cryptograhic software'' that is pending before Judge Donald C. Nugent in the Federal District Court here. Junger seeks an injunction against the enforcement of provisions of the International Traffic in Arms Regulations that require him to get the permission of the State Department's Office of Defense Trade Controls (the "ODTC") before he can communicate information about cryptographic software to foreign persons, ``whether in the United States or abroad.'' The penalty for failing to get such permission before disclosing the information can be as great as a fine of one million dollars and imprisonment for ten years. These provisions effectively prevent Junger from admitting foreign students to the course that he teaches about Computers and the Law at Case Western Reserve Law School in Cleveland, Ohio, and keep him from publishing his course materials and articles containing cryptographic software, or explaining what it does, how and where to get it, and how to use it. The challenged licensing scheme threatens the long-run viability of the United States software industry and, according to a blue-ribbon panel of the National Research Council, already costs that industry at least ``a few hundred million dollars per year ..., and all indications are that this figure will only grow in the future.'' The regulations have been extensively criticized by industry and bills to repeal or limit them are now pending in Congress. Junger's legal challenge is not based, however, on the economic damage that the ITAR's cryptographic licensing scheme imposes on the software industry and the nation's economy, but rather on the unconstitutional restraints that it imposes on anyone who wants to speak or write publically about any computer program that has, in the words of the ITAR, the ``capability of maintaining secrecy or confidentiality of information or information systems.'' Junger does not challenge the constitutionality of requiring one to get a license before exporting a physical cryptographic device: ``It isn't unconstitutional for the Office of Defense Trade Controls to damage the computer industry and our economy by requiring export licenses for cryptographic hardware, but information about cryptographic software is, as the National Research Council has pointed out, `pure knowledge that can be transported over national borders inside the heads of people or via letter.' Requiring the permission of the government before one can communicate knowledge is unconstitutional. Such a prior restraint is, in fact, the paradigmatic example of a violation of the First Amendment.'' THE GOVERNMENT ARGUES THAT PLAINTIFF MUST APPLY FOR PERMISSION TO SPEAK BEFORE HE CAN CHALLENGE THE REQUIREMENT THAT HE APPLY FOR SUCH PERMISSION In motions and briefs submitted August 21st, the government has asked the court to dismiss the lawsuit, or in the alternative, to grant the government judgment prior to trial. The government makes the initial argument that Junger lacks standing to claim that the provisions of the ITAR requiring him to get a formal license or other permission from the ODTC before he publically communicates information about cryptographic software, including the contents of the software itself, are unconstitutional. And it also argues that that claim is neither ``ripe'' nor ``colorable'', because Junger has not applied to the ODTC for such permission. Junger takes the position that as a law teacher who venerates the First Amendment it would be as improper for him to request the federal censors for permission to speak and publish as it would be for him openly violate the law. As he puts it: ``My duty is to challenge these unconstitutional regulations, not to give in to them nor to violate them in an act of civil disobedience.'' His lawyers point out in their briefs that few propositions of constitutional law are better established than the rule that a plaintiff does not have to submit to an unconstitutional restraint on speech and on the press before challenging it in court. ``Those arguments by the government are rather strange,'' says Gino J. Scarselli, one of Junger's lawyers, ``they seem to be based on their argument that cryptographic software is actually hardware because it is functional.'' And then he adds, ``Of course, that argument is also rather strange.'' THE GOVERNMENT ARGUES THAT SOME OF THE MATERIAL AT ISSUE IS EXEMPT UNDER THE ITAR The government also contends that some of the information at issue may be exempt from the ITAR's licensing requirements as technical data that is in the ``public domain'' because it is available to the public through ``fundamental research in science and engineering'' or through ``sales at newsstands and bookstores.'' ``That hardly is a defense,'' says Scarselli, ``since it is quite clear that the government will not concede that all of the information that Professor Junger wants to be able publish and discuss is in the public domain. And to make matters worse, the only way that Professor Junger can actually find out whether the government will treat particular information as being exempt from the formal licensing requirements is to apply to the ODTC for it calls a Commodity Jurisdiction Determination, which in reality is just another form of license.'' ``It is not as if I am engaged in fundamental research in science and engineering.'' Junger adds. ``What I want to publish and discuss has to do with the political and legal issues that are raised by computer technology, including, of course, cryptography. ``For just one example, since lawyers have a legal and ethical duty to protect the confidences of their clients, I am convinced that lawyers who use electronic mail or other computer technologies to communicate with their clients, or to store information supplied by their clients, are in some circumstances ethically, and perhaps even legally, required to use cryptography to maintain the confidentiality of that information. And yet I cannot publically explain to law students and lawyers--and lawyers cannot publically explain to their clients--how to obtain and use effective cryptographic software without first getting the government's permission to disclose that information. And, of course, if the cryptographic software really is effective, then there is little or no chance that the government will permit its disclosure.'' THE GOVERNMENT ARGUES THAT CRYPTOGRAPHIC SOFTWARE IS NOT PROTECTED BY THE FIRST AMENDMENT BECAUSE IT IS FUNCTIONAL There is no law in the United States that forbids or regulates the use of cryptography. Yet the government argues that the information in texts containing cryptographic software, including recipes for creating such software, can be used in a computer to preserve secrecy and confidentiality, and concludes that cryptographic software is ``conduct'' and ``functional'' and is thus not a text that is constitutionally protected as speech. Junger's lawyers, on the other hand, say that his claims do not relate to the conduct of running a cryptographic program on a computer--conduct that is not regulated by the ITAR, after all--and that he only challenges the restraints that the ITAR impose on the communication of information about how to carry on such legal conduct. ``Expressive conduct is exactly what is protected by the First Amendment,'' says Raymond Vasvari, another of Junger's lawyers. ``And if that expression were not functional, if it were not effective, there would be no need to protect it. The government's argument turns two hundred years of First Amendment jurisprudence on its head.'' ``The government's arguments about software being conduct and functional are striking examples of the sort of confusion that pervades the whole area of Computers and the Law,'' Junger says. ``Trying to clear up such confusion is my major goal in my course in Computers and the Law. In fact, when I started teaching that course in 1993, I wrote some cryptographic software to assist my students in grasping the distinction between software as a text that can be communicated, and that is protected by copyright law and the First Amendment, and software as a process that runs in a computer's central processor that can be protected by patents, but not by copyrights. If it weren't so frustrating, it would almost be funny that I cannot publish that software because of the prior restraints imposed by the defendants' interpretation of the ITAR, even though it is perfectly legal for me, or for any one else, including `foreign persons,' to actually run such software on a computer. The government's confusion is so extensive that an agent of the ODTC has actually told me that software, cryptographic software, is actually hardware.'' ``It is quite clear to me,'' Junger adds, ``that the State Department and the National Security Agency and other elements in the executive branch of the government are attempting to restrain the communication of information about cryptographic software not only abroad, but also within the United States, because they do not want us actually to be able to use cryptography to preserve the privacy of our thoughts and our communications. It is as if the government required one to get a license before explaining how to make or use an envelope, even though it did not forbid the use of envelopes themselves. After all, all that cryptographic software is is a way of making electronic envelopes.'' ORAL ARGUMENT SCHEDULED Junger v. Christopher has been placed on a fast track by Judge Nugent. On September 5 he established a briefing schedule: the plaintiff's brief was due and was filed today and the government's response is due on Friday, October 18. Oral argument is scheduled for Wednesday, November 20. Judge Nugent's decision is expected before the first of the year. BACKGROUND ON THE LITIGATION Litigation is expensive. Professor Junger and his volunteer lawyers were only able to bring the suit because of a generous gift by an anonymous donor of $5,000 that was used to create the ITAR Legal Attack Fund. Additional donations by Professor Junger and others have increased that fund to more than seven thousand dollars. Scarselli and Vasvari are lawyers in private practice in Cleveland who have dedicated much of their professional lives to the protection of First Amendment freedoms. The third lawyer on the team is Kevin O'Neill, a law professor at Cleveland State University and the former legal director of the Ohio Chapter of the American Civil Liberties Union. --30-- -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu URL: http://samsara.law.cwru.edu

1 0

SYN_not
by jya＠pipeline.com 17 Dec '03

17 Dec '03

10-1-96: "Check Point to Provide Safeguard Against TCP SYN Flooding." The new module, now available free of charge on Check Point's Web site (http://www.checkpoint.com) provides protection against this denial of service attack, which has crippled several ISPs in recent weeks. "Certicom Introduces Elliptic Curve Cryptosystem Instruction To Its Security Classroom." It has launched new information about its Elliptic Curve Cryptosystem on the Information Security Classroom section of its web site (www.certicom.ca) "IBM to herd cave-in cats for rat encryption." IBM will be joined by Digital, TIS but few others. An executive at TIS declined to comment on whether it is involved in the IBM cave-in. The company is in a quiet period before making an IPO based on government bribery. "Battle brewing over gov.crypto bribery." Last week, the DARPA announced it has awarded Trusted Information Systems, Inc. a two-year, $1.5 million contract to develop what it calls security wrappers for a Java Prototype System as well as one for the Unix operating system. ----- http://jya.com/synnot.txt (15 kb for 4) ftp://jya.com/pub/incoming/synnot.txt SYN_not

1 0

Re: Clipper III on the table
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:44 PM 10/1/96 -0400, Perry wrote: >We really have to work on cracking DES at least once -- it would >substantially reduce the wind in the Administration's sails. 56 bits + GAK does generally mean DES/GAK, though RC4/56/GAK is also possible. One "56-bit" protocol that might be allowable under the new rules is "something strong with all but 56 key bits revealed", e.g. RC4/128 with 72 bits salt revealed (like the RC4/128 with 88 bits salt revealed that Netscape uses, or 3-DES with 112 bits salt revealed), which would be substantially stronger against cracking than raw 56-bit DES. A big advantage is that it makes pre-computation of lists less useful, since two cyphertexts with the same 56-bit key might be different in the top N-56 bits of key, and the key schedules are less reusable. The 3DES version, for instance, also gains because some of the big DES hooks that let you scrounge a few bits don't work. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com America's Open Presidential Debate - Beyond Dole and Clinton! <A href="http://gate.net/~bdcollar/bbe/media.htm">Tuesday, Oct. 8th 8:00 PM EDT</a>

1 0

ITAR satellite provision
by azur＠netcom.com 17 Dec '03

17 Dec '03

Does anyone on the list have the exact ITAR reg. text relating to the exemption for space-launched crypto? -- Steve

1 0

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

American Banker: Monday, September 30, 1996 Microsoft Ups the PC Banking Ante with Money 97 By JENNIFER KINGSON BLOOM Launching a long-awaited assault on Intuit Inc. and its popular Quicken system, Microsoft Corp. today releases a new version of its Money personal financial management software, with new ways for banks to connect to it. Microsoft executives say Money 97 is easier to use than its predecessor and more widely available to banks. Banks can offer Money 97 services in various ways: through processors like Checkfree Corp., Intuit Services Corp., and Visa Interactive; or directly through Microsoft's "open financial connectivity" standard for on-line commerce. Microsoft also announced that 37 banks are offering Money 97 -- roughly the same number that today offer Quicken services -- and that at least 23 more will offer Money 97 by yearend. "We're here today with a lot of what Quicken is announcing they'll have a year from now," said Richard Bray, Money 97 product unit manager at Microsoft. "What this really means is more banks will be available through Money sooner than through Quicken." But Intuit officials said they did not feel threatened. "What they mostly did was add a few features we already had," said Matthew Glickman, Quicken group product manager. Bankers planning to offer Money 97 said Microsoft's open technology standard was a major benefit. "We will be able to provide our customers with the same service that they're used to, which is on-line, real-time balances," said Michael Papantoniou, a vice president in electronic commerce at Chase Manhattan Bank. "Microsoft Money and Quicken now have to go through Intuit Services Corp. - that's the big difference," he said. "ISC only has start-of-day balances." Bankers also praised Money 97 for giving prominence to bank brand names. Customers will see their banks' logo, Internet address, and whatever other information the bank chooses to provide. Henry Mounger, senior vice president of consumer product development at Deposit Guaranty National Bank in Jackson, Miss., said his own "road test" of Money 97 convinced him the bank should offer it. Deposit Guaranty had not previously offered Money or Quicken. "The overriding impression I had was its ease of use," Mr. Mounger said of Money 97. "I had never used Quicken or any other personal financial management software before, and I was banging out reports right and left." Mr. Mounger said the ability to offer Money 97 through Visa Interactive was also an attractive feature. "We're trying to maximize that vendor relationship," he said. "We obviously recognize the fact that Quicken is a very visible product in the marketplace, but we're not prepared at this point to go through all those operational issues to get up and connect." This month, Intuit announced the sale of its processing division to Checkfree. It also announced an alternative to Microsoft's technology specification that it dubbed OpenExchange. Mr. Bray of Microsoft said Intuit's standard is a late entry in the race. "They didn't announce anything new with OpenExchange -- what they were trying to do was slow down the market because they're a year behind," Mr. Bray said. "There's no reason for banks to wait another year, and the big banks aren't waiting," he said. "Why should they wait for an undocumented, unpublished format when there's one available today that they can work with?" Mr. Glickman at Intuit said his company's open standard does the same things as Microsoft's, "but in a much better way," offering a choice of processors plus "a broader range of connectivity." Mr. Papantoniou at Chase said he also viewed OpenExchange as a broader standard, but hoped the two specifications would converge. "That would benefit all banks," he said. Chase, like many of the larger banks, offers both Quicken and Money options for home banking. Some bankers who offer both products said they were pleased with the improvements to Money but are not taking sides in the Microsoft-Intuit rivalry. "The more they talk about each other, the more focus there will be on personal financial software, and the better for me," said S. Michael Woodward, a vice president in strategic marketing at Crestar Bank in Richmond, Va. "We don't come out and promote Quicken over Money or BankNow" -- Intuit's transaction-oriented offering with America Online. "I think both of them have done a very good job." Despite some bankers' neutrality, Money 97 is guaranteed to step up the competition for customer loyalty. "This is going to be a really interesting season for the personal finance software market," predicted Phoebe Simpson, an electronic commerce analyst at Jupiter Communications in New York. "The fact that you can download the Quicken data into Money 97 is going to be very interesting, and will ease the entrance of anyone who is looking to switch." Mr. Bray said Microsoft wanted to make switching from Quicken to Money "as easy as possible." Quicken users are being offered a $10 discount on the $34.95 retail price of Money 97, as well as the ability to instantly transfer all their existing Quicken files into Money 97. Microsoft also plans to offer all comers free 90-day trials of Money 97. Another new feature of Money 97, critical to banks and consumers, is Internet connectivity. Users will be able to connect not only to their banks but to a Web site Microsoft maintains that offers current stock quotations. Mr. Glickman of Intuit said Microsoft's previous efforts to make Money widely available had failed to dent Quicken's market share, and he predicted the same would hold for Money 97. "We've added over a million customers in the last year," Mr. Glickman said. Citing numbers compiled by PC Data of Reston, Va., Mr. Glickman said Quicken has 73% of personal financial software users, Money 23%; 4% use other types. "Microsoft has increased its market share, but it has come at the expense of the smaller players like (Meca Software's) Managing Your Money," Mr. Glickman said. Ms. Simpson of Jupiter Communications said the release of Money 97 reflected Microsoft's belief that high-function software could double as a mass market product. "Intuit sees the market splitting into transactors and trackers, and Microsoft does not buy into that, so they have worked with their product to get sort of a blend of the two," she said. "I think it's going to be a tight race." American Banker: Monday, September 30, 1996 Verifone Woos Banks with Personal ATM By JEFFREY KUTLER Verifone Inc. is claiming a breakthrough toward one of electronic banking's holy grails: an automated teller machine in the home -- or, for that matter, in the pocket. The Redwood City, Calif., company is introducing Personal ATM, a palm-size device with a smart card slot. Among other interactive capabilities, it allows value to be loaded onto the card via telephone. Accompanying Personal ATM, to be unveiled today at the American Bankers Association's bank card conference in Orlando, is Verismart, a system Verifone says will make smart cards more appealing to the banking, retailing, telecommunications, transportation, and utility industries. While Verifone is not the first to see the remote banking potential of plastic cards with built-in computer chips - for example, the Dutch company Philips makes screen telephones with smart card readers - Personal ATM may be more ready for the mass market. As purely a card reader -- lacking processing power, computer intelligence, or memory, but connectable through a phone jack -- Personal ATM is so cheap that banks ought to consider almost giving it away, said C. Lloyd Mahaffey, Verifone's vice president of global marketing. He would not discuss prices but said they are a stark contrast to the $100 or $200 that screen phone manufacturers are hoping will attract widespread acceptance, or the bare-bones $500 network computers that Oracle Corp. and others contend are the key to mainstream Internet use. "The consumer might pay $2 or $3 a month, not the $90 or $100 it takes to buy some devices that we see at technology trade shows," Mr. Mahaffey said in an interview last week. He predicted "volume deployments" of Personal ATM by mid-1997. He said the battery-powered device might be mailed out in a sturdy, compact box -- under the brand name of a bank or other provider -- along with two smart cards. The economics are such that if a defective machine arrives, and the customer calls to complain, the service representative will say, "Throw it away. We'll send a new one," said Mr. Mahaffey, architect of the Verifone consumer strategy typified by Personal ATM. In current parlance, Personal ATM is the ultimate "thin client." That means it is "intellectually challenged," Mr. Mahaffey said, relying on the smart card and on-line connections for what it needs to know. But Mr. Mahaffey said that is the key to the cost advantage through which Verifone hopes to dominate consumer automation as much as it does the point of sale terminal market, where its share is near 70%. The Verismart system is designed to embed the smart card capability in devices other than Personal ATM -- computer keyboards, telephones, television set-top boxes. Verifone has already forged alliances with manufacturers in such fields, including Keytronic, GTE, and Scientific Atlanta, as well as Mondex International and smart card maker Gemplus. At least 10 companies have signed to support Verismart, including American Express, MasterCard, Visa, and Wells Fargo Bank. Verifone says it is addressing some bankers' reluctance to commit to Mondex, Visa Cash, or a competing scheme: Verismart is "device independent," meaning a bank is not forever locked in to any smart card decision. News Release (VeriFone): Monday, September 30, 1996 VeriFone to Develop Smart Card Applications and Services VeriFone, Inc. (NYSE:VFI), the leading global provider of secure payment solutions, today announced plans to develop the VeriSmart System -- the first end-to-end system for creating smart card applications and services. VeriSmart pilot programs are planned with leading companies throughout the world, including American Express, GTE, MasterCard, Mondex International, Ltd., NIPSCO Industries, Inc., Sparbanken Bank (BABS), Sears Payment Systems (SPS), and Wells Fargo. The VeriSmart System will provide the applications, integration services and marketing support required to enable these companies to offer expanded smart card products and other services to their customers. The VeriSmart System was announced concurrently today at the ABA Bank Card Conference with a separate announcement from VeriFone and other leading companies for plans to develop personal devices and information appliances that will bring low-cost smart card capability directly to consumers. VeriSmart, a flexible, open, smart card system, is the first solution that will enable multiple consumer appliances, such as a personal/home ATM device, smart phone, personal computer or set-top-box, to access a variety of smart card applications, and seamlessly integrate with back end payment and transaction systems worldwide. VeriSmart, which will reside on various companies' host systems, is being designed to allow a customer to access and interact with their accounts to retrieve electronic cash, monitor services, pay bills, receive healthcare information, get updates on frequent flyer awards and other personal services. "VeriFone's Consumer Systems Division is developing the first realistic solution that is expected to stimulate the emerging smart card market, bringing consumers and providers together through robust, interactive products and services for everyday banking, health insurance, and utility transactions," said C. Lloyd Mahaffey, vice president of global marketing for VeriFone. "The wide range of industries that are looking to implement VeriSmart products and services indicates the enormous potential for smart card services we can expect in the future." The flexible design of the VeriSmart server and applications software, installed on the provider's host computer, will readily support additional applications and upgrades as they are developed. VeriSmart applications can allow these providers to offer new and unique products to broaden their customer base through value added smart card services. "The real value of smart card technology will not be realized until consumers have a compelling reason to change the way they conduct business today," said Thomas Kilcoyne, general manager, VeriFone's Consumer Systems Division. "The security, convenience and access to personal information they'll have through their telephone, home ATM, PC or television can dramatically enhance their relationships with providers who offer these services." Eight Major Companies Prepare Solutions VeriFone's Consumer Systems Division will begin working with leading providers to develop and deploy enhanced consumer smart card-based products and services. "We are enthusiastic about exploring business solutions that incorporate the VeriSmart System," said David L. Boyles, senior vice president of New Business Ventures for American Express' Stored Value Group. "These types of products have tremendous applicability to some of the products we will be launching in the future. VeriSmart's open system architecture is exactly the kind of technology that American Express is committed to applying to its global infrastructure, so that we may ensure maximum customer satisfaction and worldwide usability." Sparbanken Bank (BABS), is Sweden's largest savings bank. "The VeriSmart System will allow us to offer our customers a wide range of stored value card applications. We look forward to working with VeriFone on this exciting new program," said Jan Olof Brunila, vice president, Development, for Sparbanken. "GTE is the largest publicly held telecommunications company in the world with revenues of 20 billion dollars in 1995. It is also the largest U.S. based local telephone company with wire line and wireless operations covering about one third of these countries population. "GTE is interested in further exploring this exciting new technology," said Jim Palma, senior manager, New Product Markets. "MasterCard is eager to test this product and offer an early pilot to our members when it is ready," said Steve Mott, senior vice president, Electronic Commerce/New Ventures for MasterCard International. "We believe VeriSmart targets important emerging needs in the electronic commerce market." Mondex International Ltd., the leading chip-card based electronic cash payment system being introduced by institutions around the world, offers consumers a secure and convenient alternative to cash. "This announcement marks another important step forward for Mondex as a global electronic cash system. We are working with VeriFone and others to deliver e-commerce applications that will bring real benefits of convenience and security to consumers worldwide", said Mike Young, head of New Product Development, Mondex International Ltd. "We look forward to VeriSmart providing yet another secure path for offering Mondex transactions over the Internet." NIPSCO Industries, Inc., an energy-based holding company located in northern Indiana, intends to initially offer the VeriSmart system to the broad base of customers of its electric and natural gas utilities. "Through our strong customer relationships, we can help the VeriFone alliance build a two-way gateway to the home," said Barbara D. Haas, group vice president of Marketing and Communications. "We plan to concentrate our efforts on developing ways to use this two-way technology to read meters, automatically report electrical outages and supply energy usage information to the customer." SPS Payment Systems, Inc., is a provider of technology-based outsourcing services. Principal businesses include: point of sale credit card transaction processing; administration of consumer private label credit card programs; and customized operating services such as help desk support and customer service. "SPS Payment Systems has worked with VeriFone and utilized their hardware to meet the retail point-of-sale needs of many of the clients for whom we process credit and debit transactions. Their new VeriSmart System will represent an opportunity for us to provide electronic payment processing through a variety of consumer appliances such as personal/home ATM devices, smart phones or PCs," said Patrick A. Albright, director of Industry Marketing, for SPS Payment Systems. Wells Fargo, a leading force behind the development of Mondex in the United States, supports VeriFone's new technology. "The VeriSmart System is ground-breaking technology that will significantly reduce the cost and complexity of offering multiple applications to our Mondex customers," said Janet Hartung-Crane, senior vice president of Wells Fargo's Electronic Payments Division. Wells Fargo & Co., the 9th largest bank holding company in the United States, has assets of $108.6 billion following completion of its merger with First Interstate. News Release (CyberCash): Monday, September 30, 1996 CyberCash Launches CyberCoin Service Individuals can finally make small purchases on the Internet securely and instantaneously with CyberCash's revolutionary new electronic coin service. CyberCash, Inc. (Nasdaq: CYCH), today announced CyberCoin(TM), an innovative payment service that enables cash transactions, typically from $0.25 to $10.00, and can be used with funds drawn from a consumer's existing bank account. "CyberCoin fulfills a growing need for consumers to purchase lower-priced and 'impulse' items on the Internet -- especially digital goods and services that can be instantaneously downloaded to your computer, such as software, articles, research, games and music," said Bill Melton, CEO of CyberCash. "Internet merchants must offer consumers the ability to make spontaneous, small denomination payments on the Internet to take electronic commerce to the next level." CyberCoin Provides Merchants with New Opportunities "Shopping on the Internet for low-priced items will be as easy as pulling a coin out of your pocket at the store, newsstand, or video arcade," said Ray Speichert, CEO of Headgames, a Web merchant who will offer the online game Worbble, using the CyberCoin service. "With CyberCoin, players from around the world can compete against other players on the Internet on a pay-per-play basis." Until now, merchants have been unable to effectively sell low-priced, value-added products and services over the Web. CyberCoin removes this barrier, and opens up a new world of digital commerce opportunities. A broad range of soft goods and services can now be sold and delivered electronically, allowing merchants to drive incremental sales of items such as newsletters, graphic art, real-time stock quotes and virtual games. "As the premier provider of high quality financial information, Quote.COM's mission is to fulfill the sophisticated needs of serious investors," said Quote.COM President Chris Cooper. "CyberCoin will add a powerful pay-per view option for on demand purchase of financial information, giving our subscribers even greater flexibility to manage their portfolios." CyberCoin Opens Up the Internet for the Consumer Free, easy-to-use and secure, CyberCoin provides consumers with a revolutionary new way to shop online. CyberCoin can be used with any existing bank account or major credit card -- all that is needed is an Internet Wallet, which is free to consumers and can be downloaded from the CyberCash Web site at (http://www.cybercash.com) "There is undoubtedly a niche for coin payment on the Internet and CyberCash is ahead of the pack in developing a user-friendly option for small cash purchases online," said Parker Foley, Vice President and Director of Electronic Commerce, First Union National Bank. "We are pleased to be among the first to pilot this new service in 1996 and hope to offer its convenience to our Internet customers by early next year." Easy to download and install, the Internet Wallet is a password protected software program that enables encrypted transactions to move between the consumer, the merchant, and their banks. Just like an everyday wallet, the Internet Wallet offers several types of payment options and can be used with any major credit card in addition to the new CyberCoin payment service. Online Shopping Made Easy With CyberCoin CyberCoin provides the consumer with the ease and simplicity that has been missing from the Internet shopping experience. When an individual on the Web finds an item that he or she would like to purchase, the consumer simply clicks on the Coin icon next to the goods. It's that simple. The entire process takes only seconds. A complete transaction log of all purchases is kept in the Wallet. The consumer can easily, and at no cost, move money in and out of the Wallet to use the CyberCoin service. The user chooses the amount of money he or she wishes to move (in multiples of $20, up to $80), and selects whether to use funds from a bank account or credit card. Security is ensured since the money never leaves the bank-if the consumer's PC crashes, no funds are lost. Funds in the CyberCash system are FDIC-insured, giving an added measure of security. CyberCash Partners with Banks to Deliver CyberCoin Service CyberCash will work with banks to integrate the CyberCoin technology and services into the banks' Internet offerings for both their merchants and consumers. Participating banks will offer the CyberCoin service to online merchants and provide them with critical back-end processing capabilities and access to existing financial networks. Merchants will pay the banks a per-transaction fee, similar to a credit card transaction, to use the CyberCoin service. CyberCash receives a fee for each transaction from the banks. Pricing and Availability CyberCash's CyberCoin service is available now for banks, merchants and consumers. First Union, First USA Paymentech, First Data Corporation and its affiliated banks, and Michigan National Bank have already committed to offer or pilot the CyberCoin service to merchants and/or to consumers before the end of the year. Merchant server software is available immediately from CyberCash on the Windows NT, Solaris and BSDI platforms, with other platform versions available by the year-end. Consumer Internet Wallets can be downloaded for free from the CyberCash Web site at www.cybercash.com. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Can we kill single DES?
by jim bell 17 Dec '03

17 Dec '03

At 04:27 PM 10/1/96 -6, Peter Trei wrote: >Unlike many cypherpunks, I actually write code (:-). I took Phil >Karn's DES386 as a starting point, and modified it to run effiiciently >on the Pentium. The code I've written will run 14 round DES (all >that is required for a key test app) at 254,000 crypts/sec on a >90 MHz Pentium. > >Allow about 10% overhead for key scheduling (there are some tricks to >speed this up), and we're still at about 250,000 keys/sec on a 100MHz >Pentium (I'm using a nominal 100 MHz Pentium as my 'unit' of >cpu power). [snip] >On this type of processor, it would still take 9133 years to exhaust >a 56 bit key space. On the other hand, on 20,000 processors of this >power it would take less than 6 months. If the target is encrypted >in a chaining mode with an unknown 8 byte IV, the time more than >doubles. [snip] >Questions for general discussion: > >1. Is this a good idea? What will happen if DES becomes perceived > as insecure? Reluctantly, I'd have to say that I don't think this is a good idea. If anything, what this would inadvertently demonstrate is how difficult (at least, with non-dedicated hardware) it is to crack DES. The resulting number will be misleading if it doesn't represent the real danger to encryption users. I contend that a misleading estimate is actually worse than none at all, because it is a number which can be misused. They can say, "Hey, these guys had to apply $10-20 million dollars worth of computer equipment for a full year just to get the contents of a SINGLE MESSAGE!" The real danger is, indeed, a dedicated system, because it would presumably be the way a "real opponent" would do it. First, my assumptions: I assume that it would be generally straighforward to build a cracking chip that tries 10 million keys per second, with a great deal of internal parallelism and pipelining. This is a factor of 40 higher than the number you quoted above for a 100 MHz Pentium. Further, I assume that at least 10 of these chips could be installed on a single card in a PC, monitored by a program running on that PC. Thus, it would take 9133 years/400, or 23 years, for a single one of these modules to try all keys. With "only" 100 of these units, a crack would take about 3 months max, 1.5 months on the average. Now, THAT sounds like a real threat! It would be a far more effective demonstration of the weakness of DES. Compared to this, the alternative, say an average of a crack in a year with 4500 machines, is practically meaningless. An even more ominous configuration would involve perhaps 50 chips per full-length board, seven boards installed in a stripped-down PC, which would produce a crack in 4 months average with one system alone. So how would all this be done? First, write a serious proposal for the project and circulate it among companies with fab capacity. How about finding a custom, semi-custom, or other semiconductor manufacturer who would be willing to do the fab in exchange for the publicity, or a deep discount. It might be particularly "relevant" if that company had an interest in seeing DES discredited, possibly because it was going to be building an encryption chip with greater security. (NTT? and their new encryption chip?) Likewise, find a politically-sympathetic designer with access to IC layout software, etc. The way I see it, there has to be a huge amount of unused 0.5-0.7 micron IC capacity around the world. Remember, we're only talking about a few hundred wafers. And for example, as I recall, I've seen a number of ads over the years for a company called "Orbit Semiconductor," which builds small-volume IC's by putting a number of different designs on a single wafer. The number of die per wafer is, more or less, based on the volume needed for that particular chip. They do a new fab run fairly regularly, to accomodate designs with fast turnaround. Presumably, they occasionally would like to do a run quickly without waiting for the wafer to "fill up" with new designs. Anyway, the way I see it, you're probably going to burn up over a million dollars worth of ELECTRICITY alone on a single crack with Pentiums. Why not get whoever is doing these cracks to donate 1/10th of this value to finance the portion of this project which cannot be "finagled"? Maybe Microsoft would be willing to help? After all, it is THEY who are going to be limited to DES-strength exports if things continue as they've been going. How about Intel? Jim Bell jimbell(a)pacifier.com

2 1