December 2003 - cypherpunks-legacy

Re: TIS + HP
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:18 AM 11/18/96 -0500, John Young wrote: >A blurb in the Wash Post today says that the HP roll-out >this morning will include TIS's "trusted third party" product. >"One essential ingredient in the equation: technology >developed by TIS. TIS is so far the only company that has >received permission to export encryption technology >overseas that exceeds the government's existing >threshold." > >Guess we'll know shortly who else in the System is to be >Trusted with Information -- other than Thirds, Fourths and >other Dots and Steves. With TIS bending over for the big GAK Monster in so many ways, it brings up a question... (A probibly off-topic one...) Does anyone know of intentional GAK-like holes put in their Firewall Toolkit? They distribute it for free and distribute source, but with their record i have little trust in the matter... (Better yet, does anyone have suggestions for Firewall code that will run under Linux or FreeBSD?) --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

BIS_sez
by John Young 17 Dec '03

17 Dec '03

11-18-96. FiTi: "Electronic money threat to central banks" A report issued today by the BIS says that innovations such as "electronic purses" or "digital cash" used over the Internet could erode central banks' income. "However, if issuance of e-money is limited to banks, the regulatory framework already in place can be extended to cover the new products, but competition and innovation might be more limited." ----- http://jya.com/bissez.txt BIS_sez

1 0

HP proposal available
by Hal Finney 17 Dec '03

17 Dec '03

HP has put up info on its crypto proposal at http://www.hp.com/go/icf. You can also try http://www.dmo.hp.com/gsy/security/icf/main.html if that URL is slow. The basic idea is what we had been speculating, their old "International Cryptography Framework" based on hardware crypto cards. It has now been given government approval, which is no big surprise since the system looks like it's been designed by fed bootlickers. The claim of other companies signing on is less impressive than it sounds. They're using Microsoft's Crypto API, and of course Microsoft would like plenty of companies to use it. Intel offers to build some hardware, which is more business for them. "Netscape and VeriFone are exploring a wide range of uses for ICF technology." That's all they say about those companies. This is hardly a commitment; Netscape and other companies generally keep abreast of everything happening in the field to keep their options open. So this is not a resounding endorsement. The one good thing about the plan is that since it is very complicated and requires specialized hardware, we probably won't see any impact from it for years. Hopefully it will be obsolete before it can be deployed. The plan itself is an NSA wet dream. Not only do you need a token from Big Brother to activate the crypto in your computer (the token can be hardware or software, but the crypto card itself apparently must be hardware), it's also necessary for any application which wants to use crypto to supply an application specific certificate to the card. This lets the law enforcement bureaucrats not only determine who gets to use crypto, but which applications get access to it. If you want to build an app which will use crypto you'll have to get permission from the authorities in order for them to give you a certificate which you can compile in to let your app run. The one thing which was not clear was how much of these rules would apply within the U.S. In fact notably missing from the press release, white paper, overviews, slides, etc. on the web site was any discussion of civil liberties impact. It certainly was not listed as one of the considerations in the design of the system. Overall, I'd say this is just HP trumpeting the unsurprising government approval of their ICF system and turning it into a press event by providing some lukewarm "endorsements" from well known companies. This system looks to me like it's got a long way to go before it becomes a widely used standard. Hal

1 0

HP announcement
by Greg Broiles 17 Dec '03

17 Dec '03

HP has info on its new crypto stuff on the web now: <http://www.hp.com/go/security> and <http://www.hp.com/go/icf>. It's apparently a crypto coprocessor embedded in a board or chip which looks for a "policy token" (which is software/data, delivered via network or smartcard) which is doled out by local "policy servers", "developed and managed in conformance with national policy". Sounds to me like they want to be able to turn off strong crypto the way they can turn off high-detail GPS during politically/militarily sensitive events. As the press release notes, "ICF is designed to run any current or future cryptographic algorithms. Algorithms for key recovery also can be used. "Keys" are strings of computer code that lock and unlock data. Key recovery is a method that allows users to unscramble encrypted data if they lose their keys. Users can decide whether to use key recovery, based on personal needs or domestic -- or foreign -- government regulations. ICF cryptographic units, which can support keys of any length, are exportable because they are disabled until a Policy Activation Token activates them again. Policy Activation Tokens can be either a downloadable software module or a smart card. Policy Activation Tokens trigger particular algorithms for specific applications, based on needs. Additionally, ICF adapts easily to current government encryption policies, new encryption algorithms and changing key-recovery schemes. Customers who use ICF-based products are offered long-term investment protection, with rapid flexibility to meet changing needs." ICF is "International Cryptography Framework". The press release includes quotes from US and French government officials indicating that the new system will meet their needs. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

4 3

Re: ?????
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Date: Sun, 17 Nov 1996 05:36:00 -0800 To: cypherpunks(a)toad.com (John Anonymous MacDonald) apparently wrote: |Dale Thorn wrote: |>people on a list are given tools to filter with and reminded on |>occasion |>how to use them? |You are the reason, you can't shut up and you have little or nothing |to say. plonk. I wish I'd said that; my fear is that Dale will take 17 messages to compose his vapid thoughts. Love you all.

2 1

Playing card cryptosystems
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Also I did hear tell that Bruce Schneier was working on a crypto > algorithm which was designed to work with playing cards, for a book > which Neal Stephenson is writing. Presumably painful to use, but > maybe good plausible deniability, all that you need is a pack of > cards. Not even that in fact, there are methods, and I can confirm they work because I can do it myself, that allow one to memorize the order of a pack of playing cards, some people can even do it with up to 8 packs, although this requires a more complicated method. So while encryption requires one to have the cards ready (about 8 good riffle shuffles will restore a high degree of randomness to a deck) you can keep the pad for short messages in your head. But one can do the same with one time pads that use other plaintexts as the pad. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

[QUADRUPLE]-- Rewards for errors in _Digital Cash_
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

I just saw the movie "Ransom" where Mel Gibson gets to be cool by doubling the reward for the capture of his son's kidnappers. In that spirit, I'm doubling my reward again. What was once a reward of $10 for information about a technical error in the book is now a reward of $40. Also, I've opened an account with Mark Twain bank so I can pay the rewards in Digicash. Or, if you prefer First Virtual, I can handle that as well. Or, if you're old fashioned and want my signature, you get the proverbial check in the mail. The details are simple. The first person to report a technical error in the book gets $40. You're also welcome to make suggestions for ways to improve the book. I may pay a reward for these, but I can't make a blanket promise. I'm reaching my deadline so this offer will only be good until the end of November, 1996. So far no one has reported any technical errors. A few have made suggestions that I've taken. I hope more will continue to offer suggestions for improving the book because they're a great help and I will reward them. Here is the ``fine print'': 1) My decisions on what constitutes an error are final. I could declare something a ``feature'', not an error. Or I could lump many errors together and label it ``one''. So if I left out a page, this could be one error, not 200+ errors in the page number on all subsequent pages. But I hope to use this power benevolently. 2) Technical errors are eligible. Errors in spelling and grammar aren't. It's just too hard to come up with a logical definition of correct grammar. Technical errors also involve some amount of judgement, but I think they are tighter. 3) My decision on who is the ``first'' person to discover an error is final. I may choose to reward two people who obviously work independently. I just want to defend against people saying, "Okay, let's mail him this simulatenously." 4) This offer may be withdrawn at any time. Check my webpage for details. 5) Copies of the book may be obtained by purchasing them from 1-800-3131277 or from your local bookstore. Peter Wayner pcw(a)access.digex.net http://www.access.digex.net/~pcw/pcwpage.html 410-433-8275

1 0

U.S. CIA employee caught spying
by Tim Scanlon 17 Dec '03

17 Dec '03

This is on the local DC news; Harold Nicholson age 46, a CIA employee was arrested for spying today at Dulles airport. He allegedly has been working for the Russians for the past 2 years. He was caught after he failed a series of polys, and bank account irregularities had been noticed, as well as suspcious travel. They got him on hidden video apperently photocopying documents that he intended to pass along. Tim

1 0

Re: The Utility of Privacy
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 6:55 AM 11/18/1996, Sandy Sandfort wrote: >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . > >C'punks, > >On Sun, 17 Nov 1996, Huge Cajones Remailer wrote: > >> >> Informally, I don't know anybody who has suffered due to a loss of >> >> privacy. >> > >> >Your circle of associations must be limited. >> >> Examples [of people who have suffered due to loss of privacy]? > >Phil Zimmermann often tells the story of a woman whose marriage >was destroyed by the revelation of a long-past indiscretion. >After her husband divorced her, she committed suicide. Deceiving your spouse is not a good reason to protect your privacy. >Any number of celebrities have been stalked, attacked and even >killed by obsessed fans who found them through public records. Unfortunately most readers of this list do not have this problem. >Every year, children and business executives are kidnapped for >ransom. The proximate cause of these kidnappings is a breach in >privacy about the whereabouts and schedules of the victim. Or this problem. >Hitler's gun registration in Germany allowed the Jews to be >disarmed. I'm sure you are aware of the ultimate consequences >of that little invasion of privacy. Not a bad example, but genocide happens rarely. Those alert enough to protect their privacy in advance might be alert enough to get out in time, anyway. Subjective utility: low. >The US Post Office co-operated in the identification and >imprisonment of people of Japanese ancestry during the second >world war. 97,000 victims over a ~100 year period. Doesn't really show up on the scope, sorry. (Plus downside bad, but few were murdered.) >The problem with having a whole lot of private information about >you floating around in public is not what damage it can do to you >now, but rather the problems it potentially could cause in the >future. Just about everyone on this list has been to university. >Not long ago, a college education was essentially a death warrant >in Cambodia. Prior to that, a degree was considered a good thing >there. People saw no reason to hid the fact that they had been >in school. Trouble is, things changed. > >And the trouble today is that things can change now, too. Think >about the things that you have publicly done or advocated. Even >if they are as legal as church on Sunday NOW, how comfortable >will you be about them if there is extreme right or left takeover >in the future? Start to get the picture? These things CAN happen. Will they happen? Odds are low. BTW, are you operating under your True Name?

4 3

Re: The Utility of Privacy
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 8:38 PM 11/17/1996, Huge Cajones Remailer wrote: >Before we complete your school assignment for you how about letting us >all know the due date and the credit value first. > >On Sat, 16 Nov 1996, Huge Cajones Remailer wrote: > >> Privacy is a hassle. Is it worth it? >> >> Which unfortunate situations does privacy prevent? What are the odds >> that they will occur? How much effort will it take to prevent these >> outcomes? As a model, use the present and future situation of a >> typical reader of this list. Insult is not enlightening. URL? Book?

1 0