December 2003 - cypherpunks-legacy

HP GAK Proposal
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

http://www.dmo.hp.com/gsy/security/icf/main.html is a proposal by HP; don't know if it's the same as what they announced Monday. It's the approach they talked about 6 months ago or so, hardware solution with "tamperproof" module and government policy plugins. The example they show pictures of is a PCM-CIA card with little tabs you can plugin with US, UK, and some other flag on them, which would let your card do US, UK, and other flavors of GAK. It's nice to see an announcement the same week for strong-crypto plugins for Netscape, developed in Israel..... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

1 0

Re: HP announcing some International Cryptography stuff on Monday
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:44 PM 11/17/96 -0800, Lucky Green wrote: >I have a hard time believing that Netscape caved. As I wrote in July, HP >was working on selling our children's birthright to obtain an export >license for their product. But Netscape participating in this just >doesn't sound right. I agree about Netscape. IMHO they started with their hearts in the right place, but with a naive lack of experience in real-world security. Since their hearts are in the right place, and they have good people, they have improved a LOT in the last year. >> Since I am inherently optimistic, one ray of light may be that the San Jose >> Mercury News was mentioning the ability to export the system, and then when >> the necessary licenses (US and foreign) were obtained, turn on the >> encryption. I guess from this that the encryption is in hardware. Now, >> software/hardware interfaces are usually fairly simple, so what we have >> here is a software system with a crypto hook. > >One possibility is that all crypto is done in hardware. The recent >announcements by many hardware manufacturers that smartcard readers will >be included in all their products (MS will put them into their keyboards) >might get the necessary infrastructure deployed. I was assuming that you would interface software crypto where the hardware crypto goes. The best way to hack this will depend on the specific implementation. (At the same time you are gronking* the software calls to the hardware, you can gronk the signature checking code.) * gronk v.t. To hit over the head with a club. From Johnny Hart's cartoon, B.C. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

2 1

Re: It is getting easier
by Murray Hayes 17 Dec '03

17 Dec '03

On Fri, 15 Nov 1996 13:02:10 -0800, Bill Frantz wrote: >At 11:25 PM 11/14/96 -0800, Lucky Green wrote: >>If I remember correctly, some of the newer transponders used on >>commercial aircraft actually transmit GPS data back to the controller in >>real time. I wonder how long it will be before the FAA will include such >>information in their database. > >I don't think new transponders make much difference. The old ones heighten >the radar image of the airplane which gives an accurate 2D position. This >position is automatically entered into the FAA computer which maintains the >ATC controller's display. In the old style, altitude is determined by an >altimeter on the airplane which encoded into the transponder signal. > >If newer transponders are returning GPS signals, the position may be more >accurate (but probably not unless they can decode the selective >availability signal). (OBCrypto for those who care.) > > >>"To obtain the position of any passenger flight in the US within 10 >>meters, click here." > >In either case, the Passenger Name Records for the flight are in the >airlines databases (and have been there for many years), and the airplane's >physical position is in the FAA's computer (and has been for many years). >The ability to find the current position of an airplane, or a passenger >remains dependent on the incentives and disincentives for database linking >and application development. There are no insurmountable technical >problems. The technical problems are those of getting old-technology >software to do something new. > Wouldn't it be a breach of privacy to alow anyone to know the location of a passanger? A plane maybe, but the roster of passangers is protected by the Privacy Act. just my 2 cents. mhayes(a)infomatch.com It's better for us if you don't understand It's better for me if you don't understand -Tragically Hip

1 0

Securing Electronic Mail Within HMG
by John Young 17 Dec '03

17 Dec '03

We have received from an anonymous source a document titled: "Securing Electronic Mail Within HMG, Part I, Infrastructure and Protocol." 21 March 1996. >From the Introduction: "This document is the first part of CESG's recommendations for securing electronic mail within HMG. The main objective of the recommendations is to facilitate pan-government secure inter- operability of electronic mail, by simplifying the implementation of secure electronic mail within government, ensuring secure electronic mail between departments is possible, attempting to facilitate future inter-operability with commercial users, maximising the use of commercial technology in a controlled manner, whilst allowing access to keys for data recovery or law enforcement purposes if required." Other sections describe: 2. Authentication Framework 3. Confidentiality Framework 4. Security Protocol The document refers to the Royal Holloway program for TTP critiqued by Ross Anderson and others as "EuroClipper." Perhaps those with more knowledge could make an assessment. The document consists of 13 pages of text and diagrams, with a few gaps. ----- http://jya.com/sem.htm (35 kb with 7 jpg images)

2 1

Re: Extreme Left/Right
by amp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: jimo(a)astea.com, cypherpunks(a)toad.com Date: Tue Nov 19 01:59:15 1996 > I always had trouble understanding what people meant when they used the > terms "extreme left" and "extreme right". Then, about 4 months ago, I > saw a guy define the "political spectrum" the way (he said) it used to be > defined before the definitions were corrupted (by whomever wants to > divide - and conquer - the people). It made sense to me. A spectrum > afterall, at least when we're talking about colors, starts with one type > of color and graduates to other, DIFFERENT colors. The real problem you are having is that the political 'spectrum' is not 1 dimensional (a line). If you describe it in 2 dimensions, it makes a lot more sense. The libertarians have a diagram they call the worlds smallest political quiz that describes it fairly well. It can be found at http://www.libertarian.com/wwlp/docs/awspq.html?quiz I first saw mention of a chart similar to this in the 60s. It was a way of describing beliefs politically that was put forth by Jerry Pournelle. (Who is available on the net btw.) > When I used to listen to a certain "leftist" radio station broadcasting > out of New York City, they would talk about "left-wing", communist > dictatorships and "right-wing", fascist dictatorships. A dictatorship is > a dictatorship!!! The "wing" that it comes from makes no difference!! Yup. You hit the nail on the head here. This is something that any thinking person should recognise. The basic way we are taught to understand and reference politics =makes=no=sense=. > The > way the media defines these things makes no sense; you can't have a > dictatorship on BOTH sides of a POLITICAL SPECTRUM no more than you can > have YELLOW on both sides of the COLOR SPECTRUM. Take a gander at the libertarian's chart. I think it is a more accurqte way of describing people, and in fact is similar in some ways to what you describe. A philosophy is charted based on how one views personal and property rights. amp === amp(a)pobox.com Earth First! We'll strip mine the other planets later! === -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMpFo01UbR1RWr40pAQG9Xwf/YN1d9WYNjX4NG9J2O5w78+c1XWPXVVII b8vN9UmfsaG4fXvo+1RY2nwCm20riAQ+4KPpzANSMI5T7LePRuHHR6NcHIDbVnNv zb7mlxfsvgpUR+cvNDWOsi2gkJoxhJhBn9x3gvsdGKSz2fTUA+5LUgVIrkZjicll qro7d3omrf4OetDmkehYK1YeAJg3bv1yGj5HMxaMrT8RBzU625goyxz8MBc0PlkL NrXz7uUdFd1AAElmqenkRp2jjSiZ3dQkenOuaN8T8eV5hAAdnUKLQd36ffBclqKj D4ggCz27CCvTFtC/wFXFbKOhHXqARk06o4ELJBcVO/Ka8FBVi5+C4Q== =suQe -----END PGP SIGNATURE-----

1 0

"Meeks Unfiltered" on ISP-TV Wednesday nights
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: "Meeks Unfiltered" *** Wednesday, Nov. 20 *** *** 8:00 PM ET *** Brock N. Meeks, publisher of the 800,000 subscriber CyberWire Dispatch electronic news service, will bring his crusading style into real-time Internet video with "Meeks Unfiltered." The live uncensored hour-long show, produced and distributed through ISP-TV, will explore cyberspace and cyberpolitics Wednesdays at 8 PM Eastern Time. *** If you missed last week's show with Brock and Declan McCullagh, you can listen to a RealAudio version at: http://www.digex.net/isptv/meeks.html *** "Meeks Unfiltered" can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.247.33, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html See URL http://www.digex.net/isptv for more information about the ISP-TV Network To obtain Enhanced CU-SeeMe software, go to: http://goliath.wpine.com/cudownload.htm

1 0

Exposing GAK / Clipper III
by Tim Scanlon 17 Dec '03

17 Dec '03

(this is my preliminary .02 cents on a part of this so far) I've been giving the "how to deal with this" question some thought, as it seems the government strategy is to chip away at our right to privacy via extorting compromise and any other method they can come up with. It occurs to me that one of the things that has been going on, is that the Government (US) in it's discussion of crypto and what it will and won't allow, has been playing on the nature of the beast somewhat. In that many of the most tradtional uses of crypto are to keep the conversations of governments private, there is a neccesary tradition of quiet and secrecy that goes on about it. It appears to me that this aspect of "quiet" discussion has carried over into the discussions with the private sector over it. Well, the problem I see with that is that it makes little to no sense. There is no reason for it. In many, many other sectors of the government, with the defense industry perhaps being the most leading one, private entities of all sorts, and particularly corporations, go to a serious effort to openly lobby their positions as well as what they want PUBLICLY to the government. The recent spam of TV ads in the DC area by Lockheed Martin corp. is a very good example of this type of effort. My point being, what sorts of things the government is asking of industry should be far more openly disputed and discussed, and lobbied than they are. Crypto is not the black art, nor is it that-which-has-no name and should you say it you'll be struck by lightning type of thing that certain gov entities treat it as, it's a frakin tool to ensure privacy, and that's all. Granted, it's one hell of a hard tool to work on and with, but it's still just a tool. We need more openess from industry and interested corporations. Lame press confrences that come after the fact are not in their or the public's interest. Perhaps we as the public should try to encourage that more directly from corps as well. Tim

1 0

Rogue Governments Issuing Policy Tokens
by Timothy C. May 17 Dec '03

17 Dec '03

We've touched on this issue several times, in several contexts. The problem (for GAK) of "rogue governments" is this: a government such as Libya or Panama, henceforth to be known as "Rogueitania," issues policy cards to all of its citizens, and to all those visiting Rogueitania, and perhaps through the mail to anyone who pays some fee. So, unless the U.S. actually does implement _import controls_ on such things, the willingness of Rogouitania to freely issue policy cards with no restrictions, guts the U.S. system. (The crypto community does in fact call these issuers "rogue governments." For example, in the mid-80s this was the subject of some "Crypto" papers about rogue governments (like Libya) possibly being willing to issue false passports to agents, terrorists, etc. Gee, the U.S. would have no interest in doing such a thing, either for their own agents, their own covert action squads, or their own 50,000 people given false identities in the Witness Security Program.) We raised many issues similar to this during the Clipper I, Clipper II, etc., exercises. The whole issue of why foreign governments would willingly see the NSA with intercept capabilities for their traffic was never addressed by the Administration. Nor was the issue of rogue governments. Nor many other issues. (I don't even think Denning and her Blue Ribbon Panel ever issued their final report on their weekend-long study of Clipper....events sort of made it moot.) And I don't expect substantive answers to our questions on the latest Clipper announcement for years, if ever. --Tim May "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

FW: Unsubtroll
by Butler, Scott 17 Dec '03

17 Dec '03

FOR GOD'S SAKE !!!!!!!!!!!!!!!!!! >---------- >From: piotrk@opnt.optimus.wroc.pl[SMTP:piotrk@opnt.optimus.wroc.pl] >Sent: 19 November 1996 05:04 >Subject: Unsubtroll > >>unsubtroll >

1 0

Re: Playing Cards - Caution!
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:01 PM 11/18/96 -0800, Peter Hendrickson wrote: >Here's why I now prefer dice: Dice are simple. Each die throw can be >made to be quite independent of all other die throws. Even loaded dice >may be used by throwing them repeatedly and adding the results mod the >number of sides to the die. Dice which are suspect may be studied by >repeated throwing. Non-independence can be more easily studied as >it can be assumed that a throw of the die is, at most, related only >to the previous throw and none before. I used dice to generate my ATM access code for my last bank account. (10-sided dice left over from my role-gaming days...) The looks I got from the bank personnel was pretty hillarious. They had little to know clue about guessable passwords or related issues. (You would be amazed as to how many people use birthday information and the like for ATM codes.) But then again, they though that the "bank at home" software was pretty secure too... --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0