December 2003 - cypherpunks-legacy

Re: Digicash question
by Duncan Frissell 17 Dec '03

17 Dec '03

W >One problem with your proposal is that at *some* point you want to be W >able to get *real* cash for your digicash - at that point you've got to W >give the bank the password, but also an account to deposit the cash W >into (or equivalent), and at that point the bank can compare it with W >the original owner of the bill. You not only have to trust them to W >not rip off the money, you have to trust them to not give away W >the information, which may be tough if the government requires it. No, they can just dump it into your VISA "cash card" to increase the balance on that account. You can then make ATM withdrawals (or POS purchases) using your cash card. VISA recently announced that they will be issuing "plastic" traveller's cheques. Offshore banks can also be involved to increase the security if you like. DCF --- WinQwk 2.0b#1165

1 0

Security of Secure Drive
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

Andrew Loewenstern commented: > No more Steve Jackson Games cases. I hope this happens. Computer > theft and unreasonable seizure is a real problem. As far as I know, a system like SecureDrive, KFS, or CFS, is really only as secure as the running machine is. Generally, when a BBS is 'seized' (forfeited? ;), it is running when the feds get there. Right now, if they have any clue (and from what I hear, the FBI has much more of a clue than the SS when it comes to this type of investigation), they usually take pictures of the setup to make sure they can put the machine back together when they get it to wherever they are taking it to. If encrypting file-systems become a problem, a disk could be developed (probably pretty easily) to retrieve the key from memory before they power it down. andrew "Touch that keyboard and die!!" It's fairly easy to provide a TSR on MSDOS systems to either block booting from the keyboard or force a memory clear on reboot. I found these examples on local BBS's: NOFBOOT.ZIP 2647 08-28-91 Version 1.0 of Padgett Peterson's NOFBOOT. NoFBoot is a small (500 byte) TSR designed to prevent inadvertant booting from a floppy disk. It will intercept warm boot requests (Ctrl-Alt-Del) and check for a floppy in drive A: before continuing. If a floppy is found in drive A, the request will be aborted with a warning message. With NoFBoot, a cold start (reset button or cycle power) will be necessary to boot from a floppy. BLK213.ZIP 17931 09-22-93 BootLock 2.13 09/06/93 BootLock allows you to lock out the use of [CTRL][ALT][DEL], [CTRL]C, and/or [CTRL][BREAK]. New version can be loaded as a Device Driver or TSR. You can also define a "user defined" key to lock out. BootLock can be unloaded and Loaded into Hi Memory. Shareware registration form and manual included. From Foley Hi-Tech Systems (ASP). (Files: 6 Newest: 09-06-93 Oldest: 03-05-92) NOCADEL.ZIP 24234 07-07-93 No Boot on control-alt-delete. Simple util helps disable key boot sequence. Source included. (Files: 6 Newest: 02-07-93 Oldest: 02-06-93) The BBS program should also be patched to re-boot instead of returning to MSDOS on exit, and should not provide a DOS Shell. If the FBI agent is allowed access to an MSDOS command line, he can run a program which will "fish" out the Secure Drive encryption key from memory. Note that the pass phrase cannot be reconstructed from the key in memory and its crypto difficult to reconstruct -any- pass phrase which would duplicate the key (MD5 is a 1-way function). But it would be easy to construct an alternate to LOGIN which would insert the key into SECTSR directly using hex input. So it would be a good security practice to provide for an "emergency" power-off in event of a "surprise" raid. A foot switch is good for situations when the operator is present. This can be activated while one's hands are in the air. Turning off power upon activation of a burglar alarm is a good solution for unattended situations. -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

digicash
by bdolan 17 Dec '03

17 Dec '03

TO: >internet: cypherpunks(a)toad.com Re. responses to my digicash proposal: * The bank system (& feds) will know the original and ultimate recipients. True, but they can (& do sometimes) track this with the green pieces of paper we use now. With the system I propose, "they" cannot know anything about all the (potentially many) transactions in between the original and ultimate recipients. * Example about Alice getting digicash, paying Bob who pays Carol. Alice then "respends" the digicash password elsewhere before Carol can deposit it. That's why each non-trusting recipient calls the bank to verify that the password is still valid. The non-trusting recipient then anonymously receives a new password representing a claim on the money, preventing respending by a prior link in the chain. Note that, if the payee *trusts* the payor, he can silently accept and pass on ("spend") the claim password to another person - but he does so at his own risk. * Concerns that Escobar, Jr. could create a digi-bill, spend it, and the feds might come claim the money from the ultimate recipient. Escobar would want to use digi-bills already in circulation. That way no one could show they came from him. Of course the government still could say that the original recipient of the bill was a bad fellow and the ultimate recipient (or intermediate posessor) should surrender the money. Having the original and ultimate accounts in banks somewhere other than the U.S. would help. Having a non-fascist government would help, too. * bank employee honesty problems I don't see that this is more or less of a problem here than elsewhere. bdolan personal responses to bdolan(a)well.sf.ca.us, please

1 0

A Study of National Cryptography Policy
by Herb Lin 17 Dec '03

17 Dec '03

Please forward this message to any individual or mailing list that you believe should receive it. If you have seen it already, our apologies. Many thanks.. ********************* As part of the Defense Authorization Bill for FY 1994, the U.S. Congress has asked the Computer Science and Telecommunications Board (CSTB) of the National Research Council (NRC) to undertake a study of national policy with respect to the use and regulation of cryptography. The report of the study committee is due two years after all necessary security clearances have been processed, probably sometime summer 1996, and is subject to NRC review procedures. The legislation states that 120 days after the day on which the report is submitted to the Secretary of Defense, the Secretary shall submit the report to the Committees on Armed Services, Intelligence, Commerce, and the Judiciary of the Senate and House of Representatives in unclassified form, with classified annexes as necessary. This study is expected to address the appropriate balance in cryptography policy among various national interests (e.g., U.S. economic competitiveness (especially with respect to export controls), national security, law enforcement, and the protection of the privacy rights of individuals), and the strength of various cryptographic technologies known today and anticipated in the future that are relevant for commercial purposes. The federal process through which national cryptography policy has been formulated is also expected to be a topic of consideration, and, if appropriate, the project will address recommendations for improving the formulation of national cryptographic policy in the future. This project, like other NRC projects, will depend heavily on input from industry, academia, and other communities in the concerned public. Apart from the study committee (described below), briefings and consultations from interested parties will be arranged and others will be involved as anonymous peer reviewers. It is expected that the study committee will be a high-level group that will command credibility and respect across the range of government, academic, commercial, and private interests. The committee will include members with expertise in areas such as: - relevant computer and communications technology; - cryptographic technologies and cryptanalysis; - foreign, national security, and intelligence affairs; - law enforcement; - commercial interests; and - privacy and consumer interests. All committee members (and associated staff) will have to be cleared at the "SI/TK" level; provisions have been made to expedite the processing of security clearances for those who do not currently have them. Committee members will be chosen for their stature, expertise, and seniority in their fields; their willingness to listen and consider fairly other points of view; and their ability to contribute to the formulation of consensus positions. The committee as a whole will be chosen to reflect the range of judgment and opinion on the subject under consideration. The detailed composition of the committee has not yet been decided; suggestions for committee members are sought from the community at large. Note that NRC rules regarding conflict of interest forbid the selection as committee members of individuals that have substantial personal financial interests that might be significantly affected by the outcome of the study. Please forward suggestions for people to participate in this project to CSTB(a)NAS.EDU by DECEMBER 17, 1993; please include their institutional affiliations, their field(s) of expertise, a note describing how the criteria described above apply to them, and a way to contact them. For our administrative convenience, please put in the "SUBJECT:" field of your message the words "crypto person". Finally, some people have expressed concern about the fact that the project will involve consideration of classified material. Arguments can and have been made on both sides of this point, but in any event this particular ground rule was established by the U.S. Congress, not by the CSTB. Whether one agrees or disagrees with the asserted need for classification, the task at hand is to do the best possible job given this constraint. On the National Research Council The National Research Council (NRC) is the operating arm of the Academy complex, which includes the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine. The NRC is a source of impartial and independent advice to the federal government and other policy makers that is able to bring to bear the best scientific and technical talent in the nation to answer questions of national significance. In addition, it often acts as a neutral party in convening meetings among multiple stakeholders on any given issue, thereby facilitating the generation of consensus on controversial issues. The Computer Science and Telecommunications Board (CSTB) of the NRC considers technical and policy issues pertaining to computer science, telecommunications, and associated technologies. CSTB monitors the health of the computer science, computing technology, and telecommunications fields, including attention as appropriate to the issues of human resources and information infrastructure and initiates studies involving computer science, computing technology, and telecommunications as critical resources and sources of national economic strength. A list of CSTB publications is available on request.

1 0

Re: digicash
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

The point is not that B. Dolan's proposed cash is bad, it is that better systems exist. Chaum's blinded c{sh is simiXoar to Dolan's proposal, but with the added feature that the "passwords" that~r authorize access to the bank account can be altered by the users so that the bank does not recognize them later, while still allowing the bank to verify that the "passwords" are valid. This eliminates the trackability allowed by Dolan's proposal. (Sorry about the line noise!{ Hal

1 0

Re: Anarchy Gone Awry (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

This post is a perfect example why the two lists should be kept seperate and not merged. This sounds to me like it belongs on alt.politics.data- highway. -uni- (dark)

2 1

ANNOUNCEMENT: Markey Bill (HR3636) Available Online from EFF
by Stanton McCandlish 17 Dec '03

17 Dec '03

HR3636, The Markey Bill, is now available online at the Electronic Frontier Foundation's ftp archive. FTP to ftp.eff.org, and get the text file ~pub/eff/legislation/hr3636 (aka ~pub/eff/legislation/markey.bil). ****** Info on the bill ****** On Monday, November 22, 1993, EFF applauded House Telecommunications and Finance Subcommittee Chairman Edward Markey (D-Mass.), Minority Chairman Jack Fields (R-Tex.), and other cosponsors for introducing the "National Communications Competition and Information Infrastructure Act of 1993." The Markey/Fields legislation, which incorporates EFF's Open Platform philosophy, is built on three concepts: open platform services, the entry of telephone companies into video cable service, and universal service. Reacting to the open platform provisions, Mitchell Kapor, EFF Board Chairman, stated: "The sponsors of this bill are to be commended for proposing legislation that incorporates a truly democratic vision of the emerging data highway. Open platform service can end channel scarcity once and for all and make it possible for any information provider to offer voice, data, and video services on the data highway. Every citizen will be able to access a true diversity of information and programming." EFF Executive Director Jerry Berman added that "we believe public interest and nonprofit groups, as well as computer and communications industry leaders will work very hard for the open platform provisions. Our goal is to keep them in the bill and make them even stronger before its enactment." AN EFF ANALYSIS OF THE IMPACT OF THE BILL ON PUBLIC INTEREST GOALS OF UNIVERSAL SERVICE, COMMON CARRIAGE, AND CONSUMER EQUITY WILL BE RELEASED AS SOON AS IT IS COMPLETED. For an initial brief analysis (previously posted to comp.org.eff.talk and elsewhere) see ftp.eff.org, ~pub/eff/legislation/announce.mky See also ftp.eff.org or gopher.eff.org, ~pub/eff/papers/op2.0 and ~pub/eff/papers/open-platform* for more information on EFF's Open Platform initiative. See ~pub/eff/legislation/markey.bil for the full text of the Markey Bill.

1 0

on initial rejection of claims of RSA patent
by henry strickland 17 Dec '03

17 Dec '03

Diffie, via "L.": # No. But after all, the RSA patent was filed from MIT by people # (R, S, and A) that I didn't know well till much later. There may have # been some hankey pankey I didn't know about, but I certainly don't # recall the New York Times article you refer to. The statement that # ``They just got the application back rejected.'' Doesn't sound right # to me. I presume that the Patent Office has to state why an # application is returned. It's decisions, after all, are a constant All four of the PKP patents mentioned in RFC1423, Cryptographic Apparatus and Method ("Diffie-Hellman")............................... No. 4,200,770 Public Key Cryptographic Apparatus and Method ("Hellman-Merkle").................... No. 4,218,582 Cryptographic Communications System and Method ("RSA")................................... No. 4,405,829 Exponential Cryptographic Apparatus and Method ("Hellman-Pohlig").................... No. 4,424,414 had all of their claims either "rejected" or "objected to" on the first pass by the patent examiner. I have been told this is not unusual. The patent examiner gave reasonable technical reasons whe he rejected them. Nothing looks fishy to me, that is part of the record. I have a copy of [almost all of] the "full wrappers" on these four patents, and am making them available to the CA cypherpunks (CA, because I live here). (They're not online, there's a lot of handwritten pages & annotations & forms that would not OCR, and it's a 6" stack of legal paper, so it's not easy for me to provide them online, sorry.) strick

1 0

NIST Meeting Dec 8-9
by Dave Banisar 17 Dec '03

17 Dec '03

NIST Meeting Dec 8-9 NIST Computer System Security and Privacy Advisory Board Meeting December 8-9, 1993 Hyatt Regency Reston 1800 President's Street Reston, VA >From 495, take Dulles Access Road (toll road) to Reston Parkway, Turn right on parkway, Hotel is on left by new town center. Draft Agenda December 8, 1993 I Welcome 9:00 Opening Remarks - Lynn McNulty 9:10 Chairman's Remarks - Dr. Willis Ware II. Unclassified Government Cryptography Activities 9:15 National Research Council Cryptographic Study Marjorie Blumenthal, NRC 9:45 GAO Report on Cryptography Policy, Harold Podell 10:15 Break 10:30 Status of NIST Cryptographic Standards Activities, Miles Smid 11:00 DSS Infrastructure Briefing, McNulty & Mitre Rep. 11:30 Key Escrow Update 12:00 Lunch III. Emerging NII Technologies 1:30 Jim Flyzik, Director, Telecommunications Management, Treasury Dept. 2:30 Organizing for the NII and GII - Bruce McConnell, OMB 3:00 NIST's Role - Jim Burrows, NIST IV Electronic Commerce 4:00 Electronic Commerce Initiative - Steve Trus 5:00 Recess December 9 V. MOSIAC 9:00 MOSIAC Briefing - DoD Program for Protection of Unclassified Data in the DMS - John Nagangast, NSA VI Common Criteria 9:45 Common Criteria Update - Dr. Stu Katzka 10:15 Break VII NIST Security Program Plan 10:30 NIST Security Plan for FY-94 - Dr. Stu Katzke 11:00 Disussion VIII Telecommunications Security 11:30 Telecommunucations Switch Vulnerability Analysis, Rick Kuhn 12:00 Lunch IX Workplace Privacy Bill 1:30 S-984 - Privacy for Consumers and Workers Act, Kristina Zahorik Legislative Assistant, Senate Employment and Productivity Subcommittee 2:00 Discussion X CSSPAB Workplan 2:30 Draft CY-1994 Workplan - Presentation and Discussion CSSPAB Working Group XI Public Participation 3:00 Public Participation XII Close 3:30 March Meeting - Agenda Ideas 3:45 Adjourn

1 0

Re: W.Diffie on RSA patent
by smb＠research.att.com 17 Dec '03

17 Dec '03

I thought this was all documented in the NYT. Does anyone have the article? Anyway, Mr.Diffie says (see below) that nothing sinister happened at the patent office regarding the RSA patent. I would like to hear of any other patents that were suppressed by the NSA hiding behind the patent office. I mean, this professor was definitely not making up a story! She gave me the NYT reference but I think I accidentally threw out the paper I wrote it on. Does anyone have the reference? I think it happened in '78. It sounds like you're talking about the Davida patent, or maybe the zero-knowledge proof patent. Here's the basic story. U.S. patent law contains a provision for ``secrecy orders''. That is, when you apply for a patent in certain sensitive areas -- and cryptography is one of them -- the application is routed to the appropriate government agencies, including NSA. If they think the invention is too good, you'll receive a notice saying that you not only can't get a patent, you're not even allowed to discuss it anymore. George Davida -- a professor -- was hit with just such an order. Eventually, it was lifted, after a lot of public protest. NSA tried claiming that the patent application proved that the issue was commercial, rather than pure free speech, but they didn't try to fight it. More recently, Shamir received a secrecy order on his zero-knowledge proof patent. This was even more insane than usual, since (a) Shamir is not a U.S. citizen, and (b) he'd already been discussing the idea at conferences world-wide. According to rumor, this order was imposed by the Army, and was lifted through NSA's intervention. I know that the Shamir story was in the NY Times, though I don't have the citation. A pointer in my files is: journal name: Notices of the American Mathematical Society journal date: Jan 88 volume/number: 35, 1 article title: Zero Knowledge and the Department of Defense author(s) name: Susan Landau page number: 5-12 but I don't have the article handy. The Davida story was probably in the Times as well; my summary of it is taken from ``Cryptology Goes Public'', by David Kahn, in ``Kahn on Codes'', 1983. The article originally appeared in the Fall 1979 issue of ``Foreign Affairs''.

1 0