December 2003 - cypherpunks-legacy

Re: Time Stamp Server (Was: Re: Another dumb question... proving dates)
by dfloyd＠runner.utsa.edu 17 Dec '03

17 Dec '03

> From grendel(a)netaxs.com Thu Jun 16 10:40 CDT 1994 > Date: Thu, 16 Jun 1994 11:38:55 -0400 (EDT) > From: Michael Handler <grendel(a)netaxs.com> > Subject: Time Stamp Server (Was: Re: Another dumb question... proving dates) > To: "Douglas R. Floyd" <dfloyd(a)runner.utsa.edu> > Cc: cypherpunks(a)toad.com > Mime-Version: 1.0 > > On Thu, 16 Jun 1994, Douglas R. Floyd wrote: > > > In the RSA FAQ, it states how one can set up a server to do time and date > > stamping of documents, but I know of no Internet service that will > > do this. > > > > Is there a way I can send a document to some agency/server and have it > > time and date stamped with their public key? > > This appeared on alt.security.pgp a while ago. The server works > quite nicely... Getting the key for the timestamp server is left as an > exercise for the reader. ;) > > ----- BEGIN INCLUDED FILE: /usr/users/grendel/timestam.ser ----- [Burp-o-rama] > ----- END INCLUDED FILE ----- > > -- > Michael Brandt Handler <grendel(a)netaxs.com> > Philadelphia, PA PGP v2.6 public key on request > Thanks for this... I could not find any information on a time stamper site. BTW: Would a timestamp like this stand up in US court assuming that the lawyers were equal in their BS ratios? (Kinda-smiley for the humor impaired ;)

1 0

Re: DES w/ variable S-boxes
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 10:32 PM 6/15/94 -0400, Rick Busdiecker wrote: > Date: Wed, 15 Jun 1994 17:32:24 -0700 > From: Ben.Goren(a)asu.edu > > Are there any implementations of DES-variants that use variable S-boxes? > >Well, if you don't use the DES S-boxes then it isn't DES :-) Well...yeah.... >Variable boxes tend to weaken DES. The DES S-boxes were chosen to >make differential cryptanalysis difficult. Random S-boxes don't tend >to have this desirable property. Perhaps I should clarify: not DES with randomly-chosen fixed S-boxes; I'm well aware that those that DES uses are the best for differential cryptanalysis. However, as Bruce Schneier points out (p. 242), *variable* S-boxes make differential cryptanalysis impossilbe, as such an adaptive plaintext attack relies on knowledge of the composition of the S-boxes. If the boxes and their contents change with both keys used and plaintext--probably with the help of a strong RNG--then the only way such an attack could work would be by first figuring out what causes the changes in the S-boxes; in that case, the attack is probably already finished, by other means. Perhaps, even, the S-boxes could change with so many chunks of text--again, variable, of course. Most, if not all, of the actual S-box designs used would be much weaker than the original design of DES for differential cryptanalysis. However, each different plaintext (and key) would use different s-boxes, so that particular attack isn't possible. So, I guess part of my question should be, does this open up other attacks? Or, for that matter, am I completely wrong? And, like I said before, has this been done? >Use IDEA. Certainly, until there's something better. I'm just hoping this might be, or that I can learn more along the way. > Rick And thanks to Bill and Lyman, who also responded similarly. b& PS Hopefully, I'll learn to check the Cc: line more carefully in the future. Apologies again for the noise. b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): Protect your privacy; oppose Clipper. Voice concern over proposed Internet pricing schemes. Stamp out spamming. Finger ben(a)tux.music.asu.edu for PGP 2.3a public key.

1 0

AUTOPGP 2.1
by bmorris＠netcom.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com Anyone know a FTP site for AutoPGP 2.1? * RM 1.4 B0037 *

1 0

Electronic distribution of op-eds from the Competitive Enterprise Institute!
by Competitive Enterprise Institute 17 Dec '03

17 Dec '03

[Please distribute this as widely as you see fit. Thanks. -- Sasha Volokh] The Competitive Enterprise Institute is pleased to announce the CEI list! Established in May, the CEI list already has over 250 subscribers. The CEI list distributes our op-ed pieces, and perhaps other items of interest. To subscribe, drop a note to: Alexander "Sasha" Volokh at cei(a)digex.com But first, a little bit about CEI: "In today's political climate of higher taxes and the expansion of government, the need for free market voices like CEI is critical to the survival of America's free enterprise system." - The Honorable Dick Armey U.S. House of Representatives Founded in March of 1984, the Competitive Enterprise Institute is committed to advancing the principles of free enterprise and limited government. The Institute is founded on the belief that free markets and individual liberty best serve the public interest by providing freedom of choice and equal opportunity. The Institute's articles on key policy issues appear regularly in major media publications such as *The Wall Street Journal*, *The Washington Post*, and *USA Today*. The Institute's analysts also appear on international and national television programs such as *The MacNeil/Lehrer News Hour*, *Good Morning America*, CNN's *Crossfire* and *Larry King Live*. CEI analysts can also be heard on numerous national and local radio shows across the country. The Institute's policy analysts concentrate on the following issue areas: ECONOMIC REGULATION We analyze the human and economic costs of government tax and regulatory policies. ENVIRONMENTAL STUDIES The Institute's work emphasizes the reinstatement of private incentive and accountability centering on enforcement of property rights and targeted liability for pollution. Environmental Education Project Production and distribution of materials that examine environmental issues based on the latest scientific and economic research. FREE MARKET LEGAL PROGRAM Launched in 1986, this program seeks to carry the battle for economic rights into the legal arena. Issues and cases are selected on the basis of their importance as policy and precedent and on the likelihood that the Institute can make a significant contribution. Some recent activities have addressed FDA reform, rent control, and Corporate Average Fuel Economy standards (CAFE). "Death by Regulation" project Aimed at shifting the policy debate toward market-based approaches to risk management. It attempts to do so not through conventional policy analysis, but by focusing on previously unrecognized victims of regulatory failure. In particular, the project demonstrates that risk management by government can often have lethal effects.

1 0

"The Virtual Hand": Free-market Internet guide
by Competitive Enterprise Institute 17 Dec '03

17 Dec '03

[Please distribute this as widely as you see fit. Thanks -- Sasha Volokh] The Competitive Enterprise Institute is pleased to announce: THE VIRTUAL HAND CEI'S FREE-MARKET GUIDE TO THE INFORMATION SUPERHIGHWAY Now, under one cover (over 50 pages!), all the Internet places of interest to free-marketeers. Do you want to find the complete electronic text of "The Wealth of Nations"? How many places can *you* list where you can discuss the words of Ayn Rand? (The Virtual Hand can name five.) Do you want to know the latest in conservative or libertarian politics, or would you rather sit around griping about gun control? All this -- and more! -- is available from the Competitive Enterprise Institute. TABLE OF CONTENTS 1. Policy chatter (mainly Republican and Libertarian politics) 2. Cultural and philosophical (Objectivism, free-market literary journals, "fan" newsgroups, electronic books) 3. Student-oriented (college groups) 4. Single-issue forums (taxes, land rights, firearms, telecommunications policy, education, health care, feminism, law, Congressional reform, kids' rights) 5. Of local interest (statewide free-market groups) 6. Internet addresses of free-market groups 7. Miscellaneous 8. Other computer systems (BBS'es) 9. Government resources (how to get White House press releases, text of legislation, Federal Register, C-SPAN schedules, etc.) To find out how you can get your very own copy of "The Virtual Hand," drop a line to Alexander "Sasha" Volokh at cei(a)digex.com.

1 0

Unofficial Excerpt from InfoSecurity News
by NetSurfer 17 Dec '03

17 Dec '03

To: Cypherpunks: The following is unofficially extracted from the Infosecurity News, May/June 1994. * Please forward this on to EFF and CPSR, * * but please strip out all info remaining to me * (I don't want to lose my subscription. Know thy enemy and all that.) Avoid Encryption Anarchy =======================Tim: like the title? -NS BY DONN B. PARKER Encryption is a powerful tool for protecting data stored in workstations, LANs and mainframe systems and in transit between systems. In fact, it is so powerful that its misuse may cause great damage to tomorrow's informa- tion owners and users. Unfortunately, this "en- cryption anarchy" may come very soon if work- station and network encrYPtion is allowed to proliferate unchecked in its present form. What is encryption anarchy and how might it happen in your organization? Here are some examples: Hidden by voice encryp- tion, an employee could leak valuable information over phone lines, without worry- ing about wire taps or call monitoring/recording. Also, Privacy-Enhanced Mail is increasing on the Internet. But its encryption-based cer- tificates protect individual end-users by shielding their activities from managers. En- cryption technologies such as these could reduce or elimi- nate management control over voice and data communi- cations with the outside world. Large amounts of worksta- tion, LAN and mainframe in- formation may be lost if it is encrypted incorrectly, if de- cryption fails or if encryption keys are lost. As a result, many users may adopt less- secure practices. These in- clude backing up copies of files in cleartext or storing encryption keys where they can be compromised. Both practices can result in more exposure of information to unauthorized parties. Corporate deception also could become easier. If false information is given to audi- tors, for example, the true data could be hidden behind an encryption barricade. In one company, an ex-execu- tive's alleged theft of trade se- crets only after the company reviewed his e-mail. The executive's actions might never have been known if he had encrypted his e-mail and kept the key. An employee could leave a company and take copies of valuable data. If no one else knows the encryption keys, the remaining en- crypted data will be lost. As international companies turn to en- cryption to protect communications with trading partners, sup- pliers, contractors and customers in different countries, it will be- come increasingly diffi- cult to manage and control the many dif- ferent algorithms and keys that will be used in the organizations' workstations, LANs and mainframe sys- tems. Countries'differ- ing import/export controls, encryption laws and restrictions on data exchange will cre- ate both operational and man agement headaches. Without centralized, en- forced encryption standards, workstations, LANs and wide- area networks will include varying products,technolo- gies and key-management ap- proaches. Today's transitory data will be encrypted in dif- ferent ways, as will critical databack-ups and archives. Years from now, however, these files could become unavailable if encryption algorithms and key changes are not carefully tracked and controlled. A matter of control. These examples reveal that encryption anarchy may occur when the people who control and use information are not accountable for it or have no jurisdiction over it, or when people who rightfully own in- formation lose control over it. Encryption anarchy may also occur through the indiscrimi- nate use of encryption without standardized key manage- ment or managerial oversight. But even the proper use of encryption could, in the future, create unan- ticipated technical problems in network settings. For example, LAN maintenance and diagnosis often requires that information be checked for authentici- ty and integrity. This is done by comparing in- formation sent with in- formation received. If ny a this is done in real time on an encrypted net- work, special testing systems and additional network encryption/de- cryption operations may be required. Similarly, LAN managers may have to install special back-up and recovery products tabdlty as LANs become in- creasingly encrypted. These could add unexpected operat- ing costs, and the additional key management may intro- duce new security exposures. How can infosecurity man- agers avoid encryption anar- chy in the coming years? First, make sure that information (whether encrypted or not) re- mains accessible to all man- agers, boards of directors, reg llators and auditors who are held accountable for it or have jurisdiction over it. No one person should possess ex- clusive encrypted access to an information asset. Encryption also should be managed using a hierarchy of override decryption keys cor- responding to information ownership and accountability in the organization. This over- ride hierarchy should extend beyond the organization-- under careful control--to any government or regulatory body overseeing the enter- prise The U.S. government's Clipper escrowed-key propos- al, although a step in that di- rection, does not go far enough in providing these hi- erarchical override capabili- ties. Encryption keys must be escrowed in business organiza- tions as well. Infosecurity managers also could avoid encryption anar- chy by enforcing related poli- cies and standards, choosing technologies with assured Iongevity and training users to handle encryption properly. When not to encrypt. In some cases, encryption may even be inadvisable. Much business information may be adequately protected with commercially available data- compression utilities, and not full-fledged encryption. Other information may be accessed so often that encryption or compression is imprac- tical due to its cost, in- convenience and processing time. If in- formation is ubiquitous, it makes no sense to protect it in one place and not in another. There also may be valid business reasons to not encrypt. A newspa- per, for example, may deliberately exchange cleartext messages with correspondents in a for- eign country, to avoid any impression that these individuals are spying or otherwise working against the country. Even if encryption is im- plemented and managed properly, infosecurity man- agers should assume that their adversaries--industrial spies, thieves, burglars and even kid- nappers and murderers-- will try to obtain information through the easiest possible route. If they encounter en- cryption, an easier route may be through inside informants, human engineering or dump- ster diving. In fact, interviews with more than 200 computer criminals reveal that the most vulnerable form of information is spoken, followed by printed/ dlsplayed, removable media, and finally information that is communicated elec- tronically or stored in computers. In the coming years, do not overlook the many such ways in which information can be compromised. Donn B. Parker is senior consultant for SRI inter- national, Menlo Park, Calif. He can be reached at Internet ad- dress dparker(a)sri.com. Also by the author: Which crypto to use? Most encryption products using the Data Encryption Standard (DES) will be acceptable for at least thc next five years. After that time, DES will be discontinued as a U.S. federal standard and will no longer have the same strong due-care status it enjoys today. This is because increasing computing speeds will make the algorithm too weak for some applications. Many claim that DES and Rivest- Shamir-Adleman (RSA) algorithms will remain acceptable indefinitely. New encryption products and technologies, however, probably will encour- age a migration to new algorithms beyond the next five years. For example, in spite of recent protests, Clipper/Skipjack, Digital Signature Algorithm and their hardware implementations will see greater acceptance, but only in the U.S. govern- ment and among government Contractors. Other methods, such as DES triple encryption, will provide alternatives in commercial settings. However, international acceptance of Clipper/Skipjack may take longer, due to various countries' import export restrictions and U.S. control of the technology's algorithm and es- crowed keys. The underlying purpose of this control is not just to facilitate court-approved wire taps, but also to discourage criminals and foreign entities from using Clipper/Skipjack technology. This control mechanism would force them to use other, less powerful, algorithms and key management. Over time, the effectiveness, change frequency and management of encryption keys probably will prove more important than the specific algorithms chosen. New encryption products that automate these activities and make them transparent to users may help strengthen encryption management, even though fhey may introduce more opportunities for technical compromise. Infosecurity managers would be wise to delay the use of any of these new encryption technologies. This would allow time for products to fully develop and early adopters to report their experiences. Donn B. Parker. dparker(a)sri.com

1 0

I'm getting all the mail twice!
by Vinod Valloppillil 17 Dec '03

17 Dec '03

For some reason, I'm getting all cypherpunks mail twice. I'm posting to the general group address in case there's anyone else who might be getting hit twice as well. Vinod

2 1

Re: "The Virtual Hand": Free-market Internet guide
by willhoek＠halcyon.com 17 Dec '03

17 Dec '03

>[Please distribute this as widely as you see fit. Thanks -- Sasha Volokh] > >The Competitive Enterprise Institute is pleased to announce: > > THE VIRTUAL HAND > > CEI'S FREE-MARKET GUIDE TO THE > INFORMATION SUPERHIGHWAY >... Alright, who let the spammer in? I subscribe to net-resources for this sorta crud; I don't need to see it here in cypherpunks. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Parker's Third Rule of Tech Support: If you can't navigate a one-level, five-item phone tree, you didn't need a computer anyway. willhoek(a)halcyon.com =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

1 0

Andy Grove on Clipper
by Vinod Valloppillil 17 Dec '03

17 Dec '03

I saw Larry King Live last night on CNN and the guests were Al Gore, Andy Grove (CEO/Intel), Dan Sussman (? -- I think that's his name, he was an editor at Newsweek), and Reed Hundt from the FCC. As can be expected, it was another talk show about the "Data Superhighway". It got interesting on two points: First, Larry King asked Andy Grove what he thought Intel should do for the Data Superhighway and he told Larry that since Al Gore was on the show, he'd rather get into what he thought the Feds _shouldn't_ do and discussed the path towards universal access to PC's without any federal involvement. Al Gore tried to get involved by arguing that the Fed's were originally responsible for the computer revolution b/c of the Apollo program. The two hit back and forth a couple of times on the issue. At this point, I was patting Andy on the back for being a non-statist. Then, the editor from Newsweek said that in any show about the "Data Superhighway" the Clipper chip had to be discussed. He then went on to say (and occasionally apologizing to Gore for being blunt) how the chip and the whole program were "loathed" by the industry and privacy advocates. Larry asked Groves what he thought about it and he went off talking about the govt's legitimate right to tap analog media and how all this chip did was to extend that right into the digital realm. I was shocked. Even worse, Al Gore supported Andy's position and then when Larry King got back to the editor, he backed off saying "well, I just heard that people in the industry didn't like it." Larry asked for his opinion on it as a provider of information services and he said, "we just report on public opinions in our magazine and don't try to take positions on the issues. Yuck.

1 0

Cpunks archive works with lynx
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Vincent.Cate(a)FURMINT.NECTAR.CS.CMU.EDU: > As someone pointed out, this "http" method does not yet work with > "lynx" (a text only implementation of WWW) on the cypherpunks mail > database. It seems it will take a new version of lynx or WAIS for this > to work. But the Unix "xmosaic" works fine. :-) Though I prefer Mosaic, this one worked when I tried it with lynx. You can get the latest version of lynx at ftp://ftp.cc.ukans.edu/pub/lynx/ (maybe it's ftp2.cc...) ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0