December 2003 - cypherpunks-legacy

More crypto in real life...
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

[The following is excerpted from RISKS digest. I have sent mail to Valente asking him to be more specific about what kind(s) of encryption they use for their authentication routines. I am slighly worried by the somewhat naive statments in this posting. --AW] Date: 17 Jan 1994 20:09:29 -0800 From: "Luis Valente" <luis_valente(a)genmagic.genmagic.com> Subject: Safety in Telescript Phil Agre's message of January 6th ("Wild agents in Telescript?") brings up some very good points. In this message I would like to describe some of the safety features of Telescript that are used to prevent both ill-intentioned scripts (e.g., worms, viruses) and buggy scripts from damaging a Telescripted network. 1) The Telescript language is interpreted, rather than compiled. Thus, Telescript programs cannot directly manipulate the memory, file system or other resources of the computers on which they execute. 2) Every Telescript agent (i.e, Telescript program that can move around a Telescript network) is uniquely identified by a telename. A telename consists of two components: an authority which identifies the "owner" of the agent (e.g., the Personal Communicator from which it originated) and an identity which distinguishes that agent from any other agent of the same authority. The authority component is cryptographically generated and cannot be forged. Thus, when an agent is transferred from one Telescript engine to another, it is possible to verify (using cryptographic techniques) that the agent is indeed of the authority it claims to represent. (N.B.: a Telescript engine is a program capable of interpreting and executing Telescript programs). 3) Every Telescript agent has a permit which limits its capabilities. Permits can be used to protect users from misprogrammed agents (e.g., an agent that would otherwise "run away" and consume resources for which the user would have to pay) and to protect Telescript service providers from malicious agents. Two kinds of capabilities are granted an agent by its permit. The first kind is the right to use a certain Telescript instruction, e.g., the right to create clones of itself. The second is the right to use a particular Telescript resource and by which amount. For example, an agent is granted a maximum lifetime, a maximum size and a maximum overall expenditure of resources (called the agent's allowance), measured in teleclicks. An agent's permit is imposed when the agent is first created and is renegotiated whenever that agent travels to an engine controlled by a different administrative authority. If the agent exceeds any of its quantitative limits, it is immediately destroyed by the Telescript engine where it is executing. 4) Telescript agents move around a Telescript network by going from one Telescript place to another. Telescript provides an instruction -- go -- that gives agents this travelling capability (if granted by their permit, of course). Places are Telescript programs in their own right. Before accepting an incoming agent, a place can examine the agent's telename, permit and class (N.B.: an agent represents an instance of a Telescript class; thus, the class of the agent represents the "program" that the agent executes. Like authority names, class names cannot be forged). Based on that information, the place can do any the following: a) Do not allow the agent to enter. b) Allow the agent to enter but only after imposing upon it a permit more restrictive than the one it currently holds (e.g., the agent is only allowed to consume 100 teleclicks while in this place). c) Allow the agent to enter and execute under its current permit. 5) When a Telescript process (agent or place) interacts with another Telescript process, the telename and class of the former is available to the latter. This enables Telescript applications to control who can interact with them and in what ways. I hope this (brief) description of some of the more pertinent security features of Telescript will help Risks readers understand how we've addressed the issues raised in the NYT article and in Phil's message. -Luis Valente, General Magic, Inc. ------------------------------

1 0

Anyone looked at this report?
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

[Again cribbed from RISKS... --AW} From: "Lance J. Hoffman" <hoffman(a)seas.gwu.edu> Subject: crypto policy report available online The following report is available by anonymous ftp from ftp.gwu.edu under directory /pub/hoffman. The document is stored under the name "cryptpol". It is a NIST-sponsored study. The table of contents and abstract follows here. CRYPTOGRAPHY: POLICY AND TECHNOLOGY TRENDS Lance J. Hoffman, Faraz A. Ali, Steven L. Heckler, Ann Huybrechts December 1, 1993 CONTENTS EXECUTIVE SUMMARY 1. INTRODUCTION 2. TECHNOLOGY 3. MARKET ANALYSIS 4. EXPORT CONTROLS 5. PUBLIC POLICY ISSUES 5.1 EXECUTIVE BRANCH 5.2 CONGRESS 5.3 TRENDS 6. POTENTIAL SCENARIOS EXECUTIVE SUMMARY During the past five years, encryption technology has become easily available to both individuals and businesses, affording them a level of security formerly available practically to only military, national security, and law enforcement agencies. As a result, a debate within the United States about the proper balance between national security and personal freedom has been initiated. Law enforcement and national security agencies would like to maintain tight control over civilian encryption technologies, while industry and individual and privacy rights advocates fight to expand their ability to distribute and use cryptographic products as they please. This report analyzes trends in encryption technology, markets, export controls, and legislation. It identifies five trends which will have a strong influence on cryptography policy in the United States: * The continued expansion of the Internet and the progressive miniaturization of cryptographic hardware combined with the increasing availability and use of strong cryptographic software means that the strongest encryption technologies will continue to become more easily obtainable everywhere in the years ahead. * Additional growth in networked and wireless communication will fuel a strong demand for encryption hardware and software both domestically and abroad, causing the U. S. high-technology industry to be increasingly interested in selling encryption products overseas and in modifying current export restrictions. * Due to the responsibilities and bureaucratic dispositions of key Executive Branch agencies, products using strong encryption algorithms such as DES will continue to face at least some export restrictions, despite the widespread availability of strong encryption products overseas. * The American public is likely to become increasingly concerned about its privacy and about cryptographic policy as a result of the increased amount of personal information available online and the growing number of wireless and networked communications. The development and increasingly widespread use of the National Information Infrastructure will heighten these concerns. * Encryption policy is becoming an important public policy issue that will engage the attention of all branches of government. Congress will become increasingly visible in this debate due to its power of agency oversight and its role in passing laws accommodating the United States' rapid rate of technological change. Agencies will remain very important since they have the implementing and, often, the planning responsibilities. Since individuals and industry have more direct influence over Congress than over most other branches of government, Congress may place somewhat more emphasis on personal freedom than many other government actors. Four potential scenarios are likely: mandatory escrowed encryption, voluntary escrowed encryption, complete decontrol of encryption, or domestic decontrol with strict export regulations. Professor Lance J. Hoffman, Dept of EECS, The George Washington University (202) 994-4955 Washington, D.C. 20052 hoffman(a)seas.gwu.edu Fax (202) 994-0227 ------------------------------

1 0

[julf@penet.fi: Re: VIRTUAL meeting needed]
by joshua geller 17 Dec '03

17 Dec '03

>> Instead, perhaps we need to organize for another virtual meeting again. >> With a little more organizing, it would go smoother. >How about trying IRC this time? be something worthwhile on irc for once. and people would be there who wouldn't otherwise (like me). josh

1 0

Nuclear Capone in Russia?
by nobody＠jarthur.claremont.edu 17 Dec '03

17 Dec '03

Los Angeles Times, Saturday, Feb. 26, 1994, p.A10 FBI Director Sees Parallels Between Russia Now, Chicago Then Crime: Louis J. Freeh doesnÕt want a Slavic Al Capone to endanger U.S. investments or undermine the fragile democratic process. And he is working to help prevent it. By Ronald J. Ostrow Times Staff Writer Washington - To FBI Director Louis J. Freeh, organized crime in Russia today bears disturbing similarities to ChicagoÕs in the 1920s and 1930s - violent but fractionalized, a danger to itself as much as to the rest of society, and with a potential for much more. The likes of Al Capone, unchecked by the FBI or any other law enforcement body, welded the Chicago mob into a unified force that preyed on the community for decades. Freeh does not want a Slavic equivalent of Capone to do the same today in Russia, for fear not only of endangering American Business activity there but also of undermining that countryÕs fragile democratic process. And he is working to help Russian authorities prevent it. Already, Freeh said, elements of Russian organized crime are responsible for everything from "bushwhacking" American businessmen to dealing in materials that could be used in nuclear weapons. If authorities do not act soon, he said, organized crime will become so entrenched throughout the former Soviet Union and its Eastern European satellites that, like the Mafia in Chicago, it will take decades to remove it. "We have to look at it as something that's clearly directed toward the United States, toward our economy," Freeh said in an interview. "Even with decreasing resources, we can't afford to do what the FBI did with respect to La Cosa Nostra for 30 years, and that was to completely ignore it." The situation in Russia today, Freeh acknowledged, is not as dire as in Chicago in the 1920s and 1930s. But German and Russian law enforcement authorities "are concerned about the very rapid inroads that these gangs are making into officialdom, into police and government officials," the FBI director said. To help the Russians cope, Freeh wants to station up to three FBI agents in Moscow by the end of spring to serve as liaisons with Russian authorities. Contacts are now handled largely by two agents based in Bonn, who have responsibilities beyond the former Soviet Union. Authorities in Russia's Interior Ministry and the Moscow police "are desperately in need of our help," Freeh said. "They want our training, our methodology." He also wants to bring Russian agents for 11 weeks of training at the FBI's National Academy in Quantico, VA., where they would learn about laboratory and computer work and the other technologies that the FBI uses against organized crime. For now, Freeh said, the victims of Russia's organized crime are mostly Russian Entrepreneurs and other business people. But he warned that American businesses seeking a foothold in Russia are just as vulnerable. "Part of the [Clinton] Administration's program is to give not only economic aid but to [assist] economic institution-building and to encourage American and other foreign investments" in the former Soviet Union, he said. "If the scouts for leading American corporations are getting bushwhacked in their hotel rooms in Moscow or, perhaps worse, establishing a foothold and having to face extortion and economic criminal activity they are not prepared to do, our economy takes a serious hit," Freeh said. "The end product is that the process for democracy and a free economy in Russia takes a very significant step backward. "I guess it's an irony, but it's much harder to police in a democratic fashion than than to police in a totalitarian fashion," Freeh said. "Police work is very hard if you do it according to due process and democratically." Authorities in the former Soviet Union "don't have that experience and haven't had it for 70 years. So they're having to learn all of the tools, skills and techniques and, at the same time, deal with a burgeoning crime crisis," Freeh said. U.S. authorities are particularly concerned that Russian gangs "are aggressively looking to buy and sell nuclear materials," the FBI director said. The materials so far are less than weapons grade, but they could be used for designing devices deadly to population centers, according to FBI intelligence. "That's a whole different threat than we've faced before," Freeh said. He declined to give any more specifics on the threat, but said the United States under the law now lacks authority to fully deal with it. Under the 1950 Atomic Energy Act, the FBI has authority to investigate the transfer or shipment of nuclear materials only if their origin or destination is American or they have entered and left the United States. Freeh said he has discussed with Atty. Gen Janet Reno and other Justice Department officials the need for a law broadening the FBI's authority over such matters. The FBI is also interested in the criminal activities of Russian immigrants in the United States, according to Jim Moody, who directs the FBI's efforts against organized crime. In the late 1970's and early 1980's, about 200,000 people entered the United States from the Soviet Union, and Moody estimated that about 1% of them - 2,000 - were "hard-core criminals." But he regards them as second-string players who are now being replaced by more highly skilled, educated lawbreakers. In one of the more sophisticated conspiracies involving Russian emigres, a federal grand jury in Philadelphia last June charged 15 people and two corporations with evading federal and state excise taxes on the sale of more than 51 million gallons of diesel fuel in Pennsylvania and New Jersey.

2 1

Re: Newsday Editorial
by bsteve＠zontar.attmail.com 17 Dec '03

17 Dec '03

Dorothy: We have not been formally introduced. My name is Steve Blasingame. I am a long-time proponent of quality encryption systems for both private and commercial communications. I am also a long-time employee of The AT&T Company responsible for AT&T-GIS strategies, programs and products in internetworking. I am very pleased that AT&T is manufacturing the "Clipper Phone" product and believe that "Clipper" is an enabling technology for government and business. However, I must challenge the basis of your "Newsday" editorial as false. >" The Clinton administration has adopted the chip, which would allow >law enforcement agencies with court warrants to read the Clipper codes >and eavesdrop on terrorists and criminals." It would be great if this were true, but it is false. Criminals and terrorists operate outside the confines of the law and are not obliged to use encryption schemes sanctioned by statute. >" But opponents say that, if >this happens, the privacy of law-abiding individuals will be a risk. >They want people to be able to use their own scramblers, which the >government would not be able to decode." Given that criminals would not be obliged to use the statutory method of encryption, what other purpose could be served by such a technology enforced by law? " If the opponents get their way, however, all communications on the information highway would be immune from lawful interception." It is clear that the security of communications on the information highway is an important issue. However, as a corporate citizen, I am more concerned about the un-lawful monitoring of communications and do not consider that there is a sufficiently robust encryption technology to make a statutory encryption standard workable for more than a few years. >" But then who would have >thought that the World Trade Center bombers would have been stupid >enough to return a truck that they had rented?" I think that this qualifies as an appeal to ignorance. "Can you prove it isn't true?" >"... Lawlessness would prevail." If you examine definition 3 from the latest edition of the "American Heritage Dictionary" in your study, you will find that "Lawless" means "not governed by law." This is certainly a law that we can all do without. Very truly yours, Steve Blasingame bsteve(a)zontar.com

1 0

Mailing list software losing posts
by Matthew J Ghio 17 Dec '03

17 Dec '03

The list software seems to be having problems again. I sent the below post to the list three times, and it never got sent out. But since another post from me just showed up, maybe it's working now... (Let me know if you got more than one copy, because I sure didn't.) ----- To: cypherpunks(a)toad.com Subject: Re: lists of U.S. cypherpunks and Tentacles. CC: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> In-Reply-To: <9402260131.AA08270(a)toad.com> References: <9402260131.AA08270(a)toad.com> Date: Sat, 26 Feb 1994 11:34:54 -0500 (EST) From: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> mg5n+eaibiubkxb58z84cy2iaf9r61u26ra5x26mc0h(a)andrew.cmu.edu wrote: > Please add me to your list. As you can see, I clearly have > a US-based email address. :) hehe... This didn't come from my site tho. It looks like a clever port 25 hack. However, the return address is valid. I suppose this points out another problem with the US export laws: How can you know where a message came from? As the above example shows, there is really no way to know where the person you're communicating with is. In other words, you can't not break the US export laws. All you have is someone's word that they are in the US or not, but you really can't know for sure. Something to mention in your letters to Rep. Cantwell. > -Ibiu Cute... using part of your encrypted address as a handle? I never thought of doing that... hmm...

3 3

Re: I have FOIA'd the Clipper Key Escrow databases
by smb＠research.att.com 17 Dec '03

17 Dec '03

I confess -- I expect one of two outcomes. First, they may say that the database is classified, if only at the level of ``For Official Use Only''. Second, maybe they will release it -- but remember that the keys are stored encrypted. Can you file an FOIA request for the key, too?

2 1

using mediamoo - correction
by David Galiel 17 Dec '03

17 Dec '03

re:previous message about possible use of mediamoo for mtg. Ooops - the ultimate NetSin - mispelled my address. It's galiel(a)world.std.com (sheepish grin) Flout 'em and scout 'em -- and scout 'em and flout 'em; Thought is free. -- Shakespeare

1 0

Cryptography, fascism; Perot
by Brad Dolan 17 Dec '03

17 Dec '03

There has been a lot of discussion of cryptography/communications issues on the UWSA reflector (uwsa(a)shell.portal.com) This list is monitored by people who work for Perot, so post there and it might get his attention. You can be added to the reflector by e-mailing to: telcon(a)shell.portal.com [I think that's right - I believe it used to be telconsort(a)shell.portal.com] Brad bdolan(a)well.sf.ca.us

1 0

Re standard for stegonography?
by Derek Upham 17 Dec '03

17 Dec '03

> Is there a standard for stego yet? I just added stego and de-stego > filters to my pbmplus image toolkit, using a simple protocol I made > up on the spot. Now I'm wondering if I should make them compatible > with existing stego tools. There appear to be two existing steganography packages for images. One is "jsteg", a Unix-based system which stores data in JFIF- compliant JPEG images; it is based on version 4 of the cjpeg/djpeg package. The other is "Stego", a Mac-based system which stores data in Mac PICT files (I think---I don't have a Mac to examine it). "jsteg" is available in the Cypherpunks FTP archive in the applications subdirectory as the original jpegsrc package, plus the patches, plus a README file. However, you might be better off tracking down the "Stego" sources since "jsteg" stores its data in a rather odd way (see the docs for more information). Derek Derek Lynn Upham University of British Columbia upham(a)cs.ubc.ca Computer Science Department ============================================================================= "Ha! Your Leaping Tiger Kung Fu is no match for my Frightened Piglet Style!"

1 0