December 2003 - cypherpunks-legacy

A Study of National Cryptography Policy
by Herb Lin 17 Dec '03

17 Dec '03

Please forward this message to any individual or mailing list that you believe should receive it. If you have seen it already, our apologies. Many thanks.. ********************* As part of the Defense Authorization Bill for FY 1994, the U.S. Congress has asked the Computer Science and Telecommunications Board (CSTB) of the National Research Council (NRC) to undertake a study of national policy with respect to the use and regulation of cryptography. The report of the study committee is due two years after all necessary security clearances have been processed, probably sometime summer 1996, and is subject to NRC review procedures. The legislation states that 120 days after the day on which the report is submitted to the Secretary of Defense, the Secretary shall submit the report to the Committees on Armed Services, Intelligence, Commerce, and the Judiciary of the Senate and House of Representatives in unclassified form, with classified annexes as necessary. This study is expected to address the appropriate balance in cryptography policy among various national interests (e.g., U.S. economic competitiveness (especially with respect to export controls), national security, law enforcement, and the protection of the privacy rights of individuals), and the strength of various cryptographic technologies known today and anticipated in the future that are relevant for commercial purposes. The federal process through which national cryptography policy has been formulated is also expected to be a topic of consideration, and, if appropriate, the project will address recommendations for improving the formulation of national cryptographic policy in the future. This project, like other NRC projects, will depend heavily on input from industry, academia, and other communities in the concerned public. Apart from the study committee (described below), briefings and consultations from interested parties will be arranged and others will be involved as anonymous peer reviewers. It is expected that the study committee will be a high-level group that will command credibility and respect across the range of government, academic, commercial, and private interests. The committee will include members with expertise in areas such as: - relevant computer and communications technology; - cryptographic technologies and cryptanalysis; - foreign, national security, and intelligence affairs; - law enforcement; - commercial interests; and - privacy and consumer interests. All committee members (and associated staff) will have to be cleared at the "SI/TK" level; provisions have been made to expedite the processing of security clearances for those who do not currently have them. Committee members will be chosen for their stature, expertise, and seniority in their fields; their willingness to listen and consider fairly other points of view; and their ability to contribute to the formulation of consensus positions. The committee as a whole will be chosen to reflect the range of judgment and opinion on the subject under consideration. The detailed composition of the committee has not yet been decided; suggestions for committee members are sought from the community at large. Note that NRC rules regarding conflict of interest forbid the selection as committee members of individuals that have substantial personal financial interests that might be significantly affected by the outcome of the study. Please forward suggestions for people to participate in this project to CSTB(a)NAS.EDU by DECEMBER 17, 1993; please include their institutional affiliations, their field(s) of expertise, a note describing how the criteria described above apply to them, and a way to contact them. For our administrative convenience, please put in the "SUBJECT:" field of your message the words "crypto person". Finally, some people have expressed concern about the fact that the project will involve consideration of classified material. Arguments can and have been made on both sides of this point, but in any event this particular ground rule was established by the U.S. Congress, not by the CSTB. Whether one agrees or disagrees with the asserted need for classification, the task at hand is to do the best possible job given this constraint. On the National Research Council The National Research Council (NRC) is the operating arm of the Academy complex, which includes the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine. The NRC is a source of impartial and independent advice to the federal government and other policy makers that is able to bring to bear the best scientific and technical talent in the nation to answer questions of national significance. In addition, it often acts as a neutral party in convening meetings among multiple stakeholders on any given issue, thereby facilitating the generation of consensus on controversial issues. The Computer Science and Telecommunications Board (CSTB) of the NRC considers technical and policy issues pertaining to computer science, telecommunications, and associated technologies. CSTB monitors the health of the computer science, computing technology, and telecommunications fields, including attention as appropriate to the issues of human resources and information infrastructure and initiates studies involving computer science, computing technology, and telecommunications as critical resources and sources of national economic strength. A list of CSTB publications is available on request.

1 0

Re: digicash
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

The point is not that B. Dolan's proposed cash is bad, it is that better systems exist. Chaum's blinded c{sh is simiXoar to Dolan's proposal, but with the added feature that the "passwords" that~r authorize access to the bank account can be altered by the users so that the bank does not recognize them later, while still allowing the bank to verify that the "passwords" are valid. This eliminates the trackability allowed by Dolan's proposal. (Sorry about the line noise!{ Hal

1 0

Name for crypto cash
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

I thought of a new name today for digital cash: CRASH, taken from CRypto cASH. "How much crash have you got in your account? Can we FTP this GIF?" "Not enough... Hey, can I borrow some crash?" It has a nice cyberpunk sound to it. I don't know if we need a name for the units, or if we could just get by without. One of the lessons of the CP publicity is that having a sexy name is a big plus. (Apologies if I'm unknowingly regurgitating someone else's idea!) Hal

3 2

Re: Anarchy Gone Awry (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

This post is a perfect example why the two lists should be kept seperate and not merged. This sounds to me like it belongs on alt.politics.data- highway. -uni- (dark)

2 1

ANNOUNCEMENT: Markey Bill (HR3636) Available Online from EFF
by Stanton McCandlish 17 Dec '03

17 Dec '03

HR3636, The Markey Bill, is now available online at the Electronic Frontier Foundation's ftp archive. FTP to ftp.eff.org, and get the text file ~pub/eff/legislation/hr3636 (aka ~pub/eff/legislation/markey.bil). ****** Info on the bill ****** On Monday, November 22, 1993, EFF applauded House Telecommunications and Finance Subcommittee Chairman Edward Markey (D-Mass.), Minority Chairman Jack Fields (R-Tex.), and other cosponsors for introducing the "National Communications Competition and Information Infrastructure Act of 1993." The Markey/Fields legislation, which incorporates EFF's Open Platform philosophy, is built on three concepts: open platform services, the entry of telephone companies into video cable service, and universal service. Reacting to the open platform provisions, Mitchell Kapor, EFF Board Chairman, stated: "The sponsors of this bill are to be commended for proposing legislation that incorporates a truly democratic vision of the emerging data highway. Open platform service can end channel scarcity once and for all and make it possible for any information provider to offer voice, data, and video services on the data highway. Every citizen will be able to access a true diversity of information and programming." EFF Executive Director Jerry Berman added that "we believe public interest and nonprofit groups, as well as computer and communications industry leaders will work very hard for the open platform provisions. Our goal is to keep them in the bill and make them even stronger before its enactment." AN EFF ANALYSIS OF THE IMPACT OF THE BILL ON PUBLIC INTEREST GOALS OF UNIVERSAL SERVICE, COMMON CARRIAGE, AND CONSUMER EQUITY WILL BE RELEASED AS SOON AS IT IS COMPLETED. For an initial brief analysis (previously posted to comp.org.eff.talk and elsewhere) see ftp.eff.org, ~pub/eff/legislation/announce.mky See also ftp.eff.org or gopher.eff.org, ~pub/eff/papers/op2.0 and ~pub/eff/papers/open-platform* for more information on EFF's Open Platform initiative. See ~pub/eff/legislation/markey.bil for the full text of the Markey Bill.

1 0

on initial rejection of claims of RSA patent
by henry strickland 17 Dec '03

17 Dec '03

Diffie, via "L.": # No. But after all, the RSA patent was filed from MIT by people # (R, S, and A) that I didn't know well till much later. There may have # been some hankey pankey I didn't know about, but I certainly don't # recall the New York Times article you refer to. The statement that # ``They just got the application back rejected.'' Doesn't sound right # to me. I presume that the Patent Office has to state why an # application is returned. It's decisions, after all, are a constant All four of the PKP patents mentioned in RFC1423, Cryptographic Apparatus and Method ("Diffie-Hellman")............................... No. 4,200,770 Public Key Cryptographic Apparatus and Method ("Hellman-Merkle").................... No. 4,218,582 Cryptographic Communications System and Method ("RSA")................................... No. 4,405,829 Exponential Cryptographic Apparatus and Method ("Hellman-Pohlig").................... No. 4,424,414 had all of their claims either "rejected" or "objected to" on the first pass by the patent examiner. I have been told this is not unusual. The patent examiner gave reasonable technical reasons whe he rejected them. Nothing looks fishy to me, that is part of the record. I have a copy of [almost all of] the "full wrappers" on these four patents, and am making them available to the CA cypherpunks (CA, because I live here). (They're not online, there's a lot of handwritten pages & annotations & forms that would not OCR, and it's a 6" stack of legal paper, so it's not easy for me to provide them online, sorry.) strick

1 0

NIST Meeting Dec 8-9
by Dave Banisar 17 Dec '03

17 Dec '03

NIST Meeting Dec 8-9 NIST Computer System Security and Privacy Advisory Board Meeting December 8-9, 1993 Hyatt Regency Reston 1800 President's Street Reston, VA >From 495, take Dulles Access Road (toll road) to Reston Parkway, Turn right on parkway, Hotel is on left by new town center. Draft Agenda December 8, 1993 I Welcome 9:00 Opening Remarks - Lynn McNulty 9:10 Chairman's Remarks - Dr. Willis Ware II. Unclassified Government Cryptography Activities 9:15 National Research Council Cryptographic Study Marjorie Blumenthal, NRC 9:45 GAO Report on Cryptography Policy, Harold Podell 10:15 Break 10:30 Status of NIST Cryptographic Standards Activities, Miles Smid 11:00 DSS Infrastructure Briefing, McNulty & Mitre Rep. 11:30 Key Escrow Update 12:00 Lunch III. Emerging NII Technologies 1:30 Jim Flyzik, Director, Telecommunications Management, Treasury Dept. 2:30 Organizing for the NII and GII - Bruce McConnell, OMB 3:00 NIST's Role - Jim Burrows, NIST IV Electronic Commerce 4:00 Electronic Commerce Initiative - Steve Trus 5:00 Recess December 9 V. MOSIAC 9:00 MOSIAC Briefing - DoD Program for Protection of Unclassified Data in the DMS - John Nagangast, NSA VI Common Criteria 9:45 Common Criteria Update - Dr. Stu Katzka 10:15 Break VII NIST Security Program Plan 10:30 NIST Security Plan for FY-94 - Dr. Stu Katzke 11:00 Disussion VIII Telecommunications Security 11:30 Telecommunucations Switch Vulnerability Analysis, Rick Kuhn 12:00 Lunch IX Workplace Privacy Bill 1:30 S-984 - Privacy for Consumers and Workers Act, Kristina Zahorik Legislative Assistant, Senate Employment and Productivity Subcommittee 2:00 Discussion X CSSPAB Workplan 2:30 Draft CY-1994 Workplan - Presentation and Discussion CSSPAB Working Group XI Public Participation 3:00 Public Participation XII Close 3:30 March Meeting - Agenda Ideas 3:45 Adjourn

1 0

Re: W.Diffie on RSA patent
by smb＠research.att.com 17 Dec '03

17 Dec '03

I thought this was all documented in the NYT. Does anyone have the article? Anyway, Mr.Diffie says (see below) that nothing sinister happened at the patent office regarding the RSA patent. I would like to hear of any other patents that were suppressed by the NSA hiding behind the patent office. I mean, this professor was definitely not making up a story! She gave me the NYT reference but I think I accidentally threw out the paper I wrote it on. Does anyone have the reference? I think it happened in '78. It sounds like you're talking about the Davida patent, or maybe the zero-knowledge proof patent. Here's the basic story. U.S. patent law contains a provision for ``secrecy orders''. That is, when you apply for a patent in certain sensitive areas -- and cryptography is one of them -- the application is routed to the appropriate government agencies, including NSA. If they think the invention is too good, you'll receive a notice saying that you not only can't get a patent, you're not even allowed to discuss it anymore. George Davida -- a professor -- was hit with just such an order. Eventually, it was lifted, after a lot of public protest. NSA tried claiming that the patent application proved that the issue was commercial, rather than pure free speech, but they didn't try to fight it. More recently, Shamir received a secrecy order on his zero-knowledge proof patent. This was even more insane than usual, since (a) Shamir is not a U.S. citizen, and (b) he'd already been discussing the idea at conferences world-wide. According to rumor, this order was imposed by the Army, and was lifted through NSA's intervention. I know that the Shamir story was in the NY Times, though I don't have the citation. A pointer in my files is: journal name: Notices of the American Mathematical Society journal date: Jan 88 volume/number: 35, 1 article title: Zero Knowledge and the Department of Defense author(s) name: Susan Landau page number: 5-12 but I don't have the article handy. The Davida story was probably in the Times as well; my summary of it is taken from ``Cryptology Goes Public'', by David Kahn, in ``Kahn on Codes'', 1983. The article originally appeared in the Fall 1979 issue of ``Foreign Affairs''.

1 0

Information
by STERLING D. TATE 17 Dec '03

17 Dec '03

Information on mailing list. Cypherpunk-info(a)toad.com

1 0

ANNOUNCEMENT: DPSWG Crypto-Policy Statement to White House
by Stanton McCandlish 17 Dec '03

17 Dec '03

NOTICE: This is the letter from the Digital Privacy and Security Working Group sent to the White House 12/06/93, urging the Administration to lift export controls on DES, RSA and other mass market encryption without requring legislation. Some erroneous press reports have said the DPSWG (see letter signatories) were making a Clipper/Skipjack "deal". This is not true. The letter makes it clear that Clipper as originally proposed is not viable, and that in any form it is to be implemented only if it's use is completely voluntary and ONLY if current restrictions on mass market encryption software are removed, so that the right to choose one's own methods of privacy and security is retained, and American businesses can effectively and openly compete in the expanding international market for encryption products. For more details please see the third paragraph of the letter, below. - ----------------------------------------------------------------------- DIGITAL PRIVACY AND SECURITY WORKING GROUP 1001 G Street, NW Suite 950 East Washington, DC 20001 Jerry Berman 202/347-5400 Leah Gurowitz 202/393-1010 December 6, 1993 The President The White House Washington, DC 20500 Dear Mr. President: On April 16, 1993, you initiated a broad industry/government review of privacy and cryptography policies at the same time that the Administration unveiled its Clipper Chip proposal. The Digital Privacy and Security Working Group -- a coalition of over 50 communications and computer companies and associations, and consumer and privacy advocates -- has been working with members of your Administration to develop policies which will reflect the realities of the digital information age, the need to provide individuals at work and home with information security and privacy, and the importance of preserving American competitiveness. The Digital Privacy and Security Working Group is committed to the proposition that computer users worldwide should be able to choose their encryption programs and products, and that American programs and products should be allowed to compete in the world marketplace. In our discussions with Administration officials, we have expressed the Coalition's tentative acceptance of the Clipper Chip's encryption scheme (as announced on April 16, 1993), but only if it is available as a voluntary alternative to widely-available, commercially-accepted, encryption programs and products. Thus, we applaud repeated statements by Administration officials that there is no intent to make the Clipper Chip mandatory. One key indication of whether the choice of encryption regimes will be truly voluntary, however, is the ability of American companies to export computer programs and products employing other strong encryption algorithms (e.g. DES and RC2/RC4 at comparable strengths) demanded by customers worldwide. In this regard, we commend to your attention legislation introduced by Rep. Maria Cantwell (H.R. 3627) that would liberalize existing export controls on software with encryption capabilities. Of course, such legislation would not be necessary if the Administration acts to accomplish such export control liberalization on its own. As part of your on-going encryption review and decision-making, we strongly urge you to do so. As your Administration concludes its review of this issue, representatives of the Digital Privacy and Security Working Group remain available to meet with Administration officials at any time. Sincerely, American Civil Liberties Union IBM Apple Computer, Inc. Information Industry Association Business Software Alliance Information Technology Association of America Committee on Communications and Information Policy, IEEE-USA Iris Associates, Inc. Computer and Business Equipment Lotus Development Corporation Manufacturers Association Microsoft Corporation Crest Industries, Inc. Oracle Corporation Digital Equipment Corporation Prodigy Services Company EDUCOM Software Publishers Association Electronic Frontier Foundation Sun Microsystems, Inc. Electronic Messaging Association Telecommunications Industry Association GKI Cryptek Division Trusted Information Systems Hewlett-Packard Company cc: John Podesta, Office of the President George Tenet, National Security Council Mike Nelson, Office of Science and Technology Policy Ray Kammer, National Institute of Standards and Technology Steve Aoki, National Security Council Geoff Greiveldinger, Department of Justice - ------------------------------------------------------------------------- This document and others on related topics are archived at ftp.eff.org, ~ftp/pub/eff/crypto-policy.

1 0