December 2003 - cypherpunks-legacy

Re: Clinton's threat of line-item veto affect crypto bill?
by geeman＠best.com 17 Dec '03

17 Dec '03

Read my earlier post re: this. Clinton already said he'd veto SAFE. At 10:00 AM 8/5/97 -0700, stewarts(a)ix.netcom.com wrote: > >At 04:36 PM 8/4/97 -0700, Ernest Hua wrote: >>Does anyone have any idea whether Clinton's threat of using the >>line-item veto against portions of the big spending bill could >>be leverage against some pro-SAFE legislators? > >The line item veto doesn't eliminate the political games in the budget, >it just changes the details a bit. Sure, he could threaten to >veto their favorite pork-barrel projects for crossing him on crypto, >just as he could threaten to veto them if they don't support >his favorite pork. But as someone else said, he can threaten to >veto the crypto bill itself, or (perhaps worse) threaten to veto it >unless it's "balanced", by including controls on domestic cryptography >in return for letting Big Business export more products. > > ># Thanks; Bill ># Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com ># You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp ># (If this is a mailing list or news, please Cc: me on replies. Thanks.) > > >

2 1

Money magazine on Internet gambling
by Declan McCullagh 17 Dec '03

17 Dec '03

A colleague of mine down the hall at Money magazine just stopped by and asked for help on a Net-gambling story. I think she's interested in the offshore issues -- but this being Money, I think they're looking for horror stores as well. (Junior running up a $20,000 tab on Daddy's credit card. You know the drill.) I already gave her my copy of the July Wired with Charles Platt's article on FC97, told her about Sen. Kyl's bill, and gave her the URL to MSNBC's special report. If anyone wants to give her a call, email me for her phone number. -Declan PS: Thanks to everyone who responded about the digital cash story for Money earlier this summer. I printed out all the responses I got and forwarded them along, but the story got killed...

1 0

PGPfone 1.0b4 Test at Party Tonight
by tcmay＠got.net 17 Dec '03

17 Dec '03

Talk about synchronicity! Three years ago, as we met for our first meeting (before we had been dubbed "Cypherpunks"), PGP 2.0 had just appeared a day or two earlier. Arthur Abraham prepared copies on floppies (I know, I know, not fully secure :-}), and we all got copies at that first meeting. Well, PGPfone was released yesterday, and the release date is officially 25 August. And I have it, and my Cypherpunks Santa Cruz party/meeting is tonight. It runs on Macintoshes, so far, and I got it downloaded (from "alt.anonymous.messages," ironically, as the MIT site would not let me have it, claiming they couldn't verify that "got.net" was a kosher site....so, "the street" gave it to me, without any of those messy restrictions on who I can give it to, etc.:-}). Quit an example of synchronicity, that it just appeared, that the Mac is its first implementation platform, and that today's my party. It seems to work, at least in voice mode, though I need to read up on set-ups for my sound input and output (fairly standard for the Mac, but always a chance of some misconfiguration). I have a PowerMac 7100av, goosed up to 84 MHz, so power should not be a problem. What would really be nice is to have someone to test this with. Hence this message. If you are willing to be a test partner, especially at tonight's Cypherpunks Santa Cruz party, send me a message with your phone number. And any tips you've found are necessary to make it work. (I already realized I had to get the latest Threads Manager, and did so via Apple's Web site.) The party starts around 6 p.m., PDT. A call around 8-10 p.m. PDT would be nice. I can call you, or vice versa, depending. Three cheers for synchronicity! --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: SSL trouble
by Will French 17 Dec '03

17 Dec '03

> Use integrity checks to ensure that the slaves are acting > properly. One method of doing this is to keep secret part of > the known plaintext (say 16 bits). A slave is required to > report _all_ matches in the range to the master. Slaves who > report a statistically low number of matches may be considered > suspicious. It is a simple matter to allocate part of that > keyspace to another processor for a double-check. Please don't do anything like this. This will prevent people like me who prefer the "random" method from participating. Will French <wfrench(a)interport.net>

3 2

Re: Modern Journalism (was: All about Bernstein)
by steven ryan 17 Dec '03

17 Dec '03

I want to puhhff you up -- SNL? >We need to "Just say No!" to journalists asking for "more personal details" >to spice up their stories... >I no longer read the many puff pieces on Phil Zimmermann, for example, as >they all are seemingly in the same format: huge closeup photos of Phil's... You may not want to read those stories any more because you know all the details. But a puffed up cover story on Phil Z in People magazine would be one of the best things that could happen. Some actresses feel that any publicity is better than no publicity and they may be right. Given that we are not going to get many in depth technical articles in the mainstream press, puff pieces are better than nothing. In the last month on two different occasions I have been in casual conversations at work when the subject of PGP and cryptography came up based on articles in the local media. I was able to answer the questions and explain in detail the benefits of PGP and as well give out a disk loaded with the program for them to try. If the puff pieces weren't read by these people the subject would not have come up and I wouldn't have been likely to have had the opportunity to get these people interested in using PGP. Given that the average person still knows nothing of cypherpunk technology and issues and probably wouldn't mind if it was all outlawed in the name of national security, anything that keeps the topic in the public's eye is good. Steven Ryan sryan(a)reading.com

2 1

Re: Article in Time Magazine
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> All the more reason to use Linux or FreeBSD - an OS you have the source for, > on hardware that you can examine. How would you want to examine a pentium processor? Just an idea: Take the block move instructions and attach a little state machine. If a certain sequence of bytes is detected, a fuse somewhere on the chip is burned and the processor could switch irreversible into a mode where it does partial incorrect calculations. Send someone an email, an IP packet or an ethernet packet and you can expect the packet to be moved by a block move command. Hadmut

2 1

proliferation of voicesystems
by Ray Cromwell 17 Dec '03

17 Dec '03

It's really great that there are all these voice transmission/encryption programs out there, the problem is, none of them will talk to each other. If I have a unix box, I have to use product X, if I have a PC, product Y, and a Mac, product Z, and X,Y, and Z all speak different protocols. The issue is more frustrating with web clients. I like to use Netscape, but if I want to view RealAudio, I have to switch to Windows, etc. Rather than have one "successful" product set a defacto standard and lock the rest of the market into one algorithm, cypherpunks who are working on voice products should collaborate to product an open standard, which specifies base level functionality, and drop in algorithm improvements. Perhaps even video should be considered as that too will eventually be a reality. Sooner or later, there must be a shakeout and a "standard" (defacto) will emerge. The question is, do you want this to be an extensible open standard that can cope with changing hardware and network capability, or do you want, say, InternetPhone, to win and set the standard by shear market share like Netscape is doing now and like Microsoft has been doing? Just something to consider. -Ray

5 4

Fraud Feared as Antigua Net Bank Fails
by Alan Olsen 17 Dec '03

17 Dec '03

http://nytsyn.com/live/Latest/218_080697_110027_578.html Fraud Feared as Antigua Net Bank Fails By EMILE VALERE c.1997 Bloomberg News T. JOHN'S, Antigua - The Antigua and Barbuda government issued a fraud alert Tuesday after the collapse of European Union Bank and the disappearance of its cofounders. The locally-chartered bank, which fired all its employees last Thursday, had marketed itself as the first off-shore bank on the Internet. The Antiguan government hired the accounting firm Coopers and Lybrand LLP to examine the records of the three-year-old company. Callers to the bank heard a recorded message that gave only a hint that something was amiss. ``Welcome. You have reached the European Union Bank,`` said a reassuring-sounding male voice. ``Due to technical reasons, some of our services involving the security mode are temporarily unavailable.'' The bank's Internet site, http://www.eubank.ag , was also unavailable. Meanwhile, the government is on the look-out for the bank's founders, Serbveo Ushakov, allegedly of Bronxville, New York, and Vietalui Papsouev of Richmond Hill, Ontario, according to the Caribbean News Agency. The government says the two are Russian nationals. The Idaho Department of Finance on May 30 ordered European Union to stop soliciting deposits from Idaho residents over the Internet. ``I can't say I'm surprised'' at the news of the bank's collapse, said Gavin Gee, director of the department. Idaho alleged the bank, without a state or federal charter, was operating illegally. Gee said he hopes other U.S. regulators will take similar actions against off-shore banks soliciting over the Internet. ``If nobody's going to take action against fraud on the Internet, we've got a serious problem,'' said Gee. Antigua has more than 50 off-shore banks. Prime Minister Lester Bird last February targeted three of them to be shut down because of their alleged involvement with Russian crime rings. The Associated Press reported last week that the Bank of England warned investors last fall about depositing funds in European Union Bank. (The Bloomberg web site is at http://www.bloomberg.com )< (Disbributed by The N.Y. Times News Service)< NYT-08-06-97 1054EDT<

1 0

Re: SSL trouble
by Will French 17 Dec '03

17 Dec '03

>> Use integrity checks to ensure that the slaves are acting >> properly. One method of doing this is to keep secret part of >> the known plaintext (say 16 bits). A slave is required to >> report _all_ matches in the range to the master. Slaves who >> report a statistically low number of matches may be >> considered suspicious. It is a simple matter to allocate part >> of that keyspace to another processor for a double-check. > Please don't do anything like this. This will prevent > people like me who prefer the "random" method from > participating. > Not true, it would be open for anybody to sweep a random space > and report the results. I don't get it. If the challenge is partly secret, how will I know if I crack the code? > The only difference would be that the sweeper who discovered > the real key would not be the first to know of a break ? Sorry, the terminology seems to be over my head here. > and that it would not be possible to attack the crack through > dishonestly claiming to have swept space that hadn't been. That is one reason I like the random method. > You can't ACK something which has not been allocated to you. >> But I could announce it on the list. A clarification: my "it" above refers to a successful cracking of the code. Will French <wfrench(a)interport.net>

2 1

IPSEC Analyst and Engineers Wanted
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Authentication-Warning: silence.secnet.com: majordom set sender to owner-security-jobs(a)secnet.com using -f From: "Meryweather, Rod" <Rod.Meryweather(a)wang.com> To: "'security-jobs(a)secnet.com'" <security-jobs(a)secnet.com> Subject: IPSEC Analyst and Engineers Wanted Date: Wed, 6 Aug 1997 15:51:30 -0400 X-Priority: 3 MIME-Version: 1.0 Sender: owner-security-jobs(a)secnet.com Precedence: bulk WANG GOVERNMENT SERVICES SECURITY SERVICES POSITION OVERVIEW AND SUMMARY Organization Overview The Wang GS Security Services organization is a descendant from the Honeywell Information Systems group that has been focused on developing High Assurance computing solutions for the US Government since the late 1970's. Honeywell was the first vendor to have a system evaluated by the NSA National Computer Security Center (NCSC) against the Orange Book (a document that defines levels of trust that can be reached by operating systems) at the A1 level - the highest - in 1984. Our XTS 300 product is a direct descendent of the A1 SCOMP platform, and is currently evaluated at the B3 level of trust. The Security Services (SS) organization focuses on development and deployment of secure solutions. Product activities are contained in a group focused on the XTS 300 operating system and a trusted guard development framework product (the SAGE). The rest of the organization is focused on implementation of task-specific solutions. These currently include: The DMS/DII Guard: This is a multi-year development effort that will result in a XTS 300-based X.400/X.500 guard with strong user authentication and encryption support (FORTEZZA). The State Department Guard: This is a new project that will implement a proprietary (State-compliant) XTS 300-based telegram network guard that works with identification of unclassified telegrams. The Command and Control Guard: The C2G effort involves the evolution of an existing XTS 300-based Government-owned Guard application that is deployed world-wide. The FBI: Wang currently has developed and deployed multiple IBM communications guards for the FBI, and continues to evolve and enhance the functional capabilities of these XTS 300-based systems. The IRS: This effort does not involve the XTS 300. Rather, Wang is responsible for the EDI telecommunications and security infrastructure of the IRS Tax Collection system, based on an NCR commercial Unix platform. DLA Security Assessment: Wang currently supports the security planning, assessment and accreditation activities with the DLA and the Defense MegaCenter in Dayton, Ohio. General Technical Requirements Excellent C and Unix skills (we do not code in C++ except for the IRS project). Strong structured design and documentation skills. Linux OS on Pentium workstation. Heavy emphasis on one of the following areas: Computer Security, Unix Kernel (device drivers, printer drivers, API, OS construction), Communications (TCP/IP, X.400, X.500, SNMP), Encryption (PCMCIA or software-based), GUI development (X), Testing. MUST be clearable to TS. MUST have a BS degree or equivalent experience. MUST be a self-starter and quick learner. Competitive compensation and benefits, casual dress code, technical organization. Herndon location as of August 1, 1997. See http://www.wangfed.com/products/ssso/homepage.html for product details, http://wang.com for information about Wang. Specific Positions Senior OS Developer (1) Candidate will be a member of the XTS 300 OS development staff, and should have considerable exposure (8-15 years) to the construction and enhancement of a Unix OS. Activities include API development and enhancement, device driver implementation (e.g., printer, SCSI, "console", PCMCIA devices, ethernet (802.3 + 100Mb or ATM)), application porting (e.g., X), bug fixes, and new platform porting (from one Pentium mother board to the next). Orange Book security a BIG plus. Junior OS Developer (2) Candidate will be a member of the XTS 300 OS development staff, and should be very comfortable with heavy structured C and Unix (OS construction, release building from source, etc.) Linux experience a big plus. 2-5 years experience with heavy C, Unix, and at least one of the following: GUI development, application porting on Unix, communications (TCP/IP, X.4/500, SNMP), systems installation and debug, heavy scripts, heavy testing. Orange Book security a BIG plus. XTS 300 GUI Developer Candidate will initially be assigned to the State Department Guard task, and will be responsible for the specification, design, development, implementation, testing and documentation of the man-machine interfaces for this Guard (Main-in-the-Middle review capability, dirty word list management, report generation, etc.). This will be developed with a subset of X (Motif-based). 3-5 years experience in X, C, Unix, documentation, design. Sr. XTS Applications Developer (3) Candidate will be a member of the XTS 300 Application Development focus group, and will be responsible for a lead role in the development of Guard applications. Must have 8-15 years heavy C, Unix, Comm (TCP/IP, X.4/500), structured design, documentation, development, implementation, testing, debug and support. Orange Book Security and Guard/Firewall design a big plus. Jr. XTS Applications Developer (3) Candidate will be a member of the XTS 300 Application Development focus group, and will be responsible for a supporting role in the development of Guard applications. Must have 2-5 years heavy C, Unix, with a focus in one or more of the following: Comm (TCP/IP, X.4/500), structured design, documentation, development, implementation, testing, debug and support. Orange Book Security and Guard/Firewall design a big plus. Accreditation Support/Risk Assessment Candidate will be a member of the DMS/DII Guard Development and Deployment team, and will be responsible for taking a lead role in the assessment and justification of the assurance of the Guard architecture. Required 6-12 years experience with trusted solutions and architectures, X.400/X.500, accreditation and deployment issues. Strong documentation and communications (verbal) experience. Rod Meryweather Sr. Security Analyst Wang Federal, Inc. Rod.Meryweather(a)wang.com 540 Huntmar Park Dr. Wk: (703) 827-3818 Herndon , Va 22102-4299 Fax: (703) 827-3161 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0