December 2003 - cypherpunks-legacy

smartcard encryption: revised paper available
by Matt Blaze 17 Dec '03

17 Dec '03

I've put a (slightly expanded) revised version of my paper, "High- Bandwidth Encryption with Low-Bandwidth Smartcards" in my ftp directory. This paper describes a little protocol for exploiting the secure key storage facilities of slow smartcards but with the host processor doing most of the actual work. ftp://ftp.research.att.com/dist/mab/card_cipher.ps -matt

1 0

FWD: International Encryption Protocols
by Weld Pond 17 Dec '03

17 Dec '03

To: "Frank O'Dwyer" <fod(a)fws.ilo.dec.com> cc: firewalls(a)GreatCircle.COM (Firewalls Mailing List) From: Justin Mason <jmason(a)iona.ie> Subject: BoS: Re: International Encryption Protocols Frank O'Dwyer sez: >After all, if the CoCom countries _weren't_ willing to sell each other >crypto equipment, how could they spy on one another? :-) > >(Actually the :-) may not be necessary - I believe there was a story > in the news recently about the UK 'authorities' snooping on Irish > official traffic carried on UK-supplied equipment.) Almost right -- it was the UK surveillance service (GCHQ) snooping on Irish official traffic carried on US-supplied crypto equipment. Apparently, the equipment in question had a "back door", courtesy of the NSA; when GCHQ found out that the Irish govt were using this equipment, they had only to ask their NSA pals for the details. I only heard the details myself via a popular-science program on crypto ;), so the so-called back door may not have been a deliberately weakened algorithm, it may have been a set of keys from an key-escrow repository or some such. --j. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

1 0

Identity database, another attempt...
by Brad Dolan 17 Dec '03

17 Dec '03

Well, you ungrateful wretches objected to our great employment database and national ID card plans when they were presented as a means of immigration control. How about this, then: We need an employment-tracking database and licenses for everything so we can crack down on "deadbeat dads." Now that sounds more plausible, doesn't it! Please? We really want to track you closely. It's for your own good, you know. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - AP reported on 10/12/95: Deadbeat parents beware: Pay up or lose your license. And not just your driver's license. Your hunting, fishing, trapping, boating, occupational and professional licenses may be taken away too. That's the promise that Congress, intensifying the fight against parents who refuse to support their children, intends to send to millions of deadbeats as it writes final legislation to transform the nation's anti-poverty programs. ... Central to [House and Senate proposals ...] is a requirement that every state have a program to revoke or restrict the licenses of parents who fail to pay, along with a central registry to track new hiring and match employment records with child support obligations. ... [Can you say "10th Amendment," Robert Dole? I knew you could! You are against this, aren't you Bob? Bob? Bob??!!] The Department of Health and Human Services ... estimates that if every state had a license revocation program in place, child support collections would grow by $2.5 billion over 10 years. [During which time the federal government will spend $20,000 billion. Relative peanuts, in other words.] According to HHS, 32 states and Puerto Rico now have laws on the books to restrict or revoke driving privileges and professional, occupational or sporting licenses. ... ^^^^^^^^^^ [Note that driving, necessary for living in most places, is now a *privilege* granted by the government. In other words, *living* is a government-granted privilege.] Paula Roberts, a child support expert with the Center for Law and Social Policy, a liberal research and advocacy group in Washington, said license revocation programs can be effective -- but only if states have the necessary computers in place. ... Essay questions for extra credit: (1.) Explain how an advocate of the proposed system of monitoring and control could be considered "liberal." Or "conservative." (2.) How many (ab)uses of this system are possible and how long will it take for them to be implemented? (3.) Compare and contrast this plan with the Soviet internal passport / labor book system.

5 4

Anguilla Cypherpunks Meeting
by Vincent Cate 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ANGUILLA CYPHERPUNKS MEETING The meeting will be held at my house, Sunday Oct 29. My address is "Old Ta". Really, we have only a couple named streets in this country and no street signs or addresses. My area is called "Old Ta" because the Old Water Tower was near me. :-) If you don't know where I live you are probably off-island, and I can just pick you up at the airport. You are welcome to stay the week around the meeting (like Oct 25 to Nov 1 or some such). Anguilla is a fantastic little country in the Caribbean with wonderful beaches and no taxes. I have been living here for almost a year now and just love it. Right now American Airlines has some specials on that make flying to Anguilla a bit cheaper than normal. For example: New York to Anguilla $365.95 rt San Jose to Anguilla $574.95 rt For these prices the tickets must be purchase by Oct 16th. Please let me know if you are coming so I will be sure to have enough space. If we get too many people we may need some airmattresses or something. It is warm here, so sleeping bags are not needed. If while you are outside the USA you want to write some software that uses encryption and sell it worldwide, let me know. I could put you up while you wrote it and my company could sell it for share of the selling price. Let me know what you are thinking of and how long you think it would take. -- Vince -----BEGIN PGP SIGNATURE----- Version: 2.6.i iQCVAgUBMH0ZDsh6X5WuK8MNAQFqZAP+IF9OvHRsCFuRVGxH3q9jSC8Hh5rxvv9C Z6xD52PdxADM5RLxOwiuhWITStbpNL9R4T+v+mu6VnjPgifnORrS7mEM4tsmWTLT 9LJ9R4p8Q51hjXy889AOcB6Tl0rmkXouRklzYKeq/m0PnL2smt6WDF3owgq65c73 4/odioz0Oic= =6pbC -----END PGP SIGNATURE-----

7 9

Re: NYT on Internet Flaws
by Vincent Cate 17 Dec '03

17 Dec '03

The NYT claim was about as sensible as saying MS-DOS is the structure of the Internet and is not safe, so the Internet is not safe. We could as well have viruses spreading on floppies for MS-DOS (there are far more people on the Internet using MS-DOS than NFS) that cause your MS-DOS Netscape to send the unencrypted credit card numbers off to a certain anonymous email address. Now watch, someone will try this. Oh well. It really has nothing to do with the Internet or Netscape. I hope Markoff gets this: The fact that Internet communication is not inherently secure does not mean that it can not be made secure. Note that an insecure phone-line can be made secure by using a phone with a scrambler. The same can be done on the Internet and is being done - by companies like Netscape. By far the biggest obstacle to a secure Internet is the governments ITAR regulations. This has made it impractical to put real security into NFS, FTP, Unix, and WWW. Many of our current security problems are really due to "the basic structure of ITAR" but none are due to the "basic structure of the Internet". It sort of pains me to see this kind of hype, but it will probably push companies to get real security faster. So in the long run it may not be such a bad thing. Also, it may be easier to pressure the government to get rid of the ITAR restrictions. And they say any publicity is good publicity, so it probably will not really hurt the Internet at all. -- Vince > San Francisco, Oct. 10 -- Newly publicized weaknesses in > the basic structure of the Internet [...] >[...] > The problem is not Netscape's alone; it potentially affects > any organization that operates a computer from which files > or software could be downloaded over the Internet. The > weakness can be traced to the technical underpinnings of > the network, [...] > > The disclosure of the flaws casts doubt on the aspirations > of companies like Netscape, which last summer had one of > the most successful stock offerings in Wall Street history > based on the promise of the impending arrival of a > full-fledged on-line marketplace. >[...] > The newly publicized weakness occurs in a widely used > Internet protocol -- or technical standard -- known as the > Network File System, or NFS. Because NFS does not have any > means for allowing the recipient of a program or document > to verify that it has not been altered during transmission > from the file server to the user, any interception or > tampering would go undetected.

2 1

Smart Card Target
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Partnership Targets Billion Dollar Smart Card Market Denver, October 11 -- Racom Systems Inc. has entered into a multi-million dollar partnership with Rohm Co. Ltd, a Japanese company, to manufacture the ferroelectric chips used in contactless, battery-free smart cards. The deal also calls for Rohm to manufacture a new generation of advanced microprocessor-based chips currently under development for use in high-security financial applications. Rohm is currently starting up a new 0.6 micron wafer fabrication operation in Kyoto, Japan, dedicated to the high-volume manufacture or ferroelectric chips, and has licensed Racom's contactless, battery-free technology specifically for the Japanese market. Racom said the cards are already in use in over 100 installations worldwide. Racom spokesperson Laura Keane said the ferroelectric-based smart cards, which exchange information with readers via radio waves instead of being passed through a reader like a credit card, are used for electronic ticketing: automatic fare collection on buses, subways and trains, electronic point-of-sale, and electronic benefits transfer. Racom said the new cards are superior to the earlier smart cards that use conventional semiconductor technologies because of their unique combination of high-speed, low-power, non-volatile operation, and high reliability. The new smart cards have the ability to store as many as 16 different accounts, said Keane. It could hold your checking account, credit card account, let you pay for a bus or train ticket, and allow you access to controlled areas within your workplace. Keane spoke about some of the card's advantages. In automatic fare collection, users no longer have to carry the correct change or tokens, waiting times to board are reduced, and the risk of robbery of bus, subway and train operators is reduced since they have less cash on board. "It's a stored value card," said Keane. "You put money on the card and daily as you use it you wave it over an antenna and it deducts the fare for that day." Keane said electronic ticketing primarily benefits the frequent traveler. The user would simply wave their card over an antenna at a kiosk in the terminal after selecting their destination and class of accommodation for immediate ticketing. The card would have your seating preference and frequent flyer number recorded and would provide that information to the ticket machine. According to Jerome Svigals, publisher of Smart Cards & Comments and a consultant to the electronic banking industry, contactless technology is very valuable to the user because of its speed, convenience, ease of use, low cost and perhaps most importantly its security. "Even more significant is this smart cards' ability to manage multiple applications with contactless technology that ensures the highest long-term data integrity, especially important for electronic purse requirements," said the industry consultant. Press contact: Laura Keane, Racom Systems, 800-789-7627; Public contact: 800-789-7627.

2 1

Netscape 2.0b1J still core dumps on Java
by Raph Levien 17 Dec '03

17 Dec '03

I pointed the latest beta (Solaris 2.4) towards this URL: http://java.sun.com/JDK-prebeta1/applets/CardTest/example1.html ...and, lo and behold, it core dumped with a Bus error. It's unlikely that the bug is in Java itself, as I was able to successfully run the example from Sun's JDK appletviewer. Not impressed yet. Raph

3 2

netscape 2 certification authorities
by Adam Shostack 17 Dec '03

17 Dec '03

The new betas of Netscape store CA trust stuff in a NDBM database. Does anyone have good tools for looking at NDBM stuff? Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

4 3

http://www.cs.berkeley.edu/~raph/javatest.html
by Raph Levien 17 Dec '03

17 Dec '03

Plcurechaxf jevgr pbqr! Encuc

1 0

Yes, indeed the PA law is for real!
by Tom Edwards 17 Dec '03

17 Dec '03

Well folks, you can go view the new PA law yourselves at URL http://moose.erie.net/~italo/rssb655.html PA Senate Bill 655 was signed into law on June 13, 1995, and it does appear to make non-logged anonymous remailers illegal. -Thomas

3 2