December 2003 - cypherpunks-legacy

cryptography eliminates lawyers?
by terrell＠sam.neosoft.com 17 Dec '03

17 Dec '03

>From: "Cortland D. Starrett" <cort(a)bioanalytical.com> >Subject: cryptography eliminates lawyers? >As a follow-up to the article reference I posted, I pose the >following question: > >Will cryptographic technology and information (communication) >technology reduce the need for legal services in the future? >(especially regarding contracts, buying/selling, patent law, etc.) >Will legal services just look different? Will they be more >efficient (cheaper)? > >Put bluntly, will cryptography put lawyers out of business? >Any comments would be appreciated. > >Cort. > How could crypto put lawyers out of business? People would still have disagreements; plans would still go wrong; cars would still crash. More important, transactions would still need to be structured to carry out the desires of the parties while minimizing risks. Good communications technology, including crypto, could make lawyering more efficient, but I suspect the savings would be minimal. Communications technology will no more put lawyers out of business than CASE put programmers out of business. Buford C. Terrell 1303 San Jacinto Street Professor of Law Houston, TX 77002 South Texas College of Law voice (713)646-1857 terrell(a)sam.neosoft.com fax (713)646-1766

4 7

AOL Porno
by Duncan Frissell 17 Dec '03

17 Dec '03

Will the federal prosecutors and Fibbies on this list please emphasize that the Internet was not involved in the AOL kiddie porn case. The Internet has enough opportunities for bad publicity as it is. DCF "Who wonders: How it is that CompuServe was able to exist from 1979 to the arrival of Prodigy and AOL without major sex, and drugs, and rock and roll problems?"

2 1

Re: DD, pedaphiles, and Terrorists, oh my
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

September 13, 1995 PRESS BRIEFING BY MIKE MCCURRY [Snip] MR. MCCURRY: ... [The President]'ll be making some fairly significant news on Thursday. So he'll be very busy next week. Q News? What kind of news? Q News on what? MR. MCCURRY: You'll see next week. [Snip] Q What about Thursday -- Q Are you going? MR. MCCURRY: Half and half, I think. I'll go -- I think there are some days that look more political; I don't think it's necessary for me to be there. Q What will be the general topic on Thursday? MR. MCCURRY: On Thursday? Technology. [Snip to end] URL: http://docs.whitehouse.gov/white-house-publications/ 1995/09/1995-09-13-press-briefing-by-mike-mccurry.text ---------- Any scuttlebutt that computer security, the Internet or encryption are the "technology?" Or related to the NYT spin today on LEA-web-snooping: "We are not going to permit exciting new technology to be misused to exploit and injure children," Attorney General Janet Reno said today in announcing the arrests. The culmination of the inquiry by the Federal Bureau of Investigatlon comes at a time when the agency has needed some favorable attention to offset a string of incidents that have cast it in a negative light. Its officials have come under fire for their role in the siege at Waco, Tex., the standoff with a white separatist in Idaho and, most recently, over an attempt to cover up aspects in the Idaho incident. Or diversion from the allegations of Special Agent Whitehurst that Feeb lab rats and bosses are corrupt -- tar-morphing even Golden Boy Freeh. Pray that kid-loving Reno HRTs the abusive brats.

1 0

[NOISE] Alice's Remailer site (was:Re: Digital Fingerprinting)
by Peter Trei 17 Dec '03

17 Dec '03

> From: patrick(a)Verity.COM (Patrick Horgan) > > From: Mac Norton <mnorton(a)cavern.uark.edu> > > To: Patrick Horgan <patrick(a)Verity.COM> > > On Wed, 13 Sep 1995, Patrick Horgan wrote: > > > > > Then, in W.Ky., as in Stockbridge, "You can get > > > > > anything you want..."? :) > > > Why do I feel like I'm sitting on the group W bench? > > I don't know, kid, what you in for? > Encryption. And they all moved away from me on the group W bench there, > talking mean hairy eyeballs and all sorts of things until I said, and > annoying the NSA, and they all moved back, talking about crime, PEM, PGP, > and liberty and justice for all;) > Patrick I've seen various 'Alice Restaurant' pastiches, Alice's NNTP server, Alices MIT GUI, etc. I guess it's time to try to do one for crypto.... This song is called Alice's Remailer site and it's about Alice, and the remailer site, but Alices Remailer site is not the name of the Remailer site, it's the name of the song, and that's why I called this song Alice's Remailer site. You can send anything you want through Alices Remailer site. You can send anything you want through Alices Remailer site. Connect right in it's around the back. Halfway down that seventeen inch rack. You can be anyone you want through Alice's Remailer site. etc.... Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

2 1

Re: CYPHERPUNK considered harmful.
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Just a couple of comments, one on a question and one on an answer. > > >Q: Aren't LEAs worried that strong encryption will make it more > >difficult for them to catch crooks? If this is for non-cypherpunks, you should say what an LEA is. They wouldn't understand your question. (Shoot, some cypherpunks are probably going, "Huh?") > > >Q: What's this 'key escrow' thing? > > > >A: Some government agencies have been trying to figure out methods which > >simultaneously permit US citizens to use strong cryptography against > >criminal eavesdroppers, while retaining the ease with which LEAs can > >currently tap your calls. The schemes generally involve something > >mistitled 'key escrow', in which copies of cryptographic keys would be > >stored at sites accessible by LEAs. > > 'key escrow' is a code word for government access to the unencrypted > message. It is a persistent theme, dating back to the NSA's CCEP in about You probably need to say what the NSA is, and certainly have to identify CCEP. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: NSA on GAK
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:01 PM 9/14/95 -0400, Adam Shostack wrote: > > "Help me understand here. You say that serious users of >encryption don't use software distributed via network. In that case, >you would have no objection to PGP being exported, as serious users of >encryption don't use it?" Were that true, then they wouldn't be on the Internet either because the Internet runs on software distributed over the Internet. DCF

2 1

Things the LEAs don't want to admit.
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Andrew Loewenstern writes: <snip> >Encryption prevents 'fishing expeditions' and >unauthorized monitoring; this is what the LEAs don't want to admit. AMEN, Andrew. Another thing the LEAs don't want to admit is the incredible (cost and otherwise) effectiveness of the "Honey Trap" (SEX!) when used by (or against) them. Cash isn't the only way to recruit another Aldrich Ames(sp?), and sex is a lot easier to launder. <g> JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMFh3P21lp8bpvW01AQGiawP/RbB0VL2wQ4zp712EEHt3IKz+HQpM8rjY KXXMMTdMpryBX2pWZRxm82ewYwiSwI2U+Ij67jQ+9Ev2/S1WgVCiV+se05oZ8n85 QkWI182G+Bk4JJ46/LwBDFos8gp9WRYCoRVFgA5SmV92r05MpPnrtzNUCG31D8vd FsB+JDwnZQ8= =rUVo -----END PGP SIGNATURE----- Regards, Jim Ray "When making public-policy decisions for the government, I think one should ask oneself which technologies would best strengthen the hand of a police state. Then, do not allow the government to deploy those technologies." -- Phillip Zimmermann, talking to himself. (Congress sure-as-hell wasn't paying attention!) ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James M. Ray <liberty(a)gate.net> ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

1 0

Re: GAK
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>So would an FBI camcorder in every room of every house. >The question is where to draw the line, and I'd rather >let the lines draw themselves, as opposed to having >citizens be compelled to draw them. The telephone >system, Mr. Freeh's preferred analog, is inherently >susceptible to tapping, but what if it were not, and >every telephone were required to be equipped with >a government tap switch, subuect to warrant, of course? While not every telephone, every telephone switch is required to be tap capable - The Digital Telephony Act. Note there is provision for the government to pay costs for Telcos to make their phones tappable - as yet unfunded by Congress. The rights of The People have clearly collided with the interests of Law Enforcement. Guess who Congress likes better?

1 0

MOSS [IETF privacy-enhanced mail, modified for MIME] now available
by Rich Salz 17 Dec '03

17 Dec '03

>From pem-dev-request(a)neptune.tis.com Wed Sep 13 19:27:35 1995 Message-Id: <9509132011.AA19261(a)tis.com> Reply-To: James M Galvin <tismoss-support(a)TIS.COM> To: "MOSS.Announce.List":;, tis.com(a)TIS.COM Subject: ANNOUNCE: TIS/MOSS Version 7.1 Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----- =_aaaaaaaaaa0" Content-Id: <2977.811023088.1(a)tis.com> Date: Wed, 13 Sep 1995 16:11:35 -0400 ------- =_aaaaaaaaaa0 Content-Type: text/plain; charset="us-ascii" Content-ID: <2977.811023088.2(a)tis.com> Trusted Information Systems, Inc. (TIS), in cooperation with RSA Data Security, Inc. (RSADSI), is pleased to provide TIS/MOSS, a reference implementation of MIME Object Security Services (MOSS). TIS/MOSS is a security toolkit that provides digital signature and encryption services for MIME objects. TIS/MOSS includes the "glue" necessary for integration with Version 6.8.3 of the Rand MH Message Handling System, in addition to generic Bourne shell scripts that make it possible to use it with email user agents supporting UNIX shell escapes. In order to foster acceptance of MOSS and provide the community with a usable, working version of this technology, TIS/MOSS is being made available for broad use on the following basis. TIS/MOSS is distributed in source code form, with all modules written in the C programming language. It runs on many UNIX derived platforms. It includes a DOS compilation directive that facilitates its port to DOS/WINDOWS. TIS/MOSS requires RSAREF, a cryptographic toolkit distributed by RSADSI. TIS/MOSS makes use of undocumented features of RSAREF. RSADSI has given permission for users of TIS/MOSS to use these features, subject to the terms and conditions of both the TIS/MOSS and RSAREF licenses, as distributed with each software package. TIS/MOSS is a product of Trusted Information Systems, Inc. It may be used by organizations and users for exchanging MOSS email messages, subject to the terms and conditions of its license. Enclosed below is the MOSS Frequently Asked Questions, which includes instructions on how to retrieve the software. TIS/MOSS is export controlled by the U.S. Government. As a result it is only available to U.S. and Canadian sites and individuals. Please see the FAQ for more information. ------- =_aaaaaaaaaa0 Content-Type: text/plain; charset="us-ascii" Content-ID: <2977.811023088.3(a)tis.com> Content-Description: TIS/MOSS FAQ TIS/MOSS Frequently Asked Questions Last Updated July 1995 Send questions and comments to tismoss-support(a)tis.com Questions answered: 1) What is MIME Object Security Services (MOSS)? 2) What is MIME? 3) How does MOSS compare to PGP and PEM? 4) Where is the MOSS standard defined? 5) Are there implementations of MOSS available? 6) How do I get TIS/MOSS? 7) Why is TIS/MOSS only available in the US and Canada? 8) Are special privileges (e.g., root access) required to install TIS/MOSS? 9) What about integrating TIS/MOSS into email user agents? 10) What about DOS and other non-UNIX platforms? 11) Is there a forum for MOSS users and developers? 12) What about certificates? 13) What is the Internet Certification hierarchy? 14) What if I have questions or problems with TIS/MOSS? * means that this entry has been recently updated. + means that this entry has been added recently. 1 Q: What is MIME Object Security Services (MOSS)? A: MOSS is a Privacy Enhanced Mail (PEM) derivative that is a Proposed Internet Standard for adding security services to Multi-purpose Internet Mail Extensions (MIME). It uses the cryptographic techniques of digital signature and encryption to provide origin authentication, integrity, and confidentiality to MIME objects. Users of MOSS can know who originated a message, that the message has not been changed enroute, and that the message was kept secret from everyone except the intended recipients. MOSS depends on the existence of public/private key pairs to support its security services. Users must exchange public keys with those other users with whom they wish to exchange MOSS email. This may be accomplished manually, via mechanisms available in the protocol, via X.509 certificates, or any other suitable mechanism. 2 Q: What is MIME? A: MIME is an Internet Standard (RFC 1521) that defines the format of email message bodies to allow multi-part textual and non-textual message bodies to be represented and exchanged without loss of information. MIME does for message bodies what RFC822 does for message headers. 3 Q: How does MOSS compare to PGP and PEM? PGP can provide the same services but since it is not integrated with MIME the interpretation of the protected content is necessarily user controlled. Note, however, that MIME can carry a PGP object. MOSS is a PEM derivative. It integrates the security services of PEM with MIME, taking advantage of the extensive structuring and formatting facilities of MIME, limited versions of which are necessarily an integral part of the PEM specifications. 4 Q: Where is the MOSS standard defined? A: There is a Proposed Standard published as an RFC that specifies MOSS. This document may be found in your favorite RFC repository. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to "rfc-info(a)ISI.EDU" with the message body "help: ways_to_get_rfcs". For example: To: rfc-info(a)ISI.EDU Subject: getting rfcs help: ways_to_get_rfcs 5 Q: Are there implementations of MOSS available? A: Yes, Trusted Information Systems (TIS), under ARPA sponsorship, has released a reference implementation of MOSS (TIS/MOSS) to the Internet community. TIS/MOSS is a UNIX-based implementation that is easily integrated with email user agents. The source code is openly available in the United States and Canada for non-commercial use. The current version of TIS/MOSS is 7.1. Vendors interested in including TIS/MOSS in their products or integrating it with their services should contact Trusted Information Systems about licensing Trusted Mail (tm) by sending email to tismoss-support(a)tis.com. 6 Q: How do I get TIS/MOSS? A: TIS/MOSS is available via anonymous ftp in the United States and Canada to US and Canadian citizens and people with a US "green card." To retrieve TIS/MOSS please FTP to host: ftp.tis.com login: anonymous and retrieve the files pub/MOSS/README pub/MOSS/LICENSE pub/MOSS/BUGS The README file contains further instructions. 7 Q: Why is TIS/MOSS only available in the US and Canada? A: The export from the United States of the cryptography used in TIS/MOSS is controlled by the United States government. 8 Q: Are special privileges (e.g., root access) required to install TIS/MOSS? A: No. 9 Q: What about integrating TIS/MOSS into email user agents? A: TIS/MOSS includes "glue", in the form of shell scripts, to integrate it with the Rand MH Message Handling System version 6.8.3. It also includes generic scripts that make the services accessible to any UNIX application that supports shell escapes. If you integrate TIS/MOSS with a popular email user agent, we would be happy to make it available to others. 10 Q: What about DOS and other non-UNIX platforms? A: TIS/MOSS has been ported to DOS and includes a DOS compiler option that may be set to facilitate its installation in DOS environments. It has also been ported to Macintosh although it does not yet include a MAC compiler option. If you port TIS/MOSS to other platforms, we would be happy to make the changes available to others. 11 Q: Is there a forum for MOSS users and developers? A: Yes, there is an email list for users of TIS/MOSS called "tismoss-users(a)tis.com". To get added to the list send a message to "tismoss-users-request(a)tis.com". There is an email list for implementors and discussions of the MOSS specifications called "pem-dev(a)tis.com". This list originated with the PEM protocol, from which MOSS is derived. To get added to the list send a message to "pem-dev-request(a)tis.com". 12 Q: What about certificates? A: TIS/MOSS supports the use of X.509 certificates including creation, validation, certificate revocation lists, distribution, and destruction. Users may embody their public key in a certificate and may participate in the Internet certification hierarchy or some other private hierarchy. TIS/MOSS neither requires nor enforces any certification hierarchy policy. 13 Q: What is the Internet Certification hierarchy? A: The Internet Certification hierarchy is defined by RFC1422. It is a tree structured hierarchy of certificates with a single, global root called the Internet PCA Registration Authority (IPRA). The IPRA issues certificates to Policy Certification Authorities (PCAs) who issue certificates to Certification Authorities (CAs) who may issue certificates to users or subordinate CAs. Identities are based on distinguished names and there are restrictions on their form and content. For more information on becoming a PCA see the IPRA WWW page at: http://bs.mit.edu:8001/ipra.html or contact the IPRA at: ipra-info(a)isoc.org For more information on becoming a CA under the TIS PCA contact: tispca-info(a)tis.com 14 Q: What if I have questions about or problems with TIS/MOSS? A: Send them to "tismoss-support(a)tis.com". ------- =_aaaaaaaaaa0 Content-Type: multipart/signed; protocol="application/moss-signature"; micalg="md5"; boundary="----- =_aaaaaaaaaa1" ------- =_aaaaaaaaaa1 Content-Type: text/plain; charset="us-ascii" Content-ID: <2977.811023088.5(a)tis.com> Trusted Information Systems, Inc. (TIS), in cooperation with RSA Data Security, Inc. (RSADSI), is pleased to provide TIS/MOSS, a reference implementation of MIME Object Security Services (MOSS). TIS/MOSS is a security toolkit that provides digital signature and encryption services for MIME objects. TIS/MOSS includes the "glue" necessary for integration with Version 6.8.3 of the Rand MH Message Handling System, in addition to generic Bourne shell scripts that make it possible to use it with email user agents supporting UNIX shell escapes. In order to foster acceptance of MOSS and provide the community with a usable, working version of this technology, TIS/MOSS is being made available for broad use on the following basis. TIS/MOSS is distributed in source code form, with all modules written in the C programming language. It runs on many UNIX derived platforms. It includes a DOS compilation directive that facilitates its port to DOS/WINDOWS. TIS/MOSS requires RSAREF, a cryptographic toolkit distributed by RSADSI. TIS/MOSS makes use of undocumented features of RSAREF. RSADSI has given permission for users of TIS/MOSS to use these features, subject to the terms and conditions of both the TIS/MOSS and RSAREF licenses, as distributed with each software package. TIS/MOSS is a product of Trusted Information Systems, Inc. It may be used by organizations and users for exchanging MOSS email messages, subject to the terms and conditions of its license. Enclosed below is the MOSS Frequently Asked Questions, which includes instructions on how to retrieve the software. TIS/MOSS is export controlled by the U.S. Government. As a result it is only available to U.S. and Canadian sites and individuals. Please see the FAQ for more information. ------- =_aaaaaaaaaa1 Content-Type: application/moss-signature Content-ID: <2977.811023088.4(a)tis.com> Content-Transfer-Encoding: quoted-printable Version: 5 Originator-ID: PK,MHkwCgYEVQgBAQICAwADawAwaAJhAMAHQ45ywA357G4fqQ61aoC1fO6B= ekJmG4475mJkwGIUxvDkwuxe/EFdPkXDGBxzdGrW1iuh5K8kl8KRGJ9wh1HU4TrghGdhn0Lw8g= G67Dmb5cBhY9DGwq0CDnrpKZV3cQIDAQAB,EN,2,galvin(a)tis.com MIC-Info: RSA-MD5,RSA,jZjz1ope/QCf2IwPfkXfB+0bNJsFqJny+xVqjyFaW6QAY0Oy4dru= PxTgYleEFG2qQBP6rbNiucG7g254ClV6hUMG6ksd+qFioFvxqsJ15WylN7Addo/QCzknzhRo45= 6l ------- =_aaaaaaaaaa1-- ------- =_aaaaaaaaaa0 Content-Type: text/plain; charset="us-ascii" Content-ID: <2977.811023088.6(a)tis.com> Content-Description: TIS/MOSS FAQ TIS/MOSS Frequently Asked Questions Last Updated July 1995 Send questions and comments to tismoss-support(a)tis.com Questions answered: 1) What is MIME Object Security Services (MOSS)? 2) What is MIME? 3) How does MOSS compare to PGP and PEM? 4) Where is the MOSS standard defined? 5) Are there implementations of MOSS available? 6) How do I get TIS/MOSS? 7) Why is TIS/MOSS only available in the US and Canada? 8) Are special privileges (e.g., root access) required to install TIS/MOSS? 9) What about integrating TIS/MOSS into email user agents? 10) What about DOS and other non-UNIX platforms? 11) Is there a forum for MOSS users and developers? 12) What about certificates? 13) What is the Internet Certification hierarchy? 14) What if I have questions or problems with TIS/MOSS? * means that this entry has been recently updated. + means that this entry has been added recently. 1 Q: What is MIME Object Security Services (MOSS)? A: MOSS is a Privacy Enhanced Mail (PEM) derivative that is a Proposed Internet Standard for adding security services to Multi-purpose Internet Mail Extensions (MIME). It uses the cryptographic techniques of digital signature and encryption to provide origin authentication, integrity, and confidentiality to MIME objects. Users of MOSS can know who originated a message, that the message has not been changed enroute, and that the message was kept secret from everyone except the intended recipients. MOSS depends on the existence of public/private key pairs to support its security services. Users must exchange public keys with those other users with whom they wish to exchange MOSS email. This may be accomplished manually, via mechanisms available in the protocol, via X.509 certificates, or any other suitable mechanism. 2 Q: What is MIME? A: MIME is an Internet Standard (RFC 1521) that defines the format of email message bodies to allow multi-part textual and non-textual message bodies to be represented and exchanged without loss of information. MIME does for message bodies what RFC822 does for message headers. 3 Q: How does MOSS compare to PGP and PEM? PGP can provide the same services but since it is not integrated with MIME the interpretation of the protected content is necessarily user controlled. Note, however, that MIME can carry a PGP object. MOSS is a PEM derivative. It integrates the security services of PEM with MIME, taking advantage of the extensive structuring and formatting facilities of MIME, limited versions of which are necessarily an integral part of the PEM specifications. 4 Q: Where is the MOSS standard defined? A: There is a Proposed Standard published as an RFC that specifies MOSS. This document may be found in your favorite RFC repository. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to "rfc-info(a)ISI.EDU" with the message body "help: ways_to_get_rfcs". For example: To: rfc-info(a)ISI.EDU Subject: getting rfcs help: ways_to_get_rfcs 5 Q: Are there implementations of MOSS available? A: Yes, Trusted Information Systems (TIS), under ARPA sponsorship, has released a reference implementation of MOSS (TIS/MOSS) to the Internet community. TIS/MOSS is a UNIX-based implementation that is easily integrated with email user agents. The source code is openly available in the United States and Canada for non-commercial use. The current version of TIS/MOSS is 7.1. Vendors interested in including TIS/MOSS in their products or integrating it with their services should contact Trusted Information Systems about licensing Trusted Mail (tm) by sending email to tismoss-support(a)tis.com. 6 Q: How do I get TIS/MOSS? A: TIS/MOSS is available via anonymous ftp in the United States and Canada to US and Canadian citizens and people with a US "green card." To retrieve TIS/MOSS please FTP to host: ftp.tis.com login: anonymous and retrieve the files pub/MOSS/README pub/MOSS/LICENSE pub/MOSS/BUGS The README file contains further instructions. 7 Q: Why is TIS/MOSS only available in the US and Canada? A: The export from the United States of the cryptography used in TIS/MOSS is controlled by the United States government. 8 Q: Are special privileges (e.g., root access) required to install TIS/MOSS? A: No. 9 Q: What about integrating TIS/MOSS into email user agents? A: TIS/MOSS includes "glue", in the form of shell scripts, to integrate it with the Rand MH Message Handling System version 6.8.3. It also includes generic scripts that make the services accessible to any UNIX application that supports shell escapes. If you integrate TIS/MOSS with a popular email user agent, we would be happy to make it available to others. 10 Q: What about DOS and other non-UNIX platforms? A: TIS/MOSS has been ported to DOS and includes a DOS compiler option that may be set to facilitate its installation in DOS environments. It has also been ported to Macintosh although it does not yet include a MAC compiler option. If you port TIS/MOSS to other platforms, we would be happy to make the changes available to others. 11 Q: Is there a forum for MOSS users and developers? A: Yes, there is an email list for users of TIS/MOSS called "tismoss-users(a)tis.com". To get added to the list send a message to "tismoss-users-request(a)tis.com". There is an email list for implementors and discussions of the MOSS specifications called "pem-dev(a)tis.com". This list originated with the PEM protocol, from which MOSS is derived. To get added to the list send a message to "pem-dev-request(a)tis.com". 12 Q: What about certificates? A: TIS/MOSS supports the use of X.509 certificates including creation, validation, certificate revocation lists, distribution, and destruction. Users may embody their public key in a certificate and may participate in the Internet certification hierarchy or some other private hierarchy. TIS/MOSS neither requires nor enforces any certification hierarchy policy. 13 Q: What is the Internet Certification hierarchy? A: The Internet Certification hierarchy is defined by RFC1422. It is a tree structured hierarchy of certificates with a single, global root called the Internet PCA Registration Authority (IPRA). The IPRA issues certificates to Policy Certification Authorities (PCAs) who issue certificates to Certification Authorities (CAs) who may issue certificates to users or subordinate CAs. Identities are based on distinguished names and there are restrictions on their form and content. For more information on becoming a PCA see the IPRA WWW page at: http://bs.mit.edu:8001/ipra.html or contact the IPRA at: ipra-info(a)isoc.org For more information on becoming a CA under the TIS PCA contact: tispca-info(a)tis.com 14 Q: What if I have questions about or problems with TIS/MOSS? A: Send them to "tismoss-support(a)tis.com". ------- =_aaaaaaaaaa0--

2 1

Corrections to "Ron Plesser's take on NIST GAK"
by John Gilmore 17 Dec '03

17 Dec '03

There were a few sentences truncated in what I posted yesterday, due to mistakes on my part. Here's the corrections. John ... The Administration policy for 40-bit-key encryption will continue as-is, and no keys will have to be escrowed for such systems. Mr. Nelson said that the government's main concern is that strong encryption products not be available in the mass market. ... bi-lateral agreements with friendly nations. In a presentation, Bob Holleyman of the Business Software Alliance criticized the Administration's failure to "liberalize export controls on generally available software employing non-key escrow encryption." Also, he stated that the Administration's proposal and the draft criteria "continue to reflect a misunderstanding of the market place and, if implemented in anything like their current form, will prevent key escrow encryption from ever being commercially adopted." Mr. Holleyman recommended a number of features for a marketable system, including a variety of encryption algorithms using at least 64-bit keys and user specification of a key holder.

1 0