December 2003 - cypherpunks-legacy

authenticating intrahost crypto providers
by jleppek＠suw2k.hisd.harris.com 17 Dec '03

17 Dec '03

I have been doing some research on the development of an abstract security services API(not just a CAPI) and have hit a road block. The problem revolves around the need to authenticate a security service provider to an application. I noticed that microsoft has followed a path of providing a signature in each external provider but the feeling is that this is not that difficult to circumvent. I have the same misgivings but cannot come up with anything else. Are my misgivings unfounded??? What are some other possibilities to allow intrahost (application) authentication of services. Do you need to actually have a cryptographic binding of services? Comments.... Jim Leppek jleppek(a)suw2k.hisd.harris.com Harris Corporation

1 0

Indecent Trash
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 10 Jan 96 at 10:42, t byfield wrote: > At 10:26 PM 1/9/96, Alexander 'Sasha' Chislenko wrote: > > >- Landfills: They are probably the richest source of detailed > > historical information that is not obtainable from any > > other source and can be used to reconstruct the detailed > > history of society, economy, technology and any single > > person with incredible detail. > I ain't holding my breath until someone develops a search > engine for Fresh Kills. I can see it now... about the time that Grandson of Altavista finally yields a URL for Jimmy Hoffa's body in some dump somewhere the government will have figured out that it's so much simpler to catalog the stuff on the way IN, when all the artifacts are fresh and unmixed. While we're all watching what the government does to intercept packets, they will be routing *trash* packets through mysterious "garbage routers." As the stink grows stronger, someone will conceive of anonymous trash forwarders. They will accept unidentified trash, no questions asked, anonymize it with random DNA and fingerprint whorls, and sneak it into public trash receptacles. DNA generators will enable the mischievous to plant fabricated indications that Hillary did indeed have something going with Vince, the late Khomeini (hey, hard is hard, right?) as well as legions of four-footed friends, confirming the suspicions of multitudes. As the piles of trash-based data grow, some Senator from Nebraska will sound the alarm that kids are too easily exposed to the indecent signs of private behavior retrievable on the Net and will propose draconian measures to hold everyone responsible for their contributions to the city landfill. Public receptacles will be closed. Trash will only be collected from registered Identifed Surplus Providers (ISP's). $250,000 fine for disposing of a condom in a dump accessible from the Internet... 10 years in prison for carelessly tossing those nasty Polaroids in the kitchen compactor. The trash of the world will have to be made safe for kids to view. Everything will be a lot easier to trace and control if the garbage input is fully identified. Barcodes on trash bags might do for starters. Access to the garbage system might have to be restricted to those 18 and over. Trash collectors could be made responsible for content, drafting them without pay into the ranks of the trash police. People could be encouraged to report suspicious trash, and trash-related activities like neighbors sneaking out at night to place an innocent-looking compactor bag down the block with someone else's trash. For their own protection, youngsters might be required to retain all their garbage until age 18 and then, in a solemn ceremony worthy of the true significance of coming of age, pitch it all (duly anonymized to prevent abuse of minor indiscretions) from their new position as lawful participants in the world garbage system, friends and well-wishers trying to applaud and hold their noses at the same time (try it -- if you're not careful you can break your own nose, but hey, that'll work, too!). Who knows? Maybe Heinlein's advocacy of keeping kids in a barrel and feeding them through a hole until age 18 will enjoy resurgence among the compulsively protective while the Web meanwhile will provide real time underground data on Heinlein's rpm rate. Protecting the trash of youth will, however, give rise to the hiding of adult trash among that of the underaged. The government will have to root out offenders and "impute" suspicious trash to the parents. Those with no visible source of trash will of course be suspect, and will have to emit innocent trash to cover themselves. This will give rise to the practice of "trash laundering," in which agents convert nasty trash to innocuous trash that may then be tossed into any monitored, controlled channels with no repercussions. Trash laundering will become a grave offense to the accompaniment of government and Ad Council PSA's and free brochures from Pueblo, Colorado. Blatant offenders who have fled to foreign climes will be kidnapped, some will be tortured, because the War Against Filth will be a moral commitment of the national body. Foreign governments headed by suspected trash traffickers will be toppled in quickie invasions, their leaders brought back in chains to disappear into federal dungeons. Public debate will center on the legalities and rationalizations of using the military in policing domestic trash, while agencies such as the FBI cry for more budget to fight the scourge that threatens the decency of the nation's repositories. Control of trash will spread inevitably to control of liquid wastes, whereupon a terrible discovery will be made: Everyone, but everyone, emits unspeakable bodily products. At that point the government will have no choice but to reluctantly declare everyone an outlaw and execute the populace. It's all as logical as what happens when you introduce division by zero way down at the bottom of the complex equation where it isn't so noticeable. We Jurgar Din (that will have to suffice: I do not yet live in a free country) +"The battle, Sir, is not to the strong alone. It is to the+ +vigilant, the active, the brave. Besides, Sir, we have no + +election. If we were base enough to desire it, it is now + +too late to retire from the contest." -Patrick Henry 1775 + -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMPS/PEjw99YhtpnhAQH1UQH5AdXBd7AvG6xT7x/cTXf5W1cAUXzoJ+GB N0/SPrdoJnbUSN5LkJDwoVwA/eiL6/LVN9CjtmQwmydyBysM7M/7Xw== =q+CF -----END PGP SIGNATURE-----

1 0

NSA vacuuming down Internet traffic
by John Young 17 Dec '03

17 Dec '03

Responding to msg by nobody(a)REPLAY.COM (Anonymous) on Fri, 19 Jan 10:23 AM >In the 1960's - 1970's when international cable traffic >was in its computer infancy, access was had to EVERY >CABLE MESSAGE passing through the message switches of >U.S. common carriers. > >If anyone else wishes to move this from the status of >urban legend to something more solid, all they have to >do is locate and ask people who worked in message >switch operations at RCA Global Communications, ITT >World Communications, or Western Union International, >the three common carriers of that time. > >We Jurgar Din Yes, indeed. James Bamford in "The Puzzle Palace" details the long-term TLA-access to international cable traffic -- via Operation Shamrock -- beginning in 1945 and ostensibly ending in 1975. See Chapter 6, "Targets." Aside, in this chapter Bamford writes that Louis Tordella, who died earlier this week, "The Agency's chief keeper of the secrets," was central to targeting of thousands of Americans. Bamford says of Tordella, "If NSA was the darkest part of the government, Tordella was the darkest part of the NSA." Tordella allegedly shielded various NSA heads by not telling them what was going on -- to their great relief. David Kahn in "The Codebreakers" more extensively examines the history of spying on citizens in the national interest. It will be interesting to read what he is currently researching at the more PR-oriented NSA -- and perhaps provide pointers to deep-blacker orgs that have supplanted it through non-FOIA arrangements like those of Shamrock.

1 0

FAT_bet
by John Young 17 Dec '03

17 Dec '03

Saturday The Wash Post reported on the spies of many stripes invading Bosnia to strut stuff and ward off extinction. Today, TWP and NYT cover an IC briefing yesterday -- prompted by the Post story -- on the campaign of global spying cooperation to survive liposuction. FAT_bet (the 3 articles)

1 0

Re: CryptoAPI and export question
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:07 1/17/96, Tom Johnston wrote: >Two points: the CSP development kit is export-controlled; and signing a >CSP developed by a foreign vendor is treated as a export -- so the signature >is export-controlled. > >We would ship a CSP development kit to a foreign vendor, and sign a CSP >developed by the foreign vendor, but only with the appropriate export licenses. So the main thing that the new MS CSP accomplishes is to establish a standard that will prevent foreigners at the OS level from using real crypto with popular applications. Way to go Microsoft. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: underground digital economy
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> Certainly. There are a couple of ways, but all one needs is > some sort of gateway to an e-cash > This is the part that bothers me. Wouldn't a gateway between anonymous e-money and identified e-money would stick out like a sore thumb to agencies tracking the flow of identified e-money? Wouldn't identified e-money trails start and/or terminate at the gateway? Once the gateway is discovered, all clients on the identified e-money side of the gateway would be discovered. I think the gateway could only succeed if there was a way to perform the conversion anonymously. But how do you anonymously generate/propagate identified e-money? There is probably an obvious solution, but I'm not devious enough to see it. One unstated assumption I have that may be confounding me is that I assume the identified e-money system will completely replace paper money, which will then be "discontinued". Jim_Miller(a)suite.com

2 1

CAPI endorsements
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - From MS's Web page on their CryptoAPI, under the 'Endorsements' section: RSA "We're pleased to see Microsoft's announcement of CryptoAPI and CryptoAPI's use of RSA technology. This announcement makes more robust cryptography more easily available to more people--and RSA believes that's always a good thing." -- Jim Bidzos, President, RSA Data Security, Inc. I gotta wonder if that's why RSA wants Too Damn Much (tm) for licenses..... Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMP0A6cVrTvyYOzAZAQErUAQAsOc6acpfRtytyjeyxpGpMzSPEnvqXUqr vYHEIWWqm7On/qWDbkqrsl47EBc7K57hpXIX3kzeiYbko7P+4ndIFlA/yRVs+L6X mpUrqsvGy6/kadAy2AnwPefRkaTbflrtamSMfdQwF+7Du6x/tL/z/UpASA/2sx8e p5IdH9kYmfs= =RPRO -----END PGP SIGNATURE----- ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geocities.com/CapitolHill/1148

1 0

Denver area meeting, SUPER SUNDAY, Jan. 21, 2 pm
by awestrop＠nyx.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Some locals will flout this most sacred of American holidays by gathering to discuss crypto and ancillary issues at the Tivoli, on the Auraria campus between Speer, Larimer, and the Auraria Parkway. If you're not sure of the location, send email for Mo' Better Clues. Alan Westrope PGP public key: http://www.nyx.net/~awestrop <awestrop(a)nyx.net> <awestrop(a)crl.com> PGP 0xB8359639: D6 89 74 03 77 C8 2D 43 7C CA 6D 57 29 25 69 23 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMP/JO1RRFMq4NZY5AQGfnAP/ajy9KYmsXp4G2hFO5AvKkahk/qIQEFPV d9AZrTGylRDep+6jrDbdoOlr7BKEhRebwtweaupQ+fKCiVQQJvxlcCccaCfd11hD D2okx9N1Q3KRhCgtk6fglkfZ6STDUF+maHUK83t7NclW41lp75uppwfZw//qVWr2 VreutUqu16I= =QDzQ -----END PGP SIGNATURE-----

1 0

"cybertage"
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

how about a new term for all the various enemies of cyberspatial advancement? the censors, the luddites, the spooks, the politicians, the demagogues, the rabid media (all of which there seems to be no shortage of lately): "cyberteurs" engaging in "cybertage" now if we can only get a strong stigma associated with the words and label all the enemies with it. I think it could really stick. a sort of reaction by cyberspatial citizens against all the encroachments and disrespect.

2 2

Re: "cybertage"
by jwa＠nbs.nau.edu 17 Dec '03

17 Dec '03

Way back on Jan 19, 9:22am, "Vladimir Z. Nuri" wrote: > how about a new term for all the various enemies of cyberspatial > advancement? the censors, the luddites, the spooks, the politicians, > the demagogues, the rabid media (all of which there seems to be no > shortage of lately): > > "cyberteurs" engaging in "cybertage" Augh! No! No more "cyber" anything, please! Instead, how about a filter (implemented at some key top-level, NSA-funded routers, of course) that simply s/cyber//g ? - - - How "tight" is the encryption that ssh (secure shell) uses? I'm trying to push it for use across potentially insecure subnets at our University, and would like all the ammo I can get :) Has anyone tried to sniff & brute force a ssh-encrypted session? James -- James W. Abendschan Email: jwa(a)nbs.nau.edu UNIX Systems Programmer/Administrator Voice: (520) 556-7466 Colorado Plateau Research Station, Flagstaff, AZ FAX: (520) 556-7500

1 0