December 2003 - cypherpunks-legacy

Re: not a flame please read and think about this
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Rich said >>> even phil zimmerman is selling the rights to pgp. what about all the >>> people who contributed code (like me) ... . ask phil >>> about me and when i asked about sharing profits from the code i >>> conrtibuted. also about the deal with r.f... > >Mr/Ms. Anonymous is lying. His/her name appears nowhere in the credits, >and his/her code appears nowhere in any PGP release. Don't waste any >neurons on it. Let Anonymous have a share of prz's legal bills as well. No matter how much Phil is getting from licensing, somehow I doubt he is netting a profit... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMFOfeGGnwFiC3O2NAQHedwf/T9QOEUBdX7DZx1ygdk4/Us2wmiYQiDUG PZxht4G+66aYO/7IYwxIES9ksAvCP/vZJ14a55Lc+NJABFnMe/eJrbXmNSjyGdFP hoHUXGWv3BJDpx6QvhapDFoAsG0b0KgDQMpG2/6s9VPKsDoNNioUDzvpV4lh7fNh RhjO1yA1dYHVcW2ihICByw/e43aU35xhrDhzFm/9ExtVT2STMGvnTso3Pgj/oAqa Szbj2AzKp6NmI+BdfWrZmdFcFdji8toQ5AtUmBY1gBU1DbDZzdV8BiDYnMJfbcyH TIKxU4xPWpXi3WjfE37CsPnxGv+ASylHuCUpanldKaz3y03hRawIBQ== =3Pw7 -----END PGP SIGNATURE-----

1 0

Re: Digital Fingerprinting
by Hal 17 Dec '03

17 Dec '03

I'm not sure how to do it for software, but for novels it should be easy to fingerprint. Every couple of pages the author writes a sentence twice in different forms. This would not take a great deal of extra effort on the part of the author. Software can then choose from the alternative variations in different patterns to produce a unique fingerprint for every copy. There would seem to be two approaches to removing the fingerprint. One would be re-writing every sentence in the novel. The other would be to collect enough copies to identify all of the sentences which have variations. Most of the mathematics of fingerprinting research is oriented around figuring out how many different points of variation there must be to be secure against a certain number of copies of the fingerprinted item being compared. Perhaps a similar approach could be applied to software, where in many cases a couple of statements could be trivially interchanged, or other kinds of simple transformations could be manually generated. Those could be marked by the programmers without too much extra work. I agree with Doug that fully automated fingerprinting schemes which post process "vanilla" documents are going to be forced to rely on security through obscurity, probably a losing battle. Also as Doug says the viability of legal sanctions against the source of fingerprinted docs is questionable. Maybe it could work if you had just a few copies out and the people who were given copies can be seriously held to non-disclosure agreements. Hal

1 0

Beware free 'gifts'
by Eric Murray 17 Dec '03

17 Dec '03

Spammed to Usenet news: >Subject: Check Em Out >Date: 1 Sep 1997 01:43:23 GMT >Organization: MediaOne SouthEast >Lines: 36 >NNTP-Posting-Host: surf219.pompano.net >Mime-Version: 1.0 >Content-Type: Text/Plain; charset=US-ASCII >X-Newsreader: WinVN 0.99.9 (Released Version) (x86 32bit) > > > Discreet Research > > http://www.dresearch.com > > Background Checks, People Finder, Driving & Criminal Records & more! > * NOW WITH A RESELLER PROGRAM! > > Lost a friend or loved one? we can find em'! fast and cheap! > > Want to check out your mate ? we can! everything from there > driving record, bank account!, license tag trace (all legal!) > > > New Product : PHONE TRAPCARD > > Here's how this exciting new service works. You request who you > want a phonecard sent to. Discreet Research then sends your subject > a disguised gift packaged phonecard charged with 60 minutes of > calling time. Your subject will then use the card to make phone calls. > > Discreet Research will then notify you by fax, e-mail, or by phone with > a daily log that tells you the phone numbers your subject called, > & the phone numbers the calls were placed from. The trapline can trace > any type of phoneline even payphones! The phonecard is valid for 3 > months. > >We also offer a reseller program if you would like to get into the biz! > > > http://www.dresearch.com > e-mail : research(a)mediaone.net > I wonder how long this company would last if say James Kallstrom was 'tracked' using their 'trapcard'.... -- Eric Murray Chief Security Scientist N*Able Technologies www.nabletech.com (email: ericm at lne.com or nabletech.com) PGP keyid:E03F65E5

1 0

Security Policy Documents
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

From: URL: http://csrc.ncsl.nist.gov/secplcy/ Computer Security Resource Clearinghouse WWW Server _________________________________________________________________ SECURITY POLICY DOCUMENTS These are computer security policy documents, primarily from the Department of Commerce, and the Office of Management and Budget. [?] Search Security Policy Documents a130app3.txt [62983 bytes] 1995-03-29 Proposed Revision of OMB Circular No. A-130 Appendix III doj-fg.zip [172668 bytes] 1994-07-04 "Searching and Seizing Computers," U.S. Dept. of Justice, Federal Guidelines, July 1994 (zipped WordPerfect file) omba130.txt [80748 bytes] 1994-06-06 Office Management and Budget cryptpol.wp [68689 bytes] 1994-03-01 Cryptography: Policy and Technology Trends doc-copy.txt [4600 bytes] 1993-11-23 Department of Commerce's Software Copyright Policy doc-poli.txt [86434 bytes] 1993-11-23 Department of Commerce's Chapter 10 of the DOC IT Management Handbook, which contains the IT Security policies for the Dept. doc-man.txt [253689 bytes] 1993-11-19 Department of Commerce beginning sections of the DOC "Information Technology Security Manual" a130.zip [26986 bytes] 1992-06-08 Proposed Revision to OMB Circular A-130 sec_2315.txt [2150 bytes] 1992-02-27 Sect. 2315 of U.S. Code Title 10 omb_a130.txt [97630 bytes] 1992-02-27 OMB Circular A-130, "Management of Federal Information Resources" opm_plcy.txt [12951 bytes] 1992-02-27 Computer Security Training Policy csa_87.txt [153493 bytes] 1992-02-27 Computer Security Act of 1987 rfc1244.txt [253471 bytes] 1991-11-08 Very good summary of site security policies

1 0

SSZ is moving on 9-16-97...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, SSZ will be moving on the 16th. We are expecting no more than a couple of hours of downtime. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Crypto Bill HR 3011
by John Young 17 Dec '03

17 Dec '03

MSNBC reports today that one of the bills coming up in the congressional session is "H.R. 3011, an encryption bill which favors stripping all export restrictions and opposes any key escrow requirements." We've not been able to find this bill in the usual gov sites. Assuming that MSNBC got the info right, pointers to the bill would be appreciated.

2 1

GAK/weak crypto rationale?
by P.J. Ponder 17 Dec '03

17 Dec '03

After reviewing the reports filed by our intrepid reporters in the field about the NIST meetings, I am left with a puzzling thought: Why are the NSA and the FBI so very keen on GAK and weak crypto? There was posted on this list some time back a statistic about the number of wiretaps and intercepts requested and authorized in the past year. As I recall, the number was quite small - around 12K [?]. Someone had found this out through an FOIA request, perhaps, (my recollection of it is poor). It was not a large number, anyway. I must conclude that the actual number of intercepts is much, much larger than they are saying, and that they must be getting what they perceive to be good intel from all this snooping. Otherwise, why would the NSA and the FBI be so gung-ho on this, when everyone is telling them it is bad for US software business, abhorrent to privacy rights, unenforceable, and just plain bone-headed in these new international geodesic network times? -- PJ p.s. -thanks for the reports, well done. I think most of the list readers are very appreciative of the coverage provided on Crypto95 and NIST sham.

1 0

t0902mt01.html
by Damaged Justice 17 Dec '03

17 Dec '03

[1][LINK] Calgary Herald BUSINESS _________________________________________________________________ Managing Your Money [2]Stock and Mutual Fund Quotes [3]Your Investments [4]Family Finance [5]Columns [6]Technology [7]Stock News [8]Search --> [9][LINK] [10]Calgary Herald Online Home Page [Main Menu............] __ Press group refuses to join Internet rating scheme Amy Harmon The Ottawa Citizen A group of major news organizations took the digital high road last week. The group members -- which include Time, CNN, the New York Times, the Wall Street Journal and the Associated Press -- said they would allow their online editions to be rendered invisible to some Internet users rather than conform to a rating system that screens material dealing with sex or violence. "We support open access to information on the Internet," the group said in a statement. "And we will not rate our sites." That such a proclamation would be necessary, that it would be hashed out in a tense meeting that was closed -- oddly, given its agenda -- to reporters and that it would be considered an important step forward by many of the executives participating is itself a commentary on the uncertain state of the free press on the Internet. But the electronic news publishers left unresolved the more baffling question of how to wedge such a seemingly routine commitment to the U.S. constitution's free-speech guarantees into the architecture of cyberspace and the cultural politics of the United States in the late 1990s. The bind that Internet news providers find themselves in began with the U.S. Supreme Court's ruling earlier this summer that the Communications Decency Act was unconstitutional. The court found that the law, which banned the transmission of indecent material to minors over computer networks, was an overly broad restriction on speech -- in part because existing technology would allow parents to control their children's access to such material. Eager to head off regulation, the online industry expressed enthusiasm for various rating systems at a meeting convened by the Clinton administration after the decision. Microsoft and Netscape, which together control the market for the browsers used to navigate the World Wide Web, agreed to incorporate a standard for ratings in the next release of their software. Theoretically, the standard (known awkwardly as the Platform for Internet Content Selection, or PICS) would allow any entity from Good Housekeeping to the Spice Girls to create a rating system. The browser would recognize all of them, and parents could choose the one that best fit their world view, or at least the lens they wanted their children to see through. But so far, the only major group to use PICS has essentially adapted to the Web a rating system designed for video games. Under the Recreational Software Advisory Council system, sites rate themselves on a scale of one to four for nudity, sex, violence and offensive language. The council, a non-profit association of entertainment and computer companies, performs random checks to make sure sites are representing themselves correctly. Parents can set the level of each category that they wish to screen for, and, significantly, unrated sites are blocked out. So far, about 40,000 of the Web's nearly one million sites have used the system. News sites, however, have for the most part found the ratings either inapplicable or abhorrent. "The rating of content, particularly in the area of violence -- to tell people whether they should or shouldn't read about war in Bosnia -- takes news and turns it into a form of entertainment," said Daniel Okrent, editor of new media at Time. It is perhaps not surprising that an entertainment-based rating system would be incapable of describing the vast quantities and qualities of information on the Internet. Religious organizations and government agencies are also reportedly unhappy with the Recreational Software Advisory Council's limitations. But the problem is more than just a given rating system. It is inherent in the technology -- or at least the purpose it is being used to achieve. Because to screen out certain material, like sexual images, every site has to be labelled in some fashion. "In the real world, you don't know what you're going to get before you get it," said Paul Resnick, one of the creators of PICS. "We're trying to create an online world where you do know what you're going to get, and once you set that as your priority, you have to start classifying things." To accommodate the concerns of news sites, the Recreational Software Advisory Council has proposed a "news" label that would rate by category, not by content. But that raises the question of how and who would define which sites would bear the designation. The ratings group had appealed to the Internet Content Coalition, a loose alliance of online news organizations that organized last week's meeting, to serve as a monitoring body. The idea was denounced by several attendees, but they did not offer a better one. _________________________________________________________________ We welcome your suggestions; send e-mail to [11]online(a)theherald.southam.ca This web site is a supplement to the Calgary Herald, a daily newspaper published in [12]Calgary, Alberta, Canada. Contents copyright 1996. [ [13]Calgary Herald Home Page ] References 1. http://ads.galaxy.southam.com/OAS/rm/try-it.cgi/www.ch.com/b-mm-m-1.htm 2. http://www.southam.com/calgaryherald/cgi/finance/stocks&funds/overview.pl?p… 3. http://www.southam.com/calgaryherald/cgi/newsnow.pl?nkey=ch&file=/business/… 4. http://www.southam.com/calgaryherald/cgi/newsnow.pl?nkey=ch&file=/business/… 5. http://www.southam.com/calgaryherald/cgi/newsnow.pl?nkey=ch&file=/business/… 6. http://www.southam.com/calgaryherald/cgi/newsnow.pl?nkey=ch&file=/business/… 7. http://www.southam.com/calgaryherald/cgi/newsnow.pl?nkey=ch&file=/business/… 8. http://www.southam.com/calgaryherald/cgi/newsnow.pl?nkey=ch&file=/business/… 9. http://ads.galaxy.southam.com/OAS/rm/try-it.cgi/www.ch.com/b-mm-b-1.htm 10. http://www.southam.com/calgaryherald 11. mailto:online@theherald.southam.ca 12. http://www.southam.com/calgaryherald/almanac/almanac.html 13. http://www.southam.com/calgaryherald

1 0

GAK Advisory Board
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

>From URL: http://csrc.ncsl.nist.gov/csspab/minutes.395 Minutes of the March 22-23, 1995 Meeting of the Computer System Security and Privacy Advisory Board Wednesday, March 22, 1995 Introduction A quorum being present, the Chairman, Dr. Willis Ware, called the meeting to order at 9:00 a.m. at the Holiday Inn, Gaithersburg, Maryland. Besides Dr. Ware, the following Board members were present: Charlie Baggett Jr., Genevieve Burns, Cris Castro, Don Gangemi, Sandra Lambert, Henry Philcox, Randy Sanovic, Stephen Trodden, Steve Walker [TIS], and Bill Whitehurst [IBM]. [Snip long section on security assurance standards and methods in US, Canada and UK.] Update on X/Open Branding Project Mr. Bill Whitehurst, IBM, gave a brief update of the activities of the X/Open Branding Project. Two major components exist within their branding concept: (1) the ability to implement functionality based on a minimum set of assurance functionality requirements (MSFR), and (2) the confidence in the development process for achieving the functionality. He said that the workgroup meeting, hosted by Hewlett Packard, was held early in March. The group plans to re-write their document to include some type of evaluation process prior to the vendor product getting branded. X/Open plans to have a public review of the changes this summer. Vendor Perspective Ms. Linda Vetter, Oracle Corporation, presented oracle's views of security assurance. She discussed three types of assurance issues: (1) governent evaluation and certification; (2) third party evaluation and certification (government and business sponsored); and (3) vendor claims. Ms. Vetter explained Oracle s evaluation experience for two DBMS server product s, Oracle7 and Trusted Oracle7, in both the US and the UK. Oracle used the US TCSEC TPEP evaluation for B1 and C2 systems. They also used the UK ITSEC evaluation for E3 systems (which is the equivalent for US B1 and C2 systems). The UK process took significantly less time and cost less money for an identical product. Ms. Vetter suggested that NIST/NSA look into developing equivalent/comparable trust levels between the two different evaluation criteria methods as well as those for other countries. This would minimize the need to have different evaluations performed (one for each country) for the same product. Oracle has on-going work in other areas (e.g., RAMP, CMM, ISO, and Audits) as well as multiple CLEFS with the UK, Sweden, France and Germany. Ms. Vetter explained the differences in criteria between the TCSEC and the ITSEC. She said that the ITSEC requirements for the content of evaluation deliverables formed a superset of the corresponding TCSEC requirements for the evaluations. However, the TCSEC creates a framework for the presentation of these requirements and there can be little deviation from this. Oracle would like to see more concentration on low-end assurance requirements and processes. This would enable various sectors like health care, banking, and financial industries to have protection for unclasified to sensitive data. Ms. Vetter encouraged NSA to continue its efforts in modeling (Common Assurance Framework, TCMM, and SE CMM) and would discourage any more efforts in product profiling. The modeling efforts encourage vendor quality improvement, promotes flexibility in meeting assurance objectives, and are transferable to other private sector domains besides DoD. (See Reference #8). Wrap-up and Restatement of Issues Dr. Katzke summarized the discussion of assurance by saying that opportunities exist to look at alternatives. He is not sure what the government's role is or which areas to concentrate on with respect to cost. He said that he could continue with the same level of effort that is going on now with community involvement. He is open to suggestions with regard to the assurance process. Discussion After a lengthy discussion on the state of the Common Criteria (CC) and assurance approaches and issues, some of the major points from individual Board members included: - Concern as to when the CC will be widely accepted and used; - Whether to adopt the ITSEC now and migrate to CC; - The need to simplify the CC; - Building assurance and quality into the new assurance framework; - Clearly define assurance needs to be universally understood; - Conduct more C2 and below evaluations in the US; - Concentrate on low-end assurance; and - Bring key industry players into the process. [Snip] Board members continued their discussion of criteria and assurance from the previous day. Some of the major points of the discussion from Board members included the need: - for OMB to state the need for C2 level evaluation compliance for various government product purchases; - for NSA to make a statement about equivalency among all existing non-US trust levels; - to begin using components of the Common Criteria and gradually migrate to it; - to continue a wide range of assurance framework options and procedures; and - to focus on low-end assurance methods and encourage C2 level evaluation along the following Canadian AL-1 evaluation. [Snip] Status of Key Escrow Initiative Mr. Steve Walker, Trusted Information Systems (TIS), briefed the Board on the status of Commercial Key Escrow (CKE). He said, with regard to application vendors, TIS is actively seeking the participation of commercial software vendors in widespread implementation of CKE enabled software products. TIS has installed a Data Recovery Center (DRC) on the Internet and is prepared to distribute sample DRC application software packages to any interested software application developer. TIS is seeking approval of the US government for export of application programs using encryption algorithms such as the Data Encryption Standard (DES) when properly bound with CKE. Mr. Walker said the advantages of CKE for government interests is that if the TIS CKE system were to become widely used throughout the private sector and government communities, law enforcement, national security and private sector interests would be preserved. Mr. Walker said that TIS has filed for patent protection for its Software Key Escrow (Clipper equivalent) and CKE systems including the DRC and application software approaches. TIS is prepared to license its CKE system and software applications technology to any software or hardware vendor under very favorable licensing terms. TIS is also prepared to license its DRC system and technology to qualified DRC operators and vendors under similarly favorable licensing terms. (See Reference #13). [Snip] ---------- >From URL: http://csrc.ncsl.nist.gov/csspab/csspab.txt National Computer System Security and Privacy Advisory Board Identifying Emerging Computer Security Issues What is the Computer System Security and Privacy Advisory Board (CSSPAB)? Congress established the CSSPAB as a public advisory board in the Computer Security Act of 1987. The Board is composed of twelve members, in addition to the Chairperson, who are recognized experts in the fields of computer and telecommunications systems security and technology. What is the Board's purpose? The Computer Security Act specifies that the Board's mission is to identify emerging managerial, technical, administrative, and physical safeguard issues relative to computer systems security and privacy. What is the scope of the Board's authority? The Board examines those issues affecting the security and privacy of sensitive unclassified information in federal computer and telecommunications systems. The Board's authority does not extend to private-sector systems or federal systems which process classified information. What are the board's advisory and reporting functions? The Board advises the Secretary of Commerce and the Director of the National Institute of Standards and Technology (NIST) on computer security and privacy issues pertaining to sensitive unclassified information stored or processed by federal computer systems. The Board reports its findings to the Secretary of Commerce, the Director of the Office of Management and Budget, the Director of the National Security Agency, and appropriate committees of Congress. How often and where does the Board meet? The Board holds its two-day meetings twice per year; however, additional meetings may be called at the Chairperson's discretion. Board meetings are held in the Washington, DC metropolitan area as well as other areas in which there is significant federal computer security interest and activity. Are Board meetings open to the public? In accordance with the Federal Advisory Committee and Government in Sunshine acts, Board meetings are announced in the Federal Register and are normally open to the public. The Board accepts written statements from the public (see address on reverse). How is CSSPAB membership determined? The Director of NIST of the Department of Commerce appoints Board members for four-year terms. By law, the membership of the Board is distributed as follows: - Four experts from outside of federal government, one whom is representative of small- or medium-size firm; - Four non-government employees who are not employed by or a representative of a producer of computer or telecommunications equipment; and - Four members from the federal government, including one from the National Security Agency of the Department of Defense. Nominations to fill vacancies on the Board may be submitted to the Director of NIST. NIST personnel serve as the Board's Secretariat. Other federal agency personnel may also assist the Board's activities as specified in the Computer Security Act of 1987. Are Board members paid for their service? Board members do not receive a salary or stipend; however, authorized travel expenses are reimbursed as specified by Congress. ******************************************************* For further information, please contact: Computer System Security and Privacy Advisory Board Executive Secretariat National Computer Systems Laboratory Technology Building, Room B-154 National Institute of Standards and Technology Gaithersburg, MD 20899

1 0

Re: question about reputation
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Wei Dai writes: > For example, Alice starts a anonymous consulting service, and announces > that she will answer the first ten queries for free. Upon hearing this, > Mallet immediately starts another consulting service, and announces the > same offer. At this point Mallet can simply forward his customers' > queries to Alice and Alice's answers back to his customers. Thus, he gains > reputation at no cost. Well, long term he won't be able to keep it - what will he do when Alice starts charging for her services? He can charge more than she does, and they'll have equivalent "accuracy ratings" but Alice will provide her services more cheaply - or he can stop asking Alice and make up his own answers (or not answer) and his repuation will drop quickly. While I admit that I'd be pissed off if I were Alice, Mallet isn't really harming her - she gets business at the rate she's established. If Mallet's customers and Alice's don't overlap (maybe Mallet speaks/ writes in a different language, or has different friends) then it's arguable that Mallet is doing Alice a favor. If Mallet continues to purchase answers from Alice (even if he charges his customers more) his reputation isn't really false, if you think of it as meaning "can provide good answers to questions" versus "can figure out good answers to questions by himself". More proactively, Alice might choose to publish the questions and answers publically (the customers are, after all, anonymous, and only revealing as much about themselves as they'd reveal to an unknown party - Alice could sanitize the questions of identifying facts even further, if appropriate) - this would prove her aptitude (or lack thereof) to a wider audience, and Mallet's customers could notice that she was providing answers to their questions (how did she know of their questions?) before Mallet does. Alice could also choose to answer questions for free, but only to named and well-known parties with good reputations. This is a standard trick for new consultants/businesses - work cheap or free for a person or business that comes in contact with many people or gets lots of publicity. Cochran, Shapiro, et al could make a fortune from the Simpson trial even if they didn't charge OJ a dime - people charged with serious crimes will be calling them for years to come because of their media exposure. If Alice is paranoid, the well-known party could post a bond with an escrow agent, to be returned when they posted a public evaluation of Alice's services. > On the other hand, this "man-in-the-middle" attack can also work against > conventional True Name based services, but perhaps with less effect. Has > anyone ever heard of this being done? This "man-in-the-middle attack" is called, variously, arbitrage or capitalism. :) You've rediscovered Marx' surplus value theory of labor. (shh, don't say any more, or someone will say we're using language wrong.) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFPCmH3YhjZY3fMNAQEzTAP/dJFeg828BVuqS06deN15ILrX/13q2iSa seMCWXJMxOmRPS+oS7vbJtJ8jIhEJVlg+p9Un/rstD4QM7q6PRgKw9daq5LMav3y S+i0sYKEBnMmF+q5Ocm6EshHCAYs9sQOkM7hxr0rq0vhX3onFlpAIVBmUhz4BjtX YtoSpLWQ62U= =i8Zt -----END PGP SIGNATURE-----

1 0