December 2003 - cypherpunks-legacy

Re: STT_???
by James Caldwell 17 Dec '03

17 Dec '03

On 28 Sep 95 at 8:08, John Young wrote: > 9-28-95. W$Japer: > > > "Infighting Unravels Alliance Seeking Standard to Protect > Internet Purchases." Money, money, money, MONEY! Let's hope Digital cash sans the Corprats takes... > The consortium brought together such top players as > credit-card rivals Visa International and MasterCard > International Inc., software titan Microsoft Corp. and > Internet upstart Netscape Communications Corp. But this > week, the alliance split because of tensions between > Visa and MasterCard and their respective technology > partners -- Microsoft and Netscape. Watch the vultures at Mirosoft come to feed: > Regarding Netscape, Mr. Dent of Microsoft said the > firm's security deficiencies that have recently come to > light have "tainted" electronic commerce on the > Internet. Mr. Dent also noted that Microsoft yesterday > introduced new security technology, including means to > verify a user's identity, that is much stronger than > Netscape's.

1 0

VISA and Microsoft STT Specs available
by hallam＠w3.org 17 Dec '03

17 Dec '03

Hi, The specs for STT are now available. Due to various circumstances too complex to explain these are currently being served via the W3C web server at :- http://www.w3.org/hypertext/WWW/Payments/STT.html This does not constitute an endorsement of these specifications by W3C nor any representation of the fitness thereof. Note that these documents may well move in the future. For more payments related info see:- http://www.w3.org/hypertext/WWW/Payments/ The roadmap has been updated appropriately. Phill Hallam-Baker

1 0

RE: More on "Entropy"
by David Van Wie 17 Dec '03

17 Dec '03

Tom Weinstein wrote: >We used this formulation of entropy in Statistical Mechanics. It's >especially useful in Quantum Thermo where you can actually enumerate all >of the states instead of relying on probabilistic arguments. Sure, this formulation can be used. As a pedagogic tool for explaining what a theory is all about, many formulations are discussed as if they have application in real world situations. Of course (for pedagogic reasons), these discussions focus on systems in which there is a definition, and typically a well-behaved mathematical model, for all of the significant states. Some instructors believe this will assist students in appreciating the concepts of statistical mechanics and quantum thermodynamics. To build a working apparatus (or software systems, as we are discussing here), the designer is typically faced with the breakdown of well-behaved mathematical models. Everything from degenerate states to the "baked in" uncertainty of certain states tends to undermine the mathematical foundations of a theorist's constructions. Of course the theoretical models are absolutely critical, but the designer must always caution themselves against drawing inferences without measurements and clearly stated rationales that speak to these physical realities that lead to mathematical weaknesses. Ultimately, the probabilistic nature of such systems may be "moved around," but not removed from the model! Since the real world of actual measurements interferes with essentially everything we claim to "know" about quantities such as entropy, the real danger is assigning an independent "meaning" to these constructs. Why? Because these quantities do not exist independently, they only exist with respect to our predictive models of a system's behavior. So these models do not really "enumerate" anything about states, but rather restate the probability assumptions of the model in the form of a "working equation." In addition, drawing inferences as to the behavior of systems based on common mathematical form is simply inviting trouble, even at the theoretical level. Mathematical models are not the real world, and the superficial mathematical consistency between say, the functional form of a resonance in a quantum well and a marble in a bowl, does not mean that the marble gives any special insight into the nature of the quantum well. In fact, beyond the curiosity of similar equations, the most important information is in the distinctions and clarifications (emanating from theory) between the systems from a practical, apparatus building, real world perspective (as contrasted with the "everything is just a special case of X" perspective). This danger is also present in designs for sources of entropy to seed RNGs for random data or to create uniformly distributed keys. Well designed models will avoid rephrasing assumptions as conclusions, and will explicitly address the mathematical weaknesses upon which the theoretical arguments in support of the model are ultimately based. dvw

1 0

NPR reports on Digital Express Secure Telephone
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

Digital Express coverage on NPR. Seastrom and Shiller(sp?) talking over a powerbook using PGPPhone. Demonstrating secure telephones! Edward Appel, director of counterintelligence FBI representative on National Security Council is quoted. "It's very easy for a criminal or a terrorist of a spy to use this for their advantage." Reporter "You can connect to an MIT computer and get pgp-phone, you have MIT Press 900 page book from PGP! "You can carry that book with you, anywhere you want in the world... Export control laws don't cover books..." Hal Abelson, MIT advisor to MIT press, etc, etc, ... Appel "It's clearly not some weird form of poetry. It is source code, it is a program, ... if you can use it to tell the computer what to do then it is part of the machine itself..." The authors of PGP say "The real threat is that this technology is not distributed widely enough..."

1 0

Re: 25 Crays a Year to Break STT
by Frederic Miserey 17 Dec '03

17 Dec '03

> to encourage widespread adoption of STT, Microsoft and Visa are making > its technical specifications available at no charge to third parties > to allow them to develop software. > I can't find any infos on www.microsoft.com. Any hint on how to get these specs ? Frederic --------------------------------------------------------------------------- Frederic Miserey mailto:frederic@none.com none programs finger me for PGP key 42 3A 75 40 71 E6 DC 3B 50 90 F9 6B 26 28 60 91 "The last bug isn't fixed until the last user is dead" - Sidney Markowitz

1 0

Netscpae & Fortezza (Or, say it Ain't so, Jeff?)
by Adam Shostack 17 Dec '03

17 Dec '03

4 3

SAIC bought InterNic, but who is SAIC? A spook contractor!
by John Gilmore 17 Dec '03

17 Dec '03

Forwarded-by: gordoni(a)base.com (Gordon Irlam) Thought you might find this interesting. I don't know if you have thought about it or not, but control over the root name service plus some funky software is all that it takes to be able to selectively snoop on all the packets addressed to any host on the net. DNS is currently the achilles heel of a secure internet... gordoni From: Wes Thomas <wes(a)ora.com> The press recently reported that the National Science Foundation has turned over Internet Domain Name registration to Network Solutions, Inc. (NSI) of Herndon, VA. The press failed to note some interesting connections. Tomorrow morning (Sept. 26), Web Review, a biweekly online magazine (see Special Report at http://gnn.com/wr/) will reveal that NSI was purchased in May by Scientific Applications International Corporation (SAIC) of San Diego. SAIC is a $2 billion company indicted by the Justice Department on ten felony counts for fraud in managing a Superfund toxic cleanup site (SAIC pleaded guilty) and sued by the Justice Department for civil fraud on an F-15 fighter contract. SAIC's board members include Admiral Bobby Inman, former NSA head and deputy director of the CIA; Melvin Laird, Nixon's defense secretary; and retired General Max Thurman, commander of the Panama Invasion. Recently departed board members include Robert Gates, former CIA director; William Perry, current Secretary of Defense; and John Deutch, the current CIA director. Current SAIC government contracts include re-engineering information systems at the Pentagon, automation of the FBI's computerized fingerprint identification system, and building a national criminal history information system. "At the very time the Internet community is struggling with the issues of encryption and privacy, I'm more than a little uneasy to find this bunch of ex-spooks sitting at the very entry point of the Net," says Jim Warren (a leading activist in making government records accessible) in the article, which was written by investigative journalist Stephen Pizzo, Web Review Senior Editor and co-author of the book Inside Job, an expose on the savings & loan looting. Web Review is produced by Songline Studios, an affiliate of O'Reilly & Associates.

2 1

STT_???
by John Young 17 Dec '03

17 Dec '03

9-28-95. W$Japer: "Infighting Unravels Alliance Seeking Standard to Protect Internet Purchases." The consortium brought together such top players as credit-card rivals Visa International and MasterCard International Inc., software titan Microsoft Corp. and Internet upstart Netscape Communications Corp. But this week, the alliance split because of tensions between Visa and MasterCard and their respective technology partners -- Microsoft and Netscape. Regarding Netscape, Mr. Dent of Microsoft said the firm's security deficiencies that have recently come to light have "tainted" electronic commerce on the Internet. Mr. Dent also noted that Microsoft yesterday introduced new security technology, including means to verify a user's identity, that is much stronger than Netscape's. STT_??? (6 kb)

5 5

GSSAPI compliant Apps
by Rev. Ben 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm interested in writing a GSSAPI compliant app, but I have been so far unsucessful in finding an example of GSSAPI compliant code to use as a baseline. Does anyone have any pointers? Thanks Ben. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed with Bryce's Auto-PGP v1.0beta3 iQB1AwUBMGtcgL5ALmeTVXAJAQElIQL+JzyPIvta+NRiU6id45o557kvaxGvti4A cREqsyn1oJPXS44GW9/RzdzJMjN7ofnMKqNt/TbKGgMni+XYCc/OAxLauDoKl8vm 4v/tTtfgVWGoS1jEB03SAB7Z2U49HxWv =35YV -----END PGP SIGNATURE-----

2 1

Anon Http web Proxy V2.1
by Laurent Demailly 17 Dec '03

17 Dec '03

I fixed the IOs, it now works a lot faster, play with it on http://hplyot.obspm.fr:6661/ (no abuse plz) and get the source package on ftp://hplyot.obspm.fr/tcl/www/tclhttpdsh-0.4beta.tgz dl -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept smuggle FSF terrorist $400 million in gold nuclear Serbian Clinton

1 1