December 2003 - cypherpunks-legacy

Oct 14 mtg - focus on java
by mrm＠netcom.com 17 Dec '03

17 Dec '03

Hi - The Oct 14 cypherpunks meeting will be focussing on Java topics. I'm putting together an agenda, and finalizing the meeting location. It looks like we'll have someone from the Java group at Sun to talk about what the current Java security policy is, and about Java and HotJava security mechanisms. Doug Barnes and Amanda Chou will talk about JCrypt, which is a set of Java wrappers for existing C encryption routines. If you'd like to talk at the Oct 14 meeting, please send me email with a description of your project, and I'll schedule you in. I'll send out mail early next week with the agenda, and letting you know where the meeting will be held. I'm trying to get a large conference room at one of the Sun facilities. Marianne mrm(a)netcom.com mrm(a)eng.sun.com

1 0

NetManage & Cylink Crypto
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

NetManage & Cylink In Internet Encryption Deal Guildford, Surrey, England, Oct 5 -- NetManage, a TCP/IP specialist company, has signed a licensing deal with Cylink Corporation. NetManage says the Cylink public key cryptography technology will be incorporated in future editions of NetManage's Internet applications software. The move is significant since it marks the beginnings of a competitor to the Netscape "secure" Web browsing software, which has had two security flaws identified in recent weeks. Initially, NetManage's Chameleon Enterprise TCP/IP applications suite will incorporate the Cylink public key encryption technology, and later will include encryption facilities in Internet Chameleon, a UKP139 PC-Windows access suite designed for dial-up access to the Internet. Both NetManage and Cylink plan to support an open interface for Internet security which addresses the flaws found in Netscape. The idea is to establish an open set of standards to which Internet access packages of all types will adhere to, and so ensure that companies developing Internet software do not "re-invent the wheel" when writing their software, and possibly open their applications up to flaws. According to NetManage, establishing a secure Internet connection requires an Internet application to perform two functions: authenticating the user, and encrypting the data flow. The link with Cylink will allow NetManage to license and include the Cylink public key encryption technology in its applications with a variety of ciphering systems to be used in the NetManage suite, including: DES, Triple DES, Safer, IDEA, Skipjack, RC-2, and RC-4. NetManage claims the current implementations of security proposed as standards by Netscape and RSA Data Security are flawed, and fail to fully accommodate "open and interoperable secure communications" between computers which use different bulk encryption ciphers. These problems, the company claims, have limited the adoption of Internet security as a widespread interoperable feature of all Internet software and hardware products, including end-user applications, servers, firewalls, and secure routers. Later this month, NetManage and Cylink plan to announce a next-generation "plug and play" Internet encryption system. The implementation will be open and will not lock software or hardware developers into the use of encryption technology from any one vendor, as is the case with Netscape, say the companies. The related APIs, key exchange technology, and encryption, will be made publicly available to other software and hardware vendors. Licensing will include source code and no per-copy royalty fees. Further information can be downloaded from NetManage's World Wide Web site at <http://www.netmanage.com>. Contact: NetManage Europe, +44-1483-302333; NetManage US, 408-973-7171.

1 0

Re: Comments on STT Spec Implementation Details
by anonymous＠robo.remailer 17 Dec '03

17 Dec '03

Responding to msg by perry(a)piermont.com: [snip] >The belief that companies can make more money by >following proprietary solutions and imposing them on >the world as standards is falling away. It is in >Microsoft's interest that the standard that is adopted >for commerce be open, publically discussed at length, >and brutally critiqued. Losing a bit of control in >exchange for actually getting something that works out >for you and your customers is in your interest. The spew through the proprietary dike on this is swelling: MasterCard's consortium yesterday and the NetManage/Cylink today both emphasize public availability of specs in counter-response to the flaws helpfully discovered in Netscape by the ever public spirited cypherpunks. Whether any of these vaunted "superior" systems respond to attacks as constructively as Netscape will be the challenge. BTW, has anyone reviewed the promised MasterCard specs supposedly released on Tuesday?

1 0

Secure Drive questions...
by Ray Arachelian 17 Dec '03

17 Dec '03

Hi, I recently got me a much larger hard drive and would like to encrypt more than one partition using SecureDrive. I'm using an old 1.1 version which, when I log into one partition, the others vanish. I'm using the same passphrase on both paritions. I've never upgraded because the previous version did what I wanted it to do very well and I have never had a problem with it. I've noticed that on some machines SecureDevice failed where SecureDrive 1.1 worked perfectly... So I've stuck with that... but now, I'd rather not join the two partitions together if I can help it... too much work to copy everything off, repartition, restore, etc... (This is a 1.2Gb WD Caviar drive using the Disk Manager crud that makes the drive visible to DOS by loading some DMDRVR.BIN driver only - my BIOS only sees 550Mb or so without it...) Is this a question of upgrading, if so, what's the latest version? And are there any catches, snags, or problems to watch out for before I potentially kill my drives? :-) A few more questions, I've left a bit of space for me to experiment with something like OS/2Warp or Win95 or even Netware 4.1 (got a cool 2 user license for $50 from Novell I'd like to install.) Now while OS/2 and Win95 can see FAT partitions, what will stop them from trying to run something like chkdsk on it? Can I load the secure drive tsr to keep the encrypted drive safe with those operating systems? (I know Netware will keep its mits off non-Netware partitions, so that's a safe bet - but then I don't have another PC to use as a host so this will be a clientless server. Just want to experiment with it I guess... :-) I'd also consider messing with NT, I have enough RAM and space, but anyone know a place I can get a good price for it? $400 is a bit steep for an OS I probably won't do much with. And YES, I will install Linux - soon as I can get it to recognize my I/O-less FutureDomain clone SCSI controller. (It's based on the 950 chip, no I/O address, uses int 15 and DMA for transfers..) Works okay under Coherent - then again, I'm using the IDE controller under Coherent... :-) The SCSI FD controller is for the CDROM drive... ========================================================================== + ^ + | Ray Arachelian | Amerika: The land of the Freeh. | _ |> \|/ |sunder(a)dorsai.org| Where day by day, yet another | \ | <--+-->| | Constitutional right vanishes. | \| /|\ | Just Say | | <|\ + v + | "No" to the NSA!| Jail the censor, not the author!| <| n ==========================================================================

1 0

Re: NSA Realists v. Nuts (Was: Re: Crypto APIs)
by David Van Wie 17 Dec '03

17 Dec '03

Perry E. Metzger wrote: >The real problem with the NSA is the same as the problem with the FBI >re: digital telephony. They've gotten used to a certain model of how >the world works and rather than adapt to new times where most people >have access to strong crypto, they have decided to use the laws to try >to retard the inevitable. Perry is absolutely right about this. We have been living in a "golden era" for the FBI and NSA. By analogy, we have also been living in a golden era for physicians: during the last several decades (in the developed world anyway) we have relied on antibiotics to the point where they are taken for granted. This time has passed, and there is no going back. The Golden Age of Antibiotics is over. Similarly, the Golden Age of Wiretaps is over. No amount of wishful thinking and convoluted logic can put the genie back into the bottle. An attempt to (in effect) make certain types of mathematics illegal will only serve to knock us out of our technological leadership position, not make our country safe from terrorism and drugs. Given a world in which strong crypto is actually used, and that use is illegal, how can a government make the punishment fit the crime? Would all use of illegal cryptography be treated as though there was an actual threat of terrorism? The death penalty? This is, of course, an absurd point of view. The government could no more accomplish this than they could make muttering over the phone (thereby defeating a plaintext wiretap), or the use of obscure language (such as Native American dialects) illegal. It just doesn't hang together as a rational approach. Like physicians, the FBI and the national security operations must devise alternative schemes to combat the real "enemy," terrorists and drug dealers -- not mathematicians and ordinary citizens trying to have a private conversation. The suppression of basic rights that would be required in any attempt to overcome the "force of nature" that is human knowledge would make a mockery of our "inalienable rights" as free people to conduct our lives without fear of the overbearing scrutiny of unrestrained government. dvw

1 0

Re: NetManage & Cylink Crypto
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Anonymous wrote: > The link with Cylink will allow NetManage to license and include > the Cylink public key encryption technology in its applications > with a variety of ciphering systems to be used in the NetManage > suite, including: DES, Triple DES, Safer, IDEA, Skipjack, RC-2, ^^^^^^^^ > and RC-4. Hey, this is interesting... will Skipjack be included in future NetManage products or is this press-release only mentioning Skipjack as an example of a possible encryption algorithm for use with NetManage? andrew "Gentlemen, start your disassemblers."

1 0

Re: Certificates, Attributes, Web of Trust
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:11 PM 10/5/95, Jeff Weinstein wrote: > How about if the systems allows you to get a certificate that >has any name in it that you want, where the issuer makes no >claims about the identity of the owner of the certificate? >How about if the software lets the user decide which CAs they >will accept certificates from? Given these two features, >would you still consider requiring a certificate to be bad? Let's make sure what we mean by these two points: 1. "...allows you to get a certificate that has any name in it that you want, where the issuer makes no claims about the identity of the owner of the certificate?" I would expect that a certificate for "%63rrW209neU6q!" would be issuable for a miniscule amount of money, and as many of these as are desired. (No, I'm not saying "Verisign" must offer certificates for very low cost, only that there be no built-in costs, or built-in time delays and processing delays, that would prevent "Tim's Really Cheap and No Questions Asked Certificate Service" from issuing such certificates, cheaply and rapidly (in seconds, or less, as some applications will need this, if other services "demand" certificates). 2. "...software lets the user decide which CAs they will accept certificates from?" Fine, provided the following CAs are acceptable: -- an "automatic" certificate granter, essentially meant only to satisfy protocols which require certificates -- a certifier for the Mob, which sells certificates for some fee -- the application itself should be able to generate certificates immediately...call this the "null certification." It is true that some of these example seem to "undermine" the whole purpose of certificates, but this is precisely my point: if I want a key to be certified, I will determine the conditions under which I want it to be certified. Other parties are free to meet my conditions if they wish to do business with me, or not, as the case may be. The "null certification" is thus very important. Naturally, I think this null certification makes the idea of _requiring_ certification moot. Will Netscape allow this? --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

4 3

Re: Rethinking the utility of netnews "cancel" control messages
by Rich Salz 17 Dec '03

17 Dec '03

>Look just replace "cancel" with "mark as worthless and sign". Then No. Replace cancel with 1. Legal wants you to destroy this document 2. The site security officer wants you to destroy the document 3. The license has expired and you must destroy the document and so on. I don't think my life has been all that interesting, but I've had all of those things happen. Of course there is no guarnatee that indiviuals don't have private copies, etc., but you have this situation currently and it works. Replacing cancel with setaside makes Usenet architecture useful for many business semantics/requirements. That's not something I'm willing to trade away and I am surprised that others would... /r$

1 0

Re: Rethinking the utility of netnews "cancel" control messages
by Rich Salz 17 Dec '03

17 Dec '03

Sigh. >Replacing cancel with setaside makes Usenet architecture useful for >many business semantics/requirements. That's not something I'm willing to Sigh. useLESS for many ...

1 0

Re: Simple Hardware RNG Idea
by norm＠netcom.com 17 Dec '03

17 Dec '03

Simon Spero writes: .... > What about a beam of high intensity ionising radiation aimed at the > detector? .... You presumably use the oddness of the count for your random bit in some predetermined time interval. External radiation can change, but not bias the parity. If the counter saturates, the counter may be biased towards one parity but the software can easily detect saturation presuming it gets the count. You can use the source in a smoke detector.

2 1