December 2003 - cypherpunks-legacy

Scientic American
by Dan Harmon 17 Dec '03

17 Dec '03

The latest issue of SA has a small piece in zero knowledge transactions in the Math Rec section. Dan

1 0

Re: A WfW security curiosity (possibly another security hole)
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>>[WFWSYS.CFG file] > >This is the file used by admincfg.exe (on WFW3.11 disk 8). This file >contains "security" settings, such as whether or not to cache passwords >on disk (*.PWL files). Ahh, so you can silently reenable password cacheing by manipulating this file, thereby defeating Microsoft's "turn off password cacheing" kludge. Wonderful. I'll have a poke around on Monday to figure out what bits to flip and post the results here. Thanks for the info... Peter.

1 0

EPIC: Commerce Report on Crypto Availability
by tc＠phantom.com 17 Dec '03

17 Dec '03

Commerce Releases Crypto Availability Report The US Department of Commerce today released a report on the international market for encryption software. The report, which was jointly produced by the Commerce Department's Bureau of Export Administration and the National Security Agency reviews the foreign availability of encryption products and other nations' import, export and domestic use policies. The report finds that there are foreign products available which "can have an impact on US competativeness" and that US export controls "may have discouraged US software producers from enhancing the softare features of general purpose software to meet the anticipated growth demand by foreign markets. It anticipated that there is a steadily increasing demand for crypto to be included in general use software products becuase of well publicized break-ins. A large portion of the report has been redacted by the NSA. EPIC filed suit under the Freedom of Information Act in December 1995 to obtain a full copy of the report and will continue to demand its release. EPIC believes that the US goverment should remove export controls on public domain and commerical software that contains encryption and end the policy of demanding that key escrow be implimented in all encryption software. Enclosed in the Commerce Department Press Release and Executive Summary of the report. The full report is over 100 pages. EPIC will make every effort to make the full report available in electronic form as soon as possible. More information on crypto policy is available at the EPIC Web Site at http://www.epic.org/crypto/ UNITED STATES DEPARTMENT OF COMMERCE NEWS WASHINGTON DC.20230 OFFICE OF THE SECRETARY FOR IMMEDIATE RELEASE CONTACT: Carol Hamilton Thursday, January 11,1996 (202) 482-4883 Eugene Cottilli (202) 482-2721 DEPARTMENT OF COMMERCE RELEASES STUDY ON THE INTERNATIONAL MARKET FOR ENCRYPTION SOFTWARE Washington, D.C. -- The growth of an international market for encryption software is being slowed by strong export controls, both in the United States and other major countries. Moreover,the quality of products offered abroad varies greatly, with some not providing the level of protection advertised. The study, jointly prepared by the Commerce Department's Bureau of Export Administration (BXA) and the National Security Agency (NSA), evaluates the current and future market for computer software with encryption, which allows users to protect their data using codes. The study also reviews the availability of foreign encryption software and assesses the impact that U. S. export controls on encryption have on the competitiveness of the software industry. "Our study provides a clear snapshot of the international competition in this segment that the software industry faces," said Cornmerce Secretary Ron Brown. "Better understanding of the products and the marketplace gives us the tools to ensure that our export control policies are appropriate," he added. The study noted encryption software presently accounts for only a small percentage of the total computer software but should grow substantially as the U.S. and other countries deveiop and expand public networks and electronic commerce. The study found that the U.S. software industry still dominates world markets. In those markets not offering strong encryption locally, U.S. software encryption remains the dominant choice. However, the existence of foreign products with labels indicating DES (Data Encryption Standard) or other strong algorithms, even if they are less secure than claimed, can nonetheless have a negative effect on U. S competitiveness. The study also notes that the existence of strong U.S. export controls on encryption may have discouraged U.S software producers from enhancing the security features of general purpose software products to meet the anticipated growth in demand by foreign markets. page 2 All countries that are major producers of commercial encryption products were found to control exports of the products to some extent. A few countries (e.g., France, Russia, and Israel) control imports and domestic use of encryption, as well. As part of the study, NSA evaluated twenty-eight different foreign encryption software products, finding that some were less secure than advertised. Because customers lack a way to determine actual encryption strength, they sometimes choose foreign products over apparently weaker U.S. ones, giving those foreign products a competitive advantage. -30- A STUDY OF THE INTERNATIONAL MARKET FOR COMPUTER SOFTWARE WITH ENCRYPTION [Note: This is a redacted copy of the ogigional secret decoment. Brackets [] accompanied by the origional classifications have been used to indicate location and size of excised classified text] Prepared by the U.S. Department of Commerce and the National Security Agency for the Interagency Working Group on Encryption and Telecommunications Policy EXECUTIVE SUMMARY BACKGROVND In late 1994, the President's National Security Advisor directed that an interagency report be prepared assessing the current and future international market for software products containing encryption and the impact of export controls on the U.S. software industry. The report was to include an assessment ofthe impact of U.S. encryption export controls on the international competitiveness of the U.S. computer software industry and a review of the types, quality, and market penetration of foreign-produced encryption software products. This paper presents the joint efforts of the Department of Commerce/Bureau of Export Administration and the National Security Agency to complete this tasking. (U) EXPORT CONTROLS All countries that are major producers of commercial encryption products control exports of those products to some extent. Control methodologies and licensing practices vary, however, and a few countries, most notably France, Russia and Israel also control imports and/or domestic use of encryption. There is a significant amount of international cooperation in controlling encryption exports. (U) Some European and other countries apparently treat exports to the United States of DES- based software more liberally than the United States treats DES exports to those countries. Some countries have stated that they generally restrict DES exports to financial end-uses. In general, no independent verification of these licensing practices was obtained. However, in some cases the U.S. was able to obtain DES products from them for non-financial end-uses. It is possible that some countries may allow these exports based on their political/economic/military relationship with the destination country (e.g., within the European Comrnunity, or former COCOM), for end uses that are considered legitimate commercial applications of the technology, or, in the case of exports to the United States, because DES is a national standard. (U) As the technology and the marketplace have evolved, the USG export control authorities have relaxed licensing constraints on cryptographic products several times over the past 10 years. These changes have usually been made after industry pressures and internal debate to balance national security and economic concerns. (U) DOMESTIC AND INTERNATIONAL MARXETS While presently encryption software accounts for only a small percentage of the total software market (1-3%), according to numerous information security experts contacted in the course of the study, the future growth trend for this sector is expected to be great. The market for encryption in distributed computation, databases, and electronic mail is beginning to expand exponentially as the U.S. and other countries develop and popularize electronic commerce, public networks, and distributed processing. (U) Encryption in these environments will often be implemented in software, as opposed to hardware, because it is generally less expensive and simpler to install and upgrade. Absent changes in government standards, for the next ten years, encryption software will primarily use DES and RSA-licensed encryption algorithms. Other non-standard and company proprietary algorithrns will be used primarily for security-specific products for small niche markets. (U) Certain developments are promoting greater use by the general public of software-based network security features, including encryption, throughout the industrialized world. They include ever increasing use, fueled by well publicized "break-ins," of distributed databases, popular acceptance and usage of global networks, and the development and use of electronic commerce. (U) These developments are ongoing at one stage or another in practically all of the countries surveyed for this assessment. Less technologically advanced countries, where demand for encryption software is reportedly negligible, will soon undergo widespread development and computerization leading to increased demand for encryption so~ware within the next 10 years. (U) The overwhelming majority (75%) of general-purpose software products (e.g., word processors, spread sheet programs, and database programs) available on foreign markets today are of U.S. origin. Cornmerce Department analyses indicate that the U.S. has few viable foreign competitors for such products, and of those general-purpose products with encryption features, all were found to be of U.S. origin. (U) In the security specific software market, however, U. S. manufacturers face competition in several foreign markets from such encryption exporting countries as the United Kingdom, Germany, and Israel. To a large extent, markets for these products tend to be "national. " Not only do export controls affect sales, but local vendors of security-specific products are at a competitive advantage in that they are better situated to work closely with end- users and develop encryption solutions tailored to meet the conditions of the local environment. (U) NSA confirmed the existence of a significant number of foreign security-specific software products with encryption features, predominantly from Western European suppliers. Security-specific products are usually not available on the shelf at retail stores either in the U.S. or abroad, but can be purchased through direct contact with the manufacturer. (U) ES-2 BXA attempted to quantify U.S. competitiveness and market share in 31 foreign countries where encryption is thought to have significant demand. While sources in the countries surveyed had limited access to import statistics or market literature on encryption software and encountered nwnerous difficulties in evaluating this complex market, definite conclusions may be drawn from the responses. (U) Sources in 14 countries indicated that U.S. export controls limit U.S. market share in their countries. Sources in seven countries indicated that export controls have either no impact or no major impact. (U) Sources in most countries indicated that the U.S. market share is keeping pace with overall demand despite the impact of U.S. export controls, which may promote indigenous production or reduce U. S. market penetration. In all known cases, the U.S. holds the majority of the general-purpose encryption software market. (U) Three exceptions are Switzerland (where the U.S. market share reportedly declined in 1994, while the market shares of other European countries rose), Denmark and the United Kingdom, which reported unspecified declines from previous years. Sources in all three countries attribute the decline to U.S. export controls, which they claim promote the development and sale of indigenous encryption products. (U) In many countries surveyed, exportable U. S. encryption products are perceived to be of unsatisfactory quality. (U) ANALYSIS OF FOREIGN PRODUCTS NSA used various methods to procure encryption software products from a variety of countries and companies, as reflected in the TIS database and other sources. Altogether, 28 products from 22 foreign producers in 10 countries were acquired for the purposes of this study. Of these, 21 purportedly use the DES algorithm, while the remaining 7 use proprietary algorithms. (U) [ ] (S) ES-3 ECONOMIC IMPACT In the absence of significant foreign competition, the impact of U.S. export controls on the international market shares of general-purpose products is probably negligible. Customers are often unaware of the encryption features in these products and primarily base purchases on the features implementing the primary function of the product (e.g., word processing or database). (U) [ ] (S) BXA attempted to quantify the economic impact of export controls on the U.S. software industry by forwarding a detailed voluntary questionnaire to 206 software vendors and other interested parties. Thirty six encryption software manufacturers provided completed surveys out of the 71 returned. By and large, the companies were unable or unwilling to quantify the costs of export controls, but did provide substantive explanations of how and why they believe they are adversely affected. (U) Some general-purpose software companies claim that export controls have affected their plans to expand security features to meet anticipated growing demand. These companies believe that they could expand their domestic and international customer base with such features. (U) The export licensing process itself is not a major obstacle to U. S. competitiveness. Only seven survey respondents use the Department of State licensing system. While they continue to have some complaints about the administrative burdens and time delays associated with State's process, several noted that there had been improvements in recent years. Only two of the survey respondents had been denied licenses by the Department of State. (U) Numerous survey respondents indicated that they avoided applying for export licenses from the Department of State altogether. Some larger companies whose products tended to be general-purpose in nature either developed two ~fersions of so~ware, or incorporated an encryption algorithm they knew would qualify for Commerce general licenses. (U) Many smaller, security-specific software firms, on the other hand, elected to limit their sales to the domestic market only. These companies indicated a high level of foreign interest in purchasing their products, and therefore lost potential sales. While it is difficult for them to quantify their potential market, they believe it to be sizeable. They claim their small size limited their ability to develop two versions of their products, and the fact that their products were for secunty purposes ES-4 specifically requires them to incorporate strong encryption. Only one company was able to provide specific examples where a foreign competitor o~ta ned a sale due to an export license denied by U.S. authorities. (U) There is little evidence that U.S. export controls have had a negative effect on the availability of products in the U.S. marketplace. A broad range of products with secure algorithms exist in the U. S. market and availability of products is based principally on the level of customer demand. Export controls may have hindered incorporation of strong encryption algorithms in some domestic mass-market, general-purpose products, since some companies find developing and maintaining two versions of a product infeasible. (U) The existence of foreign products with labels indicating DES or other strong encryption algorithms, even if they are less secure than claimed, can nonetheless have a negative effect on U.S. competitiveness. Most encryption users base their purchasing decisions on the advertised product features, along with price, company reputation, etc. (U)

1 0

[NOISE] Re: A Modest Proposal: Fattening up the Proles
by Bruce Baugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 08:54 AM 1/17/96 -0500, John Young <jya(a)pipeline.com>wrote: > By any means, emulate elitist indolents and avoid anxiety. > Display iron-fisted civilized beliefs, practice tough-love > humiliation and master-over-slave manners and militant > mind-couture, but do nothing truly disruptive of the status > quo that so rewards niche market exploiters of genuine > dissent. The patient displays advanced signs of Stephen Donaldson's Disease. We recommend _immediate_ replacement of the TrendyLeft <tm> thesaurus and spelling checker package with more robust models. Strunk&White GoodWrite <tm>, say, or perhaps RichardScarrySoft <tm>. More seriously, I recommend a re-reading (or first reading, as it may be) of Orwell's "Politics and the English Language". I quote: "In our time it is broadly true that political writing is bad writing. ... Orthdoxy, of whatever color, seems to demand a lifeless, imitative style. The political dialects to be found in pamphlets, leading articles, manifestos, White Papers and the speeches of under-secretaries do, of course, vary from party to party, but they are all alike in that one almost never finds in them a fresh, vivid, home-made turn of speech. When one watches some tired hack on the platform mechanically repeating the familiar phrases - bestial atrocities, iron heel, bloodstained tyranny, free peoples of the world, stand shoulder to shoulder - one often has a curious feeling that one is not watching a live human being but some kind of dummy. ... And this is not altogether fanciful. A speaker who uses that kind of phraseology has gone some distance towards turning himself into a machine. ... "Consider for instance some comfortable English professor defending Russian totalitarianism. He cannot say outright, 'I believe in killing off your opponents when you can get good results by doing so.' Probably, therefore, he will say something like: 'While freely conceding that the Soviet regime exhibits certain features which the humanitarian may be inclined to deplore, we must, I think, agree that a certain curtailment of the right to political opposition is an unavoidable concomitant of transitional periods, adn that the rigors which the Russian people have been called upon to undergo have been amply justified in the sphere of concrete acheivement.' "The inflated sytle is itself a kind of euphemism. A mass of Latin words falls upon the facts like soft now, blurring the outlines and covering up all the details." Ironically, of course, Tim May's brutal honesty (right or wrong, he's almost always clear) is lots more "populist", the sense of being readily and widely understood, than John Young's stale academese. Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMP2PZX3AXR8sjiylAQG6gAfPVudIcO/WocUGwVYF7GVk5GvYT7ToYnR0 76SQXeEmwuvoG0reFoJdKJEGpJ5IQTboIgIyHYmEtirteH3y1vGeeiqQfmIhtx+S aUUtNHSOGKNUfSNvwY2Fw0Ij/3sAR16jZFmh4T1TPRW1xwgo0KYUkvB4tk5tx1sD Hzd+D2cPJNP/WhmwntkaXhynwnlgcYyLxqwjoD4QfiEHHS0Lbv+JVWuutJpKTih0 yFnhStoD9YL0ynZwIbfqZpl7HiX3FAAQ7aNLFPyqqRajJmTO7GuQLju8T1cWT+n+ oUTzgmXLtw5FY4OOLPR6mKkLvilyb1UzmX+GG/AlA671Ng== =qBu4 -----END PGP SIGNATURE----- Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0

Re: CryptoAPI and export question
by hallam＠w3.org 17 Dec '03

17 Dec '03

>Two points: the CSP development kit is export-controlled; and signing a >CSP developed by a foreign vendor is treated as a export -- so the signature >is export-controlled. >We would ship a CSP development kit to a foreign vendor, and sign a CSP >developed by the foreign vendor, but only with the appropriate export licenses. This could lead to problems. I'm not sure what the European Community reaction to US attempts to export its legal system will be. The problem is that the Lotus Notes scheme changes the previous deal. Before the European governments benefited from the US export control laws because they had wiretap abilities. Now they are denied wiretap capabilities and have the US able to snoop on all their traffic. Could find yourselves in the middle of a nasty battle... Phill

1 0

Base conversion
by grimm＠MIT.EDU 17 Dec '03

17 Dec '03

I am trying to write some code to perform base conversions on very large numbers (possibly as large as 256^(2^(ULONG_MAX))). Specifically, I store the numbers in base 256, but I would like to be able to print them in base 10. Any really brillant ideas? -James

1 0

Re: pgp broken?
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

At 07:42 AM 1/17/96 -8, you wrote: >On 16 Jan 96 at 19:16, Derek Atkins wrote: >To give further perspective, he kept claiming that a "triple DES with >RS4 overlay" was the most secure method of encryption. Well, he's wrong. A one time pad (properly generated and used) is provably secure as the "most" secure cipher. Speaking of "provably", ask him if he's sure that "triple DES with an RC4 overlay" is more secure than, say, "quintuple DES with an RC4 overlay" (since we're making up combinations). I would be VERY interested in any mathematical proof or empirical evidence that putting the RC4 on top of the encryption would be more secure than doing it first or between the DES rounds. Some pretty good mathemeticians have failed to produce such sweeping results (for the public domain, anyway.) Let's see if I have this right. Someone with access to the internet claims that someone with access to the DOD claims that some cipher system is good and another is bad. I have no reason to believe you. You seem to have no reason to believe him. He does not seem to know what he's talking about, on a subject where a great deal of effort is expended to promote confusion... I think I've got it! Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

CryptoAPI and export question
by Tom Johnston 17 Dec '03

17 Dec '03

Two points: the CSP development kit is export-controlled; and signing a CSP developed by a foreign vendor is treated as a export -- so the signature is export-controlled. We would ship a CSP development kit to a foreign vendor, and sign a CSP developed by the foreign vendor, but only with the appropriate export licenses. -TJ ---------- From: Dr. Dimitri Vulis <dlv(a)bwalk.dm.com> To: <cypherpunks(a)toad.com> Subject: Re: FW: CrytoAPI on Cypherpunks Date: Wednesday, January 17, 1996 8:37PM Tom Johnston <tomj(a)microsoft.com> writes: > >>> We won't charge high fees (right now, it's free!). Our policy is > >>> simple: we'll sign the CSP of anyone who follows the rules. Would you sign a foreign-developed CSP (which isn't subject to the rules)? --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: noise levels and hack-Microsoft
by R. J. Harvey 17 Dec '03

17 Dec '03

At 10:47 AM 1/18/96 -0500, you wrote: > >"R. J. Harvey" writes: >> At 10:20 AM 1/18/96 -0500, Perry wrote: >> > >> >Posts on windows registration wizards, gun control, unemployment, >> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >> Well, I'm sure you're correct on most of those, >> but the post on Microsoft using ENCRYPTED databases >> of competitor programs as part of its plan to surreptitiously > >Actually, the database isn't encrypted -- its plaintext -- and the >wizard isn't surreptitious and tells you everything its doing and lets >you stop it if you like. In short, the topic has no cryptography >or security relevance *AT ALL*. > I don't mean to sound argumentative, but I'm wondering if you actually read the article cited earlier today by the person you were criticizing for 'noise.' To quote from Andrew Schulman, the author of the piece he referenced, and a person who has more than a little credibility on such topics, REGWIZ.EXE in turn loads a dynamic-link library, \WINDOWS\SYSTEM\PRODINV.DLL. This is the "Product Inventory DLL," normally used for compliance checking of upgrades to Microsoft Office programs such as WinWord. (In fact, PRODINV.DLL's internal module name is "COMPLINC," for "compliance checking.") Of course, when you buy the upgrade edition of something like WinWord, there needs to be a mechanism to check that in fact you really are upgrading from some previous word processor -- be it a previous version of WinWord, or a competitor's word processor, such as AmiPro or WordPerfect. So there's an encrypted database (the reasons ^^^^^^^^^^^^^^^^^^^^^ for this encryption are discussed below) inside PRODINV of about 100 products, ... At this point, it was trivial to locate the beginning and end of the buffer, and write it to disk. (Recall that the database is stored on disk in encrypted form; this is why a search of ^^^^^^^^^^^^^^^^^ the entire hard disk did not find it.) ... The database is encrypted because otherwise it would be trivial to fool this "wizard" (hmm...; examination of RegWiz/ProdInv shows it to be anything but wizardly) simply by creating an appropriately-sized file with the appropriate name in the appropriate subdirectory. Although I haven't personally verified the above, I'm quite confident that Schulman is correct here. Of perhaps greater relevance to this list, the final passage cited above should provide a potentially very interesting "project" for those list-readers who are interested in the "hack Microsoft" project. Schulman got at the cleartext by looking at the program in a debugger, AFTER it had decrypted the database and loaded its contents into memory; he didn't try to crack the encryption method itself. My point is, if the crypto used here is as poor as has been seen in the password area, and somebody were to come up with a way to fool this "compliance checking" protocol (which would defeat BOTH the "voluntary" registration function and the potentially much more interesting reduced- price product upgrading authentication mechanism), I think that might constitute very poor PR for Micro$oft, as well as a highly crypto-relevant issue. That is, a hell of a lot more people might exploit a flaw like that in order to falsely qualify for cheap upgrades than would ever be involved in exploiting the password cache problem. For those who missed it, and who care, the URL is ftp://ftp.ora.com/pub/examples/windows/win95.update/regwiz.html rj

1 0

Re: A Modest Proposal: Fattening up the Proles
by stevenw＠best.com 17 Dec '03

17 Dec '03

Tim May: >(Ironically, I brought up the new book, "The Winner Take All Society," at >the last Cypherpunks meeting. No time to discuss it here, but it confirms >my strong belief that we are heading for a economy in which a shrinking >fraction of workers have really valuable things to contribute, and a >growing fraction of the population does not. I had not recalled the >authors, but Strick had a battery-powered laptop and Metricom wireless >modem, and ran an Alta Vista search from where he was sitting: ROBERT FRANK >& PHILIP COOK, The Winner-Take-All Society, New York: The Free Press.) See also _The End of Work_ by Rifkin. It chronicles changing work patterns from agriculture through mass manufacturing and the service age on to an uncertain future. Lots of interesting numbers and "look what is already happening" statements. It also shows that the changes are inexorable, just as the decline in agriculture based on human and animal labor was. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0