December 2003 - cypherpunks-legacy

Re: [FYI] FBI Training Eastern European Police
by Dave Del Torto 17 Dec '03

17 Dec '03

At 8:22 PM 12/6/95, anonymous-remailer(a)shell.portal.com wrote: [elided] >I'm certain that the FBI and other law-enforcement officials might >also learn by living in a city where the East truly meets the West. > >Budapest is a beautiful old city of bridges, not just literally but >figuratively. It's where anyone in the world can find comfort. [much elided] Hey "Alice," This is a very persipicatious set of observations about Budapest, a city I lived/worked in for a while (you sound like you know it rather well yourself). The level of technical CS knowledge in Bp is comparable to, or better than, many other cities (except maybe for Moscow and St. Petersburg) in the former Bloc. Your comments also provide good insights into why it's technically and geographically important to cypherpunks: it's the petri disk for many of our cpunk brethren over there. The fact that the FBI has chosen Bp as one of their entry-points into the region impacts our policy discussions here, particularly since our LE types are making contact with the former secret police in that region, and especially so given the stationing of US Troops in Kaposvar as we type (southern Hungary) for easy entry into Bosnia. Anyone who attended CFP 95 may also remember some of Esther Dyson's lunchtime comments about the Russian mafia (which has a strong presence in Bp) and the growth of crypto's use both by the gangsters and LE officers. Some of the most powerful crypto may be emanating from these regions and it would be wise for us to try and track TLA activities in that area. I won't drag this topic out any further, but if anyone comes across similar info about our various TLAs operations over there, I hope they'll at least share it with me, if not the list. dave PS: I hope Perry's paying attention. ;)

1 0

Anyone Remember socket.c?
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Fellow 'Punks, A while back on the list, someone posted a very short C program called socket.c, which, when given a port number and an excutable, would fork off copies of a given application for anyone who connected to the port. I saved the program at the time, but seem to have deleted it. I realize it would be trivial to write, but don't want to have to look at nasty network #include files. If someone could either post it to the list again, or email me a copy, I will be eternally greatful. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Java musings
by Adam Shostack 17 Dec '03

17 Dec '03

Some musings on policies, threats and liabilities of Java, Livescript and other downloadable applets. I. Policies. The recent Livescript problem was predictable. Building an execution environment to safely handle all the myriad of tricks that programmers will throw at it is not a simple or easy task. People will make mistakes in the design and execution of these environments. Right now, many people are chasing the idea of applets; its neat, sexy, and everyone wants in. But, for many users, and many environments, certain capabilities may be inappropriate. There has already been loud complaining in many forums about the lack of site configurable Certification authorities, lack of site control over Java features. A site needs to be able to decide who to trust, and who should be able to make these decisions, in a manner that a user can not easily override. The ease of configuration of trust parameters in Netscape is neat for personal use, but inappropriate for business. When Java gets its ability to check signatures, expect complaints about lack of site configuration of trust hierarchies. (Yes, as opposed to web of trust. As a bank, I want to be able to control what code can run with a very explicit hierarchy.) All applets are not created equal. All user requirements are not equal. Applets are not created equal. Some are created in house to do certain things, like watch the price of two stocks relative to one another. If an applet is created in house, signed off on by the InfoSec people, then there's no reason (assuming strong integrity checking) to deny it access to local disk, arbitrary network access, etc. However, for various reasons (notably compartmentalization, aka defense in depth), it is desirable to restrict disk (and possibly network) access to certain addresses. Something akin to chroot(), tagging of packets outside the applications control to make firewall filtering easy, filtering of available addresses to send to (only talk on local subnet). The ability to assign various levels of privilege to code that runs on a virtual machine will be essential. The ability to limit these privileges must be reserved in some way to those with site security responsibilities. The security people, in turn, will need the ability to delegate. This can perhaps be provided based on a least trusted basis. Code starts out in a small, tight environment, with no access to anything other than the (protected) processor, and a promote() function which does authorization checking before granting new levels of privileges in certain areas. Access to disk, access to local and remote network services, and the ability to pull the browser to a new URL are all privileges that should be orthogonally configurable, by site, by machine, or by applet. All user requirements are not equal. This should be obvious. Not all users need Java or Livescript. If a user is using Netscape to look at man pages, access to Java and livescript is not very important. Access to unsigned Java applets may or may not meet the site security policy. At home, I might happily look at them. In the office, I might have a very different approach. A bank teller might need access to applets developed by the bank for various things, but not need access to anything over the internet. He would need to be able to access the local lan servers. The need of users to get to different resources, and work under different levels of protection calls out for mandatory strong authentication in applets. In other words, a better design might be only execute applets with some (verified) signature attached to them. The language in which the applet was written is important. More important is the ability of users and management to set policies, and see those policies enforced by applications. I could then set my browser only to run Livescripts signed by someone I know (or an agency that vets them for bugs), and only run Java with minimal trust in the absence of signatures. II. Threats and liabilities A malicious applet, running amok on a machine, with the same disk & network access as a user, can send off to the world anything it thinks interesting. However, there are times when letting an applet at certain files, or giving it heavy network access, might be very useful. I'll take as an example Anderson Consulting's demo BargainFinder (http://bf.cstar.ac.com/bf/) BargainFinder is a way to search 9 music stores on the web for an album, with one form. 3 of the stores are blocking the searches. In addition, a cypherpunk might wonder if the searches and their origins are being logged. Thats not very useful for those of us who look forward to perfect marketplace information for consumer goods. Let me sketch BargainFinder2, as powered by Java. Instead of going to Anderson for the page, you download BF to your local machine. It does the searching, same as BF1 did, but with no blocking possible. You find your CD at the best price. Perhaps BF is rental-ware, perhaps its someone advertising their Java coding skills. But its clear that this applet needs to be able to access the network freely. Its also plain that it won't be written for 6 platforms. It might be written for Windows, but the Java market might be larger still, and thus more attractive. (Not to mention that the network interface is mostly taken care of. no Winsock version worries.) Other applets, say a Ecash wallet manager that interfaces with Quicken, needs access to your local disk, and needs to be able to respond to incoming network queries from shops. Granular control of the access that applets have thus seems to be needed. Making Java 'secure' is not enough, because people will 'turn off' all the security to make one applet work. It might also be interesting to consider automatically updating software, that can replace itself from time to time, after verifying that a signature is correct. Although, that does raise the value of stealing a key from some well known, trusted applet vendor. To summarize, 'security' in the vauge sense that Java promises, while useful, needs granularity to allow it to fulfill its potential. Comments are welcome. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

GAK solutions was: Is there a lawyer in the house?
by Pat Farrell 17 Dec '03

17 Dec '03

In message Thu, 7 Dec 95 16:27:23 EST, cme(a)acm.org writes: > It could be even worse. I was on a panel last year with Scott Charney > (sp?) (I believe from DoJ) during which he commented that if you give > your secret key to anyone -- e.g., your own company -- then you have > given up the presumption of privacy. Interesting. At the NIST meeting, criteria #5 deals with decrypting a conversation with only the key from one end. I thought that would be hard to implement. But during the discussion, they called on Miles Smid [sp?] who was obviously a NIST employee/consultant with real knowledge. He suggested that you could encrypt the session key with the public key of both parties, and send it along. This would allow single ended GAK. This is not far from the idea that CME proposed that the NSA/FBI/CIA publish public keys, and we'll hack a voluntary version of PGP that encrypts the session key with the LEA public key -- instant voluntary Key Escrow. Miles Smid's idea seemed reasonable, until you realize that he intends you to escrow your private key... Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: GAK solutions was: Is there a lawyer in the house?
by Carl Ellison 17 Dec '03

17 Dec '03

[By the way, I know that my sig on that message was bogus. I made the mistake of editing the message after signing it and sent it before I stopped to think.] >Date: Thu, 07 Dec 1995 22:07:00 -0400 (EDT) >From: Pat Farrell <pfarrell(a)netcom.com> >Subject: GAK solutions was: Is there a lawyer in the house? >Interesting. At the NIST meeting, criteria #5 deals with decrypting >a conversation with only the key from one end. > >I thought that would be hard to implement. But during the discussion, >they called on Miles Smid [sp?] who was obviously a NIST employee/consultant >with real knowledge. He suggested that you could encrypt the >session key with the public key of both parties, and send it along. >This would allow single ended GAK. Miles Smid is a NIST employee who is quite knowledgeable about crypto and Clipper. >This is not far from the idea that CME proposed that the NSA/FBI/CIA >publish public keys, and we'll hack a voluntary version of PGP that >encrypts the session key with the LEA public key -- instant >voluntary Key Escrow. I still think that's the only way the gov't will get GAK -- :) - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Re: Micro$oft and Java
by Joel McNamara 17 Dec '03

17 Dec '03

I was at the Microsoft presentation. Crypto-relevant info: A patch will be published in the next few days to address the weak .PWL encryption. I got a rather lame excuse about how the encryption was first implemented in 1991, and how it was sufficient then. They will supposedly be changing the seed. I asked about what MS was doing in regard to future strong crypto. Got an interesting response in that that "the government was going to let them implement 768 bit keys." I later asked an MS person if these were RSA session keys or what. He said yes, but I really don't think he knew what he was talking about based on some of his other comments. Visual Basic Script will be MS's response to JavaScript. The interesting thing here is a plan to use digital signatures on controls and scripts as a means of authentication. The comment was made "you'd trust something signed by Lotus or some other big name, but you probably wouldn't be that trustful of a piece of shareware." Hmmm... MS will be releasing a "safe" runtime version of Visual Basic that will supposedly prevent nasty virii and trojan horses from being implemented on Web pages. IMHO, Perry's previous comments on the security of Java apply. Servers and some clients will support end-to-end encryption. No details... I didn't ask about GAK. Bill said there was a white paper explaining Microsoft's position on encryption. Maybe I'll test the search capabilities of the MS Web site later tonight. Overall, the presentation was interesting (but obviously lacking in technical details as the audience was mostly press). MS is going to throw a lot of resources at this in order to maintain its industry dominance. Thought for the day. Bill on the relevance of the briefing being held on Pearl Harbor day quoted Admiral Yamamoto after the 1941 attack, "we have awoken a sleeping giant." Draw your own conclusions on that one... Joel

3 2

Re: GAK solutions was: Is there a lawyer in the house?
by Carl Ellison 17 Dec '03

17 Dec '03

>>This is not far from the idea that CME proposed that the NSA/FBI/CIA >>publish public keys, and we'll hack a voluntary version of PGP that >>encrypts the session key with the LEA public key -- instant >>voluntary Key Escrow. > >I still think that's the only way the gov't will get GAK -- :) Actually, the real proposal (http://www.clark.net/pub/cme/html/no-ke.html) is to have them give me their public keys. I would sign and post them. The world's citizens would then add them to their public keyrings and, when they feel like volunteering GAK, would include these agencies as crypto-recipients -- on a per-message basis. No meetings -- no hassle -- nearly 0 cost -- and the gov't could have GAK tomorrow. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Re: PGP
by Adam Hupp 17 Dec '03

17 Dec '03

Sorry...I was always taught that the user should not be mandated to finish the job of the programmer. Please, do not take me wrong, PGP is a remarkable tool...but I was not aware I had iron out the bugs. That part is the easiest to do compared with the genius of the program... but I still should not have to do it. This is not "ironing out bugs". It is configuring the program to run on your version of Unix. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQBtAzCNppQAAAEDALhWZl7IuGZ9zZT5bACo0b/1L0Nv0C72vKHIO3IHh+cwpHHa 2Ozb9aeO0UvXGwkkZIYgUm0EvmzKh7yb1GTLvBp5kXpR3I9w+Yj4LGlBDERpUWw6 x4ED49pwDnz1Hl5FBQAFEbQYYXNoIDxhaHVwcEBwcmltZW5ldC5jb20+ =PtJK -----END PGP PUBLIC KEY BLOCK-----

1 0

Netscape stock on 12/7/95
by Adam philipp 17 Dec '03

17 Dec '03

2 1

Oh Yeah? ipsecure
by Ecafe Mixmaster Remailer 17 Dec '03

17 Dec '03

For Immediate Release Contact: National Semiconductor Lori Sinton (408) 721-2448 lori(a)ipower.nsc.com http://www.ipsecure.com CryptoSampler, from National Semiconductor, Demonstrates Ease of Building Secure Electronic Commerce and Communications Applications Company's iPower(tm) Business Unit Launches Free CryptoSolver to Inaugurate New Web Site SANTA CLARA, Calif., November 27, 1995 --- National Semiconductor Corporation today announced the availability of its CryptoSampler package for applications developers interested in gaining a "hands on" understanding of how cryptography solves modern business problems. Developed by National's iPower Business Unit, the program consists of three demonstration applications and the PersonaCard(tm) 100, a hardware token for personal, portable data security. The package contains both the demonstration applications including "build-it- yourself" tools to integrate security easily into electronic commerce and communications applications. Priced at $129, the CryptoSampler package is available to the first 1,000 U. S. respondents and can be ordered directly from National's iPower Business Unit. In a related move, the company's iPower Business Unit launched its own web site along with CryptoSolver, an interactive game that invites participants to solve encrypted messages based on the concepts of substitution ciphers and the alphabetic frequency table. CryptoSolver, a technology-teaser game rates players' deciphering skills and can be downloaded from iPower's new web site free. "As networks become the lifeblood of corporations and the principal means of commerce, securing electronic transactions and proprietary information over public and private networks is absolutely critical," said Tom Rowley, marketing director for National's iPower Business Unit. "Through this program, we hope to help broaden individual's understanding of how modern security technology can solve real problems on the Internet and in Electronic Commerce business applications," Rowley explained. CryptoSampler Package - Token Plus Three Applications in One ------------------------------------------------------------ The CryptoSampler package consists of a PersonaCard 100 data security token, a floppy disk containing all three demonstration applications, a cryptography primer written by recognized cryptography expert Bruce Schneier, and a questionnaire. Customers who choose to complete and return the questionnaire, will receive a free copy, while supplies last, of Bruce Schneier's newly-released book, Applied Cryptography, second edition. o PersonaScreen(tm) System Lockout Utility is a screen locker that prevents unauthorized entry into a personal computer by locking the keyboard and mouse. The PersonaCard Token, implemented in the PC Card (formerly PCMCIA) Type II format, locks and unlocks the desktop computer. o PersonaSecure(tm) Word Utility enables users to sign, seal (encrypt, decrypt), and verify documents as well as e-mail messages from within Microsoft Word 6.0 for Windows. Installed automatically, PersonaSecure displays a toolbar that corresponds to the functions of National's PersonaCard data security token. The hardware token incorporates RSA's industry-standard digital signature and encryption formats which are now "token aware." In addition to protecting and validating Microsoft Word documents, users can encrypt and decrypt e-mail messages with others who have installed the PersonaSecure Word Utility. o PersonaDLL Library for Visual BASIC 3.0 is a Dynamic Link Library (DLL) of routines that enables developers to quickly and easily develop their own applications incorporating high-level data security features. PersonaDLL includes a Visual BASIC application, Visual BASIC source code, and access to all of the features of the PersonaCard 100 token including digital signatures, RSA key generation, encryption, and verification. System requirements to run the CryptoSampler package are: Microsoft Windows 3.X, Windows for Workgroups 3.X, and a PC Card slot (version 2.1 or later). Microsoft Word 6.0 is required for the PersonaSecure Word Utility. Pricing and Availability ------------------------ The CryptoSampler package is available with or without a PC Card Reader. For those who plan to run CryptoSampler applications on a desktop or portable personal computer already equipped with a PC Card slot, the basic package is offered at a special price of $129 (including handling and shipping). A CryptoSampler package with PC Card reader is available for $199. The total retail value of the basic package and configuration with card reader is $300 and $500, respectively. To order the CryptoSampler package in either configuration, call 1-800-272-9959 Ext# 631 between the hours of 7 AM and 7 PM Central Standard Time. To play CryptoSolver and for more information about the CryptoSampler program, see the iPower web site at http://www.ipsecure.com . iPower Security Solutions ------------------------- Introduced a year ago, iPower technology provides the highest-level of commercially available security in a personal, portable hardware token. iPower solutions are already being incorporated by OEMs, ISVs, and VARs into a variety of applications and hardware platforms including e-mail and messaging, electronic commerce, network security, and secure access to on-line services including the Internet. National Semiconductor Corporation provides technologies for moving and shaping information. The company focuses on four key areas - communications, consumer, industrial, and personal systems. National Semiconductor is headquartered in Santa Clara, California, and has 22,300 employees worldwide. -30- Note to Editors: To receive a CryptoSampler package for review, call or e-mail Lori Sinton, 408 721-2448 or sampler(a)ipower.nsc.com iPower and PersonaCard are trademarks of National Semiconductor Corporation. All other trademarks are held by their respective companies.

1 0