December 2003 - cypherpunks-legacy

CryptLib CAPI for VB
by Joel McNamara 17 Dec '03

17 Dec '03

Before I do it myself, thought I'd check if anyone has updated Peter Gutmann's CRYPT.BAS file for CryptLib (if not, I'll forward it to Peter when I get finished). The current version is fairly out of date, and I'm looking for a library to use with Visual Basic to implement some secure hashing and 3DES. Thanks in advance... Joel

1 0

ISP-TV Interview with Solveig Bernstein
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: Interview with Solveig Bernstein *** Monday, September 16 9:00 PM ET Solveig Bernstein Assistant Director of Telecommunications & Technology Studies Cato Institute ISP-TV will present an interview with Solveig Bernstein from the Cato Institute. Ms. Bernstein will be discussing legal issues concerning the CDA, the upcoming Supreme Court case, and other telecom legal issues. This video interview can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.247.33, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html See URL http://www.digex.net/isptv for more information about the ISP-TV Network

1 0

Re: What is best policy paper on crypto?
by Hallam-Baker 17 Dec '03

17 Dec '03

Adam Shostack wrote: > > Declan McCullagh wrote: > | I happen to know that an influential Congresspern will be meeting with > | some Cato folks tomorrow morning, so I'm assuming this isn't an idle > | request. > The NAS report, despite a few silly points, does push for > liberalization of the export regime, standardization, a switch to > an 'assume export' stance, states that the debate can be carried out > in public, and that classified information is not needed, and suggests > that crypto can help reduce many threats to Americans. > > It does not suggest abolishing the ITARs, and suggests > consideration of a law criminalizing the criminal use of crypto. I agree that the NAS report is the one to use. Its from an authoratative source and the conclusions are pretty reasonable. Its perhaps not as far as some would like to go but if we got there it would be livable. Given where we are it would make a good first step. Some good lines from the talk included: Re Dennings "If you know what I know argument", basically Lin said that he did know and it made no difference at all to his point of view. Also 13 of the 16 members of the committee got "the briefing" - which is all Dorothy bless her socks got, and the report was unanimous. Re who is behind the anti crypto policy, its Freeh at the FBI and not the NSA. The NSA know crypto and don't really care all that much. Gore credited as guy who is holding Freeh back. Seemed a reasonable enough guy, but a number in the audience were upset that they didn't have someone like Dorothy who we can throw tomatoes at. Phill

1 0

Gaining trust in OCO crypto code
by frantz＠netcom.com 17 Dec '03

17 Dec '03

These thoughts came up at the Mac Crypto conference, but are somewhat more general than the Macintosh, so I am ccing them to cypherpunks. OCO, or Object Code Only, a bad idea whose time has not yet past (although it was part of the reason for the decline of IBM's mainframe operating systems), is the business practice of keeping the source code for a system secret. Some companies are applying the idea to cryptographic software, so the we should think about how we can establish trust in such software. There are three techniques which may work for all OCO software. (1) Trust the designer/implementor. Ron Rivest's RC2 and RC4 algorithms were originally released as OCO algorithms. Rivest's reputation as a cryptographer established trust in them. (2) Trust a third party auditing agency. The US military trusts vendor implementations of cryptographic software because they have been audited by the NSA. (3) Reverse engineer the implementation. While laborious, this process is straight forward. When Netscape started using RC4 in their SSL implementation, a review of its security became important enough that a certain anonymous person(s) reverse engineered the implementation and posted it to the Internet. As a result, the algorithm has undergone peer review. If we can't use the above techniques, we have to think very carefully about what parts of a cryptographic system we can trust by only examining their inputs and outputs. Here is a list of things we can NOT trust in this manner: (1) Random number generation. An error (as occurred in a Netscape implementation), or a deliberate weakness can not be easily detected by examining only the output of a cryptographic random number generator. (2) Key generation. There are published ways to encode an RSA secret key in the corresponding RSA public key. A key generation algorithm which only uses 32 bits of the random number would be hard to detect, but easy to break by one who knew its secret. You have to be able to examine in detail how keys are generated. Now there are some things we might be able to trust based only on an examination of the inputs and outputs. (1) Implementation of a cryptographic algorithm. If we can feed it enough test cases, and compare the output with a public, well vetted implementation, we can come to believe that it is correct. (2) Certain cryptographic protocols. If we can trust one side of a Diffie-Hellman (DH) key exchange, then we can trust the keys generated because both sides contribute to the randomness of those keys. However we can't trust two instances of an OCO DH exchange implementation working with each other, so this trust doesn't seem to cover many practical instances. If the OCO protocol implementation can interoperate with a trusted implementation, then we can start to have some trust in it. However, we will still have to carefully examine the protocol for covert channels. This form of trust may be of real-world use. ------------------------------------------------------------------------- Bill Frantz | "Lone Star" - My personal | Periwinkle -- Consulting (408)356-8506 | choice for best movie of | 16345 Englewood Ave. frantz(a)netcom.com | 1996 | Los Gatos, CA 95032, USA

1 0

Re: [Long] A history of Netscape/MSIE problems
by Hallam-Baker 17 Dec '03

17 Dec '03

Some comments:- 1) Netscape were using BSafe but Kipp unhooked the ergodicity testing code which is meant to detect inadequate random number generation methods. Netscape got full access to Bsafe in return for 1% of Netscape stock. 2) Most serious concern was not the 40bit part. That was simply the US govt making the security a joke and there was nothing that Kipp or anyone else could do about it. More serious were the structural problems, SSL cannot be used across a firewall (unless the admin is a twit) because it is entirely opaque. SSL is not very good as an authentication only option. There is no facility for escrow of keys - another essential feature if you are to use it inside a corporation. If I am the CIO of IBM I'm not having the company secrets go out the door via some encrypted stream I can't read. Similarly banks and nuclear power stations have a legit need to snoop on their own lans. 3) Microsoft proposed PCT because they wanted to force Netscape to make SSL an open standard rather than one Netscape could tweak as they liked and freeze Microsoft out of the picture. Quite how they would imagine that anyone would want to ever do such a thing... 4) The initial weakness exposed in SSL was that integrity attacks had not been considered at all. It took a while to explain that this was in fact a more pressing concern than confidentiality in many applications. The SSL.v2 integrity was not actually bound to a particular site. Simon Spero produced a rather nice proxy server which allowed one to reroute URLs but keep the key intact. (ie connect to foobar.com and get the netscape home page). There was a long list of security holes in SSL, PCT plugged a good number of them and SSL v3 plugged a few. The overall design never gave me confidence however. Like much Netscape stuff they start with an over-simple view of the problem spec and then try to solve problems by adding extra ornaments. Phill

1 0

Re: Court challenge to AOL junk-mail blocks
by Hallam-Baker 17 Dec '03

17 Dec '03

watson(a)tds.com wrote: > > NetSurfer said: If you know a valid email address on the spammers system you can always > bounce each message back to them. If enough people turned the messages > back on them it might give them the opportunity to experience first hand > what its like to receive tons of mail you don't want or need... > > Doesn't seem to work that well. The "green card lawyers" were reported > to have received hate-mail in the hundreds of thousands. The happily waded > through it all and pulled out a few valid replies who apparently made it > all a net profit for them, apparently. What we really need is to improve > our defensive filtering mechanisms. Someday soon we'll all have our own > personal software agents that will handle all this stuff for us. Balls, the green card lawyers minions ratted on them. The number of responses from interested people was small and the amount of business they obtained even smaller. The cost of going through all the mail, getting new net hosts and such left them with a net loss which is why they are no longer in business. Phill

1 0

EPIC Alert 3.16
by Dave Banisar 17 Dec '03

17 Dec '03

============================================================= @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @@@ @ @ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @@@@ @ @ @@@@ @@@@ @ @ @ ============================================================== Volume 3.16 September 12, 1996 -------------------------------------------------------------- Published by the Electronic Privacy Information Center (EPIC) Washington, D.C. http://www.epic.org/ ======================================================================= Table of Contents ======================================================================= [1] White House Proposes Screening of all Airline Passengers [2] EPIC Testifies on Children's Privacy Bill [3] House Panel Probes White House Database [4] Crypto Update [5] Anonymous Remailer Shuts Down [6] EPIC Now Accepts First Virtual Contributions [7] EPIC/PI to Sponsor Conference on Surveillance Technologies [8] Upcoming Conferences and Events ======================================================================= [1] White House Panel Endorses Airport "Profiling" System ======================================================================= In the wake of perceived terrorist threats and the mysterious crash of TWA Flight 800 in July, a Presidential advisory panel has proposed an automated system for increased screening and "profiling" of airline passengers for all domestic and international flights. In its interim report sent to President Clinton on September 9, the White House Commission on Aviation Safety and Security provided few specifics, but noted that "[b]ased on information that is already in computer databases, passengers could be separated into a very large majority who present little or no risk, and a small minority who merit additional attention." Details of the profiling system will presumably be withheld from the public on national security grounds -- a substantial portion of the Commission's "public" meeting on September 5 was closed to permit the discussion of "classified" matters. Nonetheless, the proposed system appears to raise substantial privacy issues. The Washington Post recently reported that under the proposal, "the federal government would require creation of a computer profiling system that would examine passengers' bill-paying records, flying habits and much other data to determine which checked baggage should undergo examination by sophisticated explosives detection equipment." The Commission's initial report also calls for FBI and CIA involvement in the development of the profiling database. The theory underlying the profiling proposal appears to be that even seemingly innocuous bits of personal data can raise the suspicions of a law enforcement agency. This point is illustrated by the comments of an unidentified FBI agent recently quoted in a New York Times article. Discussing the Bureau's investigation of the bombing of Pan Am Flight 103 over Scotland, the agent noted that, "Almost everyone on the plane, almost everyone you ever met, has something that can get your imagination going. A recent fight, a divorce, a business deal, an overseas connection -- when you don't know what you're looking for, it's easy to see all kinds of possibilities." EPIC plans to monitor the development of the automated passenger profiling system under the public oversight provisions of the Federal Advisory Committee Act, which governs the proceedings of the White House Commission. More information, including relevant government documents, is available at: http://www.epic.org/privacy/faa/ ======================================================================= [2] EPIC Testifies on Children's' Privacy Bill ======================================================================= EPIC Director Marc Rotenberg testified today before the House Judiciary Committee Subcommittee on Crime in support of the Childrens Privacy Protection and Parental Empowerment Act of 1996. The bill would establish basic privacy standards for organizations that collect personal information on children and curb recent abuses in the marketing industry. The bill is sponsored by Rep. Bob Franks (R-NJ) and has 46 cosponsors in the House of Representatives. A similar measure has been introduced in the Senate by Senator Diane Feinstein (D-CA). Rotenberg said that "current practices pose a substantial threat to the privacy and safety of young people." He described a recent incident where a reporter posing as the murderer of Polly Klaas was able to obtain the ages and address of young children living in the Pasadena area. Rotenberg also cited editorials from USA Today and the Economist favoring privacy legislation as well as public opinion polls which show that 9 out of 10 Americans object to the sale of personal data where explicit consent is not obtained. Recalling the passage of the Family Educational Right to Privacy Act of 1974, which protects the privacy of student records, Rotenberg said there was already Congressional recognition of the need to protect personal information about young children. "No universities have been shut down because of the Act, but the privacy of children's educational records is more secure because Congress did not fail to act when it had the opportunity to establish privacy protection for young people." #011#Also testifying in support of the bill were Rep. Bob Franks, children rights advocate Marc Klaas, and Miriam Bell of Enough is Enough. Marc Klaas also heads the Klaas Foundation for Children which launched the Kids Off Lists campaign. Testifying against the bill were representatives from the Direct Marketing Association, a list broker, a book publisher, and a police officer from San Bernadino. More information on the Childrens Privacy bill and kids privacy may be found at: http://www.epic.org/privacy/kids/ The Klaas Foundation for Children is on the web at: http://www.klaaskids.inter.net/ ======================================================================= [3] House Panel Probes White House Database ======================================================================= The General Accounting Office revealed at a hearing of a subcommittee of the House Committee on Government Reform and Oversight on September 11 that the secret White House database of 200,000 people has inadequate controls on access. The GAO reported that the database, this existence of which, was revealed during the Filegate controversy, does not keep track of what files have been viewed by the 150 White House staffers who are authorized to access the files. The database contains 125 different fields of information for each file. Several thousand files included ethnic and political information. The GAO did not reveal in its testimony what was contained in the other fields. According to news reports, the database was designed to link into other related databases, including the Secret Service and the Democratic National Committee. The White House claims that the database is used for a number of reasons, including, for invite lists for White House events, tracking correspondence, sending out Christmas cards and other matters. Congressional Republicans claim that it is more akin to the Nixon "enemies list." The database was created by PRC Inc., a company that also creates databases for the CIA and other intelligence agencies, among other government agencies. ======================================================================= [4] Crypto Update ======================================================================= As the election approaches and Congress scrambles to complete its agenda before recessing for the year, members are continuing to deal with cryptography-related issues. The Senate Commerce Committee delayed its scheduled vote on S. 1735, the Promotion of Commerce Online in the Digital Era, originally planned for September 12. The Committee is expected to take up the measure next week. Members of the Committee have reported receiving a large number of calls supporting the bill. Individuals interested in supporting the bill should continue calling members of the Committee. The House is planning to hold hearings at the end of September to examine the companion House bill. The hearings were originally scheduled for September 11 but were delayed due to other legislative matters. The White House is also expected to introduce its own legislation next week. According to reporter Brock Meeks, the legislation will offer "sweetheart deals" to limited segments of the industry including financial, health care and insurance sectors who would then agree to support government key escrow systems. The systems would then become de facto mandatory. Internationally, an expert committee of the Organization for Economic Cooperation and Development is meeting on September 26-27 to review draft guidelines on cryptography policy. The US has been pressuring the OECD to adopt its key escrow proposals as an international standard but has been opposed by other countries and business representatives. EPIC will be hosting an international symposium in Paris on September 25, in cooperation with the OECD, to provide an opportunity for cryptographers, human rights advocates, privacy experts and user associations to present public concerns about the development of international privacy guidelines. The event will feature speakers from more than a dozen countries and includes US cryptographers Matt Blaze, Whit Diffie, and Phil Zimmermann. On September 20, oral arguments will be heard in the Daniel Bernstein's challenge to the constitutionality of export controls in federal court in San Francisco. Bernstein is arguing that the controls violate the First Amendment. Judge Marilyn Patel ruled preliminarily in May that software code is speech protected by the First Amendment More information on cryptography is available from: http://www.epic.org/crypto/ ======================================================================= [5] Anonymous Remailer Shuts Down ======================================================================= Johann Helsingius, the operator of the anon.penet.fi anonymous e-mail service has decided to shut down his remailer service because of the unknown legal protections of privacy on the Internet. He had come received requests by the Church of Scientology and the Singapore government demanding to know the identity of some of his users. In a press release, he said that he hoped to bring the server back up once the Finnish government enacted new laws protecting privacy of electronic messages, "I will close down the remailer for the time being because the legal issues governing the Internet in Finland are yet undefined. The legal protection of the users needs to be clarified. At the moment the privacy of Internet messages is judicially unclear." A list of remailers and other tools to protect privacy are available from: http://www.epic.org/privacy/tools.html ======================================================================= [6] EPIC Now Accepts First Virtual Contributions ======================================================================= Individuals interested in donating or purchasing books from EPIC can now use the First Virtual system to transfer money to EPIC. Until the end of 1996, donations of up to $50 will be matched by the Stern Foundation. Your support is appreciated and will help make possible our continued FOIA litigation, privacy advocacy, and web site development. More information about supporting EPIC is available at: http://www.epic.org/epic/donate.html ======================================================================= [7] EPIC/PI to Hold Conference on Surveillance ======================================================================= The new generation of covert surveillance activities of government agencies and private companies will be examined at a conference to be held in Ottawa next week, sponsored by EPIC and Privacy International. The conference will explore the process of planning and implementation of the technologies, their operating conditions, and the people and organizations responsible for instituting them. The conference will also examine possible technical, regulatory and legal responses. A number of former government agents, intelligence experts and surveillance analysts will gather at the Advanced Surveillance Technologies II conference on September 16th to discuss the use of powerful new technologies being used to gather information. Speakers will include Mike Frost, a former intelligence officer for the Canadian Communications Security Establishment and author of the bestseller "Spyworld." He will discuss the surveillance technologies used by the CSE and its American counterpart, the National Security Agency. The Conference will take place at the Citadel Hotel in Ottawa, Canada. More information is available on the conference from the Privacy International Web Page at: http://www.privacy.org/pi/conference/ottawa/ ======================================================================= [8] Upcoming Conferences and Events ======================================================================= "Advanced Surveillance Technologies II." September 16, 1996. Ottawa, Canada. Sponsored by EPIC and Privacy International. Contact: http://www.privacy.org/pi/conference/ottawa/ or email pi(a)privacy.org. "Privacy Beyond Borders", 18th International Privacy and Data Protection Conference. September 18-20, 1996. Ottawa, Canada. Sponsored by the Privacy Commissioner of Canada. Contact: jroy(a)fox.nstn.ca or http://infoweb.magi.com/~privcan/ "Regulation or Private Ordering? The Future of the Internet." September 20, 1996. Washington, DC. Sponsored by the CATO Institute. Contact: R. Scott Wallis, (202) 789-5296. "The Public Voice and the Development of International Cryptography Policy." September 25, 1996. Paris, France. Sponsored by EPIC. Contact: rotenberg(a)epic.org. "The 2nd International Conference & Exhibit on Doing Business Securely on the Information Highway." September 30 - October 1, 1996. Montreal, Quebec, Canada. Contact: http://www.ecworld.org/Conferences/2nd_Security/ menu.html. "Managing Privacy in Cyberspace and Across National Borders." October 8-10, 1996. Washington, DC. Sponsored by Privacy and American Business. Contact: Lorrie Sherwood, (201) 996-1154. "The Information Society: New Risks & Opportunities in Privacy," October 17-18, 1996. Bruxelles, Belgium. Sponsored by the European Parliament. Contact: http://www.droit.fundp.ac.be/privacy96.html "Communications Unleashed - What's at Stake? Who Benefits? How to Get Involved!" October 19-20, 1996. Washington DC. Sponsored by CPSR and Georgetown University. Contact: phyland(a)aol.com. "19th National Information Systems Security Conference." October 22-25, 1996. Baltimore, MD. Sponsored by NSA & NIST. Contact: Tammy Grice (301) 948-2067. "Eurosec'97, the Seventh Annual Forum on Information Systems Quality and Security." March 17-19. 1997. Paris, France. Sponsored by XP Conseil. Contact: http://ourworld.compuserve.com/homepages/eurosec/ (Send calendar submissions to alert(a)epic.org) ======================================================================= The EPIC Alert is a free biweekly publication of the Electronic Privacy Information Center. To subscribe, send email to epic-news(a)epic.org with the subject: "subscribe" (no quotes). Back issues are available via http://www.epic.org/alert/ ======================================================================= The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national id cards, medical record privacy, and the collection and sale of personal information. EPIC is sponsored by the Fund for Constitutional Government, a non-profit organization established in 1974 to protect civil liberties and constitutional rights. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, email info(a)epic.org, HTTP://www.epic.org or write EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. +1 202 544 9240 (tel), +1 202 547 5482 (fax). If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "The Fund for Constitutional Government" and sent to EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington DC 20003. Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and funding of the National Wiretap Plan. Thank you for your support. ---------------------- END EPIC Alert 3.16 -----------------------

1 0

Re: [Long] A history of Netscape/MSIE problems
by Tom Weinstein 17 Dec '03

17 Dec '03

Hallam-Baker wrote: > > There was a long list of security holes in SSL, PCT plugged a good > number of them and SSL v3 plugged a few. This statement surprises me. It appears to mean that you think PCT has fewer holes than SSL 3.0. If you know of any holes in SSL 3.0, I'd be very interested in hearing about them. -- You should only break rules of style if you can | Tom Weinstein coherently explain what you gain by so doing. | tomw(a)netscape.com

2 1

Re: mailing lists
by Ross Wright 17 Dec '03

17 Dec '03

On Or About: 12 Sep 96 at 18:11, Rabid Wombat wrote: > > > more restricted. I'm personally against needing to pay the social costs of > > more and more laws because someone is trying to make a buck any way he > > can, regardless of the costs and annoyances to others. > > > > Junk faxing was a blessedly short term fad, one that had to be legislated > > > > I'm completely in favor of allowing junk email, as long as "JUNK MAIL" is > > required to be the first thing on the subject line. PLONK! ... but that > > will take yet another law ... > Wombat: If you are "against needing to pay the social costs of more and more laws" Then how come you want another one? > IE," as long as "JUNK MAIL" is required to be the first thing on > the subject line. PLONK! >... but that will take yet another law > > ... "! One more law to pay for, one foot in the door for the government. Don't call for new legislation in order to not get spam! Please. Ross =========== Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Fed appellate judge remarks re anonymity, free speech on the net
by Greg Broiles 17 Dec '03

17 Dec '03

The Daily Journal, a LA/SF legal newspaper had an article today (9/12) about a lunchtime address given by Ninth Circuit Judge Alex Kozinski last Monday at an Internet Law Symposium in Seattle. The article quotes Kozinski as saying "I have a severe problem with anonymous E-mailers . . . You don't have a right to walk up to somebody's door and knock with a bag over your head." The article says Kozinski likened anonymous E-mail to menacing someone. Kozinski also suggested that computer-generated or morphed images of children involved in sexual acts may not be protected under the Constitution because of ongoing trauma to the child, while computer-generated or morphed images of adults would be protected. The article says that Kozinski was skeptical that he or other federal judges necessarily agreed with the 3rd Circuit's ruling in _ACLU v. Reno_ (finding the CDA unconstitutional). Kozinski is considered relatively conservative and relatively libertarian, as 9th Circuit judges go. Copies of the Daily Journal should be available at larger newsstands in CA; interested parties might try DeLauer's on Broadway near 14th St in Oakland if you're in my neck of the woods. (They usually have extras for the preceding week or so.) Also try Barnes & Noble in Santa Monica or the newsstand whose name escapes me in Westwood, if you're down there. (Also in today's news, the 9th Circuit upheld a CA statute forbidding sales of material considered "harmful to minors" from vending machines.) -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

2 1