December 2003 - cypherpunks-legacy

ABA Likes GAK
by jya＠pipeline.com 17 Dec '03

17 Dec '03

10-03-96 at 19:09 EDT, American Banker Banks Like Export Plan for High-Power Encryption By Drew Clark ----- "Banks have really taken a leadership role in the responsible management of cryptography," said a senior Clinton administration official who asked not to be named. "Banks are already doing what we want other organizations to do: safeguarding their keys and providing them, when necessary, to law enforcement." "Providing 56-bit encryption with key recovery doesn't help us," said Netscape spokeswoman Chris Holton. "The government is saying that you can export it but you have to provide us with the keys. We feel that is extortion on the part of the government." "We are making the best of a bad situation," said Scott Schnell, vice president of marketing for RSA Data Security. ----- Bank technology experts have reacted favorably to the Clinton administration's proposal to liberalize the development and sale of strong data security tools. This week, the government said it would lift export restrictions on certain kinds of cryptography, provided U.S. companies agree to cooperate with a procedure that would give law enforcement officials access to the "keys" of such codes, upon presentation of a warrant. Banks were heartened by the announcement because many view the widely used Data Encryption Standard - a low-level form of data scrambling - as inadequate protection against the rising computer power of so-called hackers. Though banks can use a complex 56-bit data encryption key for financial transactions, sensitive communications with overseas branches are limited to a less powerful 40-bit standard. Banks hope that a loosening of restrictions in general will benefit them, too. "This policy announcement is better than anyone expected," said Kawika M. Daguio, federal representative at the American Bankers Association in Washington. "It is gravy for us, but it's the meat and potatoes for the hardware and software industries." "Banks probably won't be adversely affected," said Stewart A. Baker, a partner at Steptoe & Johnson, a Washington law firm, "and they will be left pretty much where they were before." The announcement by Vice President Al Gore said that controls over powerful encryption technology would be lifted as the government and private sector develop a "key recovery" system. (International Business Machines Corp. already has stepped forward to head a consortium dedicated to creating such a system.) Current law forbids the export of computer hardware or software that uses cryptographic codes with digital "keys" - randomly generated combinations of 0's and 1's - longer than 40 bits. The longer the key length, the more impenetrable the code. For three years, the government has said it would permit the general use of more complex cryptography only if the companies using it placed their keys in the hands of the government or a third party. "Key escrow," as it is known in the technical community, is needed in order to prosecute people who have stored evidence of illegal activity on the hard drive of a computer, officials argued. But the private sector - banks included - have balked at handing over such access to any third party. The disagreement gave rise to a compromise system known as "key recovery" in which companies would hold their own keys but could be required to divulge certain information about specific transactions when presented with a court order or warrant. "What is novel is that it doesn't escrow any keys," said Homayoon Tajalli, executive vice president of Trusted Information Systems, Glenwood, Md., one of IBM's consortium partners. "If the government comes and gets this data with a court order," explained Mr. Tajalli, "then they take a digital lockbox from the third party or parties that hold it, and they read the message." Kathy Kincaid, director of information technology for IBM, said the difference between key escrow and key recovery is analogous to the following approach to securing a house when its owner goes on vacation: Instead of giving a key to two neighbors, the owner gives each neighbor half the combination to a lockbox that holds the key. "You must have both halves and put them together in exactly the right sequence," said Ms. Kincaid. "This provides protection against a single point of attack." Companies participating in development of key recovery systems include: Apple Computer Inc., Digital Equipment Corp., Groupe Bull, Hewlett-Packard Co., NCR Corp., RSA Data Security, Sun Microsystems Inc., Trusted Information Systems, and United Parcel Service. And a government official said banks may even play a role. "Banks have really taken a leadership role in the responsible management of cryptography," said a senior Clinton administration official who asked not to be named. "Banks are already doing what we want other organizations to do: safeguarding their keys and providing them, when necessary, to law enforcement." Heidi Kukis, a spokeswoman for Vice President Gore, said: "This key recovery system is the proper balance between commercial interests and national security." But not all agree. Some argue that the key recovery system still gives the government too much control over information flow. "Providing 56-bit encryption with key recovery doesn't help us," said Netscape spokeswoman Chris Holton. "The government is saying that you can export it but you have to provide us with the keys. We feel that is extortion on the part of the government." "We are making the best of a bad situation," said Scott Schnell, vice president of marketing for RSA Data Security. "The bottom line is that the standard proposed by the government is an insubstantial step in the right direction," he said. "We want to make sure it is usable and prepare for the day that products will be available that do not have this key recovery situation." The government's announcement came three months after a National Research Council report on the role of cryptography in an information-oriented society. The report encouraged liberalization of government standards and questioned the feasibility of the key escrow system then favored by government. "We raised the issue about the security of key escrow systems," said law professor Kenneth W. Dam, chairman of the body that prepared the report, "and we said the government should work on it." "I take it this is an attempt to move in the way of key escrow, with the help of industry," said Mr. Dam. [End]

1 0

[COMMENT][GAK] "GAK from KRAP"
by Brian D Williams 17 Dec '03

17 Dec '03

1) Thanks to Phil Zimmerman the world already has "Pretty Good Privacy." 2) Only an idiot, much less one of the 4 Horsemen would get caught using GAK from KRAP. 3) As the FOIA obtained documents from the Clipper I era indicated, the gubmint knows the only way to make this work is to ban other forms of encryption. 4) That and that alone would be "The Shot Heard 'Round the Net." Brian

1 0

Re: (Firewalls) Where is that Snake Oil FAQ again?
by Lou Zirko 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: adam(a)homeport.org, cypherpunks(a)toad.com Date: Fri Oct 04 18:15:25 1996 This is the same company that made the claim earlier on this list to "break our code and own the company for $1". It definately generated a lot of comments then, I think about six months ago. They changed their name to IPG midway through the process. This should be in the archives. Sorry about the late response to this but I have been unavailable for the last four days working on a project and am just beginning to catch up on sleep and mail. Lou Zirko Lou Zirko (502)383-2175 Zystems lzirko(a)c2.org "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 iQEVAwUBMlWamctPRTNbb5z9AQGoAggAngPrYPYCOp+53BZ3Ns0XJtsI6O/PqUzQ sbxzpROa/blx9O3e1zIxbxPk1+aQcEwUXsnfFbDnciAjouaSnRzIfKG9XJ+cOy5y XRaLzBgZ3lQr3fIp7mHv5n+nsdtrj8mdgmUxYXpO9q+MwTuGL54n12Qw23rJ4KMq TSkBSgJWeqr7Mf1X2bI8ejaIbgImv9dCNFXIF+mUpKea2rarGej7lM1NOFd5FuyT umaFeOcH05pcmC8sYmaabe5i9kmDXztCiGaCD3O101a7JoIh8GOCNjg7blo7q/lZ rw77jyYpsI+3Ra67jWOMRK3p3WeBq9K8XqpP0b0Wo02R5nU1w5UnjQ== =eT3d -----END PGP SIGNATURE-----

1 0

Did HP get a sweetheart deal, too?
by Ernest Hua 17 Dec '03

17 Dec '03

Ditto ... I expect Apple and the rest of the "gang" to announce something soon. Ern -------- From: San Jose Mercury (Breaking News) Hewlett-Packard wins $100 million NASA deals PALO ALTO, Calif. (Reuter) - Hewlett-Packard Co. said Friday that it won several contracts with a potential value of $100 million from the National Aeronautics & Space Administration (NASA). The contracts cover scientific and engineering workstation procurement contracts for mechanical computer-aided design and geographic information systems. The contracts cover a four year period. Hewlett-Packard will provide workstations, as well as peripherals, software, training and support services.

1 0

Sun's GAK position
by Frank Stuart 17 Dec '03

17 Dec '03

I haven't been able to find a position statemnet from Sun Microsystems about the new GAK plan, but it looks like I did find a position. This is from "http://www.sun.com/corporateoverview/CorporateEmployment/LISTINGDIR/JobDeta…": >Created on Oct 01 1996 06:01. To return to: Employment Opportunities Home >Page. >---------------------------------------------------------------------------- > >Sun Employment Req#: AUF971004 > >SUMMARY > >Descriptive Title: System Engineer >Skills: Security & Cryptography Exp. >Functional Area: Engineering: Engineering >Location: Vienna, VA > >DESCRIPTION > >Extensive Security and Cryptography knowledge and skills, ability to >authoratatively present and advocatae security technologies at technical and >public policy levels, confidence and skill at writing and presenting >security documents and presentations. specific knowledge of government >security requirements. A US Government Top Secret SCI and potentially other >clearances will be necessary for this position. >The position of Principal Architect for Security and Networks requires an >individual with the following levels of education, experience and >specialized knowledge. A masters degree in a computer related field or a >bachelors degree in a computer technology and a masters degree in a business >oriented discipline is required. A minimum of twelve years of directly >related experience in computers, computer security and mission critical >systems design, and deployment is also required. Credit for four years >experience may be granted for a candidate with a masters degree in computer >science or computer security. Up to six years experience can be credited for >a PHD in somputer security. The condidate needs experience and >specializedknowledge in the areas of: >Government Security Requirementes, NSA MISSI and DoD DMS programs, Public >policy issues of cryptography and Key Escrow, Current workstation and server >hardware, Trends in network and systems security, Analysis of competing >security products and technologies. Hands-on experience with installing and >configuring computer hardward, Sun's product offerings in the security >arena, NCSC and Common Criteria evaluaations of trusted systems. Export >controls as they apply to encryption and security products. >To be successful in the position the candidatae must be able and willing to >write short analytical papers and long research documents. The position also >requires short notice or extemporaneous presentations on security, >technology and Sun specific subjects to groups of one to two hundred >customers or industry professionals. >A successful candidate must be capable of presenting themselves in an >authoritative fashion on many aspects of security in order to influence >product development in directions advantageous to Sun Federal. the candidate >must also be comfortable and confident when representing Sun and Sun Federal >in government and industry standards bodies and technology forums. >To be successful the candidate must be able to develop, define and >articulate a security vision and to develop support both within and external >to Sun for necessary technological and procedural changes necessary to >accomplish that vision. The condidate must either hold or be capable of >receiving US Government Security Clearances for Top Secret and Special >Compartmented Information. These clearances may require a CI Polygraph test. >This position will be locate in Vienna, VA and report to the Sun Federal >Director of Systems Engineering. >---------------------------------------------------------------------------- >CONTACT: >Employment Agency resumes referred to this posting are considered >unsolicited; Sun does not accept unsolicted resumes. >To apply, please reference the requisition number of AUF971004 and email, >fax or mail your resume, attention Recruiter: Staffing45/OWSMI96, using: > > * Resume Submittal Form > * Email alias: Staffing45(a)bruin.corp.Sun.COM [ASCII ONLY, PLEASE] > * Fax number: 630-285-8177 > * Mail Address: > Sun Microsystems, Inc. > 2550 Garcia Avenue > Mountain View, CA 94043-1100 > Mail Stop: UITA01 > >---------------------------------------------------------------------------- > >Employment Opportunities at Sun > >---------------------------------------------------------------------------- | (Douglas) Hofstadter's Law: | It always takes longer than you expect, even Frank Stuart | when you take into account Hofstadter's Law.

1 0

[Books] Kahn's *The Code Breakers*
by stainles＠bga.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My room-mate just brought me the latest catalog from Uncle Hugo's Science Fiction Bookstore & Uncle Edgar's Mystery Bookstore. The updated edition of Kahn's *The Code Breakers* is listed as being expected by mid-November, with a cover price of $65. (No publisher listed.) Hugo's can be reached at 612-824-6347, or unclehugo(a)aol.com. No connection except as a satisfied customer. ==Dwight -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBMlW+rYY4AzhdF11FAQEfzwP5AXP/63of9MPefzguLX5n9byRVUPcXOKT cYJNdTGe9ErVb6skDNN7e4PiwlZPSV03OFgntsp9CBFed+2AN/d+EFI3kNyFWQ5p fwEZ2u6VYINaQ0PhYaxneoMrxa+U8gnB5PZ8sa/Pwq4hhf6XxcOk7vUwKsLPQmeX 2KBLVLKeWj8= =f5D5 -----END PGP SIGNATURE-----

1 0

Re: legality of wiretapping: a "key" distinction
by jim bell 17 Dec '03

17 Dec '03

At 06:10 PM 10/4/96 -0700, Vladimir Z. Nuri wrote: >>It didn't have to be this way. The SC might simply have said that wiretap >>warrants must follow the same rules all other warrants followed, meaning >>that the target is informed of the tap when it is placed. Sure, the police >>would howl, complaining that they'll never hear anything "useful" if the >>target is informed, but then again, the Constitution cannot guarantee that >>any particular search would achieve its intended results. > >but then again, if "we the people" didn't challenge a usurpation of >our rights when it happened, something's wrong here. I've read references to polls which repeatedly show that well over 60% of the public is opposed to wiretaps, period. But no, I'm under no illusion that even a legal challenge would be respected. > hence my >opinion that wiretapping should be challenged in court. Well, I agree it should be challenged, but if anything my point is that the reason it wasn't challenged was the fact that wiretap targets are never given the opportunity. (Note for the clueless out there: An after-the-fact challenge doesn't count. Apparently, "non-incriminating" wiretaps are essentially never announced to the victim...er...target. And judges are sufficiently biased, gutless, and brainless that they almost never throw out the _incriminating_ results of a wiretap warrant. THis is for the same reason Judge Ito didn't throw out the evidence the four crooked detectives got in OJ's house, after jumping the fence without a warrant, claiming that they were afraid somebody was in danger inside. As I'm fond of saying, "Fuhrman pretended to tell the truth, and Ito pretended to believe him.") >>Are police entitled to use thumbscrews if simply asking a question won't get >>the "right" answer"? I don't think so. > >very poor analogy. a rhetorical loser imho characterisitic of >painting the issue in terms of extremism. wiretapping doesn't involve >any physical pain to the surveilled. also it is barely analogous >to "search and seizure" in that there is nothing physical being >seized. (just playing the devil's advocate here) No, not at all. The point is that acknowledged illegal tactics (remember, wiretaps were illegal before 1968, but they were done!) may be unquestionably "useful," but that doesn't mean that they are acceptable. If anything, the fact that cops would use illegal tactics proves that they aren't very good judges of what tactics are appropriate. Furthermore, the fact that telephone companies ALLOWED cops to do illegal wiretaps before 1968 (and even assisted them) proves that you can't depend on them to limit these tactics to reasonable limits. >>One thing that was very important to those who wrote the US Constitution was >>the sanctity of contracts. > >well, if the person entered in a contract with their phone company >to provide protected communications, maybe you'd have a case there. >in fact such a thing is not such a bad idea. Since up until now people have not had a choice, I think it's appropriate to assume that every telephone customer would have been entitled to insist on an anti-wiretap clause, and got it. >>As I understand it, there is a principle in law that all affected parties to >>a dispute must be included in a proceeding. (To ensure that each can protect >>his own rights.) Obviously, targets of wiretaps have not been informed, and >>thus can't possibly have been included. > >on the other hand, there are clear laws that say you can't withhold >evidence. That's misleading. If a cop wants in your house to collect evidence but he doesn't have a warrant, not letting him in is "withholding evidence." But that's obviously okay. So you need to qualify that claim. >>While I'm sure that I will be corrected if this is wrong, somehow I doubt >>whether there has EVER been a "before-the-fact", full challenge of a wiretap >>order _including_ representation for the target of the wiretap. Further, I >>also doubt whether there is frequently ANY SORT of challenge to a wiretap >>by a telephone company, even when the target was not informed. Quite >>simply, the telephone company does not consider itself to be in the business >>of protecting the rights of its customers! And without real challenges, >>there can be no presumed validity to such warrants. > >no, you have it backwards; without real challenges, there >is no validity to anyone trying to defeat the status quo. That depends on whose burden of proof you think it is. Since: 1. Wiretaps were done illegally before 1968, demonstrating that the people involved (cops, government officials) don't think they have to obey the law anyway. This should destroy any presumption on your part that wiretaps are constitutional, because those people are the main ones pushing wiretaps. 2. 60% of the public opposes wiretaps, period. (I think it's arguable that if most of the public decides that society should do without wiretaps, they are entitled to do this. Otherwise, "Who's country is it?") 3. Wiretaps do not resemble ordinary searches, because the target is not informed, and he's not given a chance to challenge them. 4. Wiretaps have "never" been adequately challenged, precisely because the only outside people who know about them have no motivation to do them. (Primarily telephone companies.) I'd say the bulk of the evidence is that the legal system accepts wiretaps simply as a convenience, without genuinely believing that they are constitutional. > >[bernstein, etc] >>Since it has always been legal to use encryption (in the US), they're really >>not "challenging the cryptographic status quo." > >no, ITAR has been around a long time and they are challenging it. you're >mixing up the issue. No, YOU'RE mixing it up. _DOMESTIC_ wiretaps are being compared with DOMESTIC use of encryption. ITAR says nothing about wiretaps. The government is pushing Clipper et al based primarily on domestic wiretap issues. >>I don't know about you, but somehow I'm past the idea that it's possible to >>reliably get unbiased justice in court. Know what I mean? > >ah yes, we revert to the basic cypherpunk nihilist position oft repeated >by lucky green, tcmay etc-- "essentially, we're screwed" Not really. It's just that when there's enough evidence of dishonesty already in the treatment of this issue in the courts, there is no reason to presume that the right decision will be reached in the future. Jim Bell jimbell(a)pacifier.com

1 0

RE: DESCrack keyspace partitioning
by James A. Tunnicliffe 17 Dec '03

17 Dec '03

>geeman@best.com[SMTP:geeman@best.com] writes: >Another thinking step: most real-world DES keys are derived from hashes. >Not (P)RNGs. >The distributions are **not** uniform. Oh?? >I am talking about FAMILIES of predictable bit patterns in keys, not any >specific pattern. >I'm doing the stats. [...snip...] If you've discovered significant biases in MD5, or some other crypto-strength hash, that could be exploited to speed a keyspace search, that would be newsworthy indeed. I'm skeptical, but please share your results with us. [For context, Mike McNally wrote, in part] >[...] a good >32-bit CSPRNG has only a 1/2^32 chance of producing any particular >bit pattern. Of course, another way of saying that is that it's just >as likely to get an "obvious" bit pattern as it is to get any other >one. You can't just throw away part of the keyspace based on such >bogus reasoning. (There may be other reasons to throw away part of >the keyspace, of course.) Tunny ====================================================================== James A. Tunnicliffe | WWWeb: http://www.inference.com/~tunny Inference Corporation | PGP Fingerprint: CA 23 E2 F3 AC 2D 0C 77 tunny(a)Inference.com | 36 07 D9 33 3D 32 53 9C ======================================================================

1 0

ironic, no?
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

"Dr." Vulis - KOTM whines: >What is the crypto-relevance of the above-quoted passage? what is the irony-factor in the above statement?

1 0

Ignorance
by Santoyo, Felipe 17 Dec '03

17 Dec '03

The topics inwhich are discussed here are interesting to say the least, but I need to be brought up to speed. So if anyone could help with this or suggest so good sources of information on this subject I would more than appreciate it. Thanks! Feshnicad(a)petersenpub.com

1 0