December 2003 - cypherpunks-legacy

Remailer Keys, etc.
by Mike Ingle 17 Dec '03

17 Dec '03

"ub075(a)freenet.victoria.bc.ca" wrote: >First off, anyone notice how quiet it is in here without LD? >There used to be 30-40 messages a day, now I only see about 15 >(Or so.. no KF) Nice, isn't it. And the S/N ratio has been much higher. >Second, what size should a remailer key be? Is there really any >need for military grade encryption on a remailer that might have >3 or 4 nested messages, each encrypted? Depends on how fast the system running the remailer is. Key length has little effect on encryption time, but a major effect on decryption time. So if the machine is fast, use a 1024 bit key. If the machine is slow or heavily loaded, and there is nothing going through it that might interest a spook, use a 512 bit key. -- Mike (encrypt your hard drive, ask me how)

2 1

Worldwide Electronic Commerce Conference (fwd)
by Derek Atkins 17 Dec '03

17 Dec '03

I was asked to forward this here. Please do not send responses back to me, as I have nothing to so with this... -derek ------- Forwarded Message - -------------------------------------------------------------------- WORLDWIDE ELECTRONIC COMMERCE: Law, Policy and Controls Conference ****************Program Details**************** Dear Colleague: Our world is getting smaller. Electronic Data Interchange (EDI), Electronic Mail (E-Mail) and other computer-based technologies (that collectively support Electronic Commerce) are drawing individuals and organizations closer together. However, these exciting developments also present significant challenges. Corresponding audit, controls, legal, policy and security issues pose potentially serious barriers to the rapid adoption and extensive use of Electronic Commerce. Worldwide Electronic Commerce will address the implementation and control issues inherent in applying Electronic Commerce to today's environment. The answers provided at this conference will address current problems as well as provide a foundation for dealing with these complex issues in the future. We have been fortunate to have secured an unusually qualified and internationally recognized faculty to share their experience, knowledge and theories on the wide range of issues identified in this brochure. We are equally pleased to have obtained a distinguished group of organizations who, in affiliation with this conference, are lending their considerable support. Please join us at this unique and ground breaking event which will be held on January 16-18, 1994 in New York City at the Waldorf-Astoria Hotel. Michael S. Baum, Esq., Conference Chair M. Todd Ostrander, Conference Co-Chair WORLDWIDE ELECTRONIC COMMERCE CONFERENCE PUT ON IN AFFILIATION WITH: - -------------------------------------- American Bar Association, Section of Science & Technology Centre for Commercial Law Studies, University of London Computer Law Association EDI Association of the United Kingdom EDP Auditors Association Harvard Law School John F. Kennedy School of Government, Harvard University National Institute of Standards and Technology U.S. Council for International Business Data Interchange Standards Association Healthcare EDI Corporation International Union of Latin Notaries CONFERENCE AT A GLANCE - ---------------------- SUNDAY, JANUARY 16TH - Registration 17:00 - 20:00 - ------------------------------------------------- PRE-CONFERENCE TUTORIALS: 18:00 - 19:30 * Electronic Trade Overview for Beginners * Security and Audit Overview * A General Counsel's Perspective on Electronic Trade * Electronic Commerce Policy and Regulation 101 MONDAY, JANUARY 17TH - Registration 7:00 - 18:00 - ------------------------------------------------ OPENING PLENARY: 8:00 - 8:50 SESSION 1: 9:00 - 10:20 * Will Legislation Keep Up with Electronic Trade? * Anatomy of a Model EDI Audit Program * Will Privacy Requirements Inhibit Electronic Commerce? * Clearing Houses and Electronic Commerce SESSION 2: 10:30 - 11:50 * U.S. Efforts in Coordinating Electronic Commerce Standards Policy * How to Audit a Third Party/Value Added Network * What is Cost Effective Commercially Reasonable Security? * Anticompetitive Restraints on Trade in Electronic Commerce LUNCH 12:00 - 13:30 SESSION 3: 13:30 - 14:50 * Trading Partner and Business Agreements in Electronic Commerce * Electronic Negotiability - What Scares the EDI Users Away? * INFOSEC Standards Coordination and Interworking * Time/Date Stamping - Options and Constraints SESSION 4: 15:00 - 16:20 * United Nations Electronic Commerce Initiatives * Directory control Issues in Electronic Messaging and EDI * Comparing Critical Cryptographic Algorithms and Standards * Financial Clearing Houses - a Foundation for EDI? SESSION 5: 16:30 - 17:50 * Model Electronic Payments Agreements * What to Save, When to Save It, and For How Long * Do "Smart Cards" Provide an "Ultimate" Control Solution? * The "FAST" Initiative - Business Trust in the Computer Era? TUESDAY, JANUARY 18TH - Registration 7:00 - 12:00 - ------------------------------------------------- SESSION 6: 8:00 - 9:20 * Negotiating Electronic Trade Agreements * Back-Up, Archival and Contingency Planning Services * Security Policy in a Global Information Environment * Electronic Software Distribution (ESD) - a Pandora's Box? SESSION 7: 9:30 - 10:50 * Value Added Networks and Interconnect Agreements * Do Criminal Laws Really Protect Electronic Commerce? * Digital and Electronic Signatures and the Law * Accreditation and Certification - the New Frontier? SESSION 8: 11:00 - 12:50 * The ICC Electronic Commerce Initiatives * Admitting, Proving and Enforcing EDI Transactions * Re-engineering the Tax Filing Process * EDI Insurance - the Next Control Approach? LUNCH: 12:00 - 13:30 SESSION 9: 14:00 - 15:20 * Central and Eastern European Electronic Trade * The Role and Future of Notaries in Computer-Based Commerce * Will Healthcare Reform Profoundly Reshape EDI Law, Policy, and Controls? * The Uses of Escrow in Electronic Commerce SESSION 10: 15:30 - 16:50 * Who Owns the Standards, Functionality and Systems? * Risk Analysis in Electronic Trade * Judicial EDI * EDI Translation Software Control and Legal Considerations CONFERENCE PROGRAMMING COMMITTEE: - --------------------------------- Robert Barger, Esq., Section of Science and Technology, American Bar Association Michael S. Baum, Esq., Independent Monitoring, Conference Chair Susan Caldwell, Executive Director, EDP Auditors Association Rachel Foerster and Garren Hagemeier, Healthcare EDI Corporation Mark L. Gordon, Esq., Computer Law Association Jerry Mechling, Ph.D. and Tom Fletcher,Ph.D., Kennedy School of Government, Harvard University Mario Miccoli, Natariat, Unione Internazionale Del Notariato Latino Professor Charles R. Nesson, Harvard Law School M. Todd Ostrander, EDI Program Manager, Egghead Software, Conference Co-Chair Chris Reed, Esq. and Ian Walden, Ph.D., Centre for Commercial Law Studies, University of London Peter Robinson and Bruce Wilson, U.S. Council for International Business Roy Saltman, National Institute of Standards and Technology In Memory of the Late Professor Donald Trautman, Harvard Law School SUNDAY, JANUARY 16TH: PRE-CONFERENCE TUTORIAL EVENING SESSIONS - ---------------------------------------- The following tutorials provide newcomers to electronic trade with an overview of the concepts, technologies, and business practices that will make the conference more meaningful. These pre-conference sessions are scheduled from 18:00 - 19:30, January 16th, so that they will not interfere with the regular conference sessions. ELECTRONIC TRADE OVERVIEW FOR BEGINNERS An overview of "Electronic Trade" and how it applies to the business environment of the '90's & the 21st century. You will learn about the history and state of electronic commerce, including EDI, E-Mail, and other enabling computer-based trade technologies and the components necessary to implement these technologies successfully in your industry. Additionally, this session will provide an overview of electronic commerce-relevant aspects of the American National Standards Institute (ANSI), United Nations/EDI for Administration, Commerce and Trade (UN/EDIFACT) and International Standards Organization (ISO) standards development processes, how they affect you, and important differences that multi-national companies will likely encounter while implementing them. SECURITY AND AUDIT OVERVIEW The basic control structures and security guidelines for an electronic trade program including cryptographic and non-cryptographic controls will be discussed in this tutorial session. This session also provides the 'non- auditor' with a description of the unique characteristics of auditing in an electronic trade environment and an understanding of how auditors must contribute to the electronic commerce environment. A GENERAL COUNSEL'S PERSPECTIVE ON ELECTRONIC TRADE Corporate counsel are increasingly called upon to respond quickly and effectively to the demands of accelerating electronic trade implementation programs. Veteran corporate counsel will summarize the critical responsive actions they have taken, and provide perspectives on how they navigated and climbed the electronic commerce learning curve. This session will provide the electronic commerce neophyte general counsel with helpful hints for making the most of the conference. ELECTRONIC COMMERCE POLICY AND REGULATION 101 The policy and regulatory issues affecting electronic commerce continue to grow without an end in sight. As a primer for an enriching Worldwide Electronic Commerce conference, this session identifies and explains the critical policy and regulatory building blocks (and road blocks) that electronic commerce professionals simply cannot avoid. It also surveys the "tools" that are used in policy development and implementation. This session provides a useful foundation for many of the policy-oriented sessions. MONDAY, JANUARY 17TH MORNING SESSIONS - ------------------------------------- SESSION 1: 9:00 - 10:20 - ----------------------- 1. WILL LEGISLATION KEEP UP WITH ELECTRONIC TRADE? Viewpoints of law reform experts on the development of diverse topics of possible legislation affecting electronic commerce will be presented. Current and proposed legislation from around the globe will be presented and considered for its practicality and likelihood of impacting electronic commerce. 2. ANATOMY OF A MODEL EDI AUDIT PROGRAM More and more organizations are designing and implementing enterprise-wide EDI and electronic commerce systems. Audit standards, guidelines and practices are in the process of responding to the need for EDP and MIS systems auditors to have a detailed understanding of the requirements for auditing EDI systems. This session will outline the EDI systems audit requirements and provide an overview of the ASC X12 Model Audit Program currently under development. Experienced auditors will walk you through the results of their years of experimentation and implementation and explain an effective and practical audit program that you can implement. 3. WILL PRIVACY REQUIREMENTS INHIBIT ELECTRONIC COMMERCE? How does personal data communicated among trading partners and/or the government, particularly in open systems environments, create barriers to business transactions? Data protection is a frontier for electronic commerce. This session will distinguish privacy and confidentiality and discuss methods to protect companies from the risks associated with the improper disclosure of telecommunicated personal data. It will also consider the economic, privacy or national security requirements and restrictions imposed by governments, and their impact on electronic commerce. Various laws and directives, including the EC's proposed directive concerning the protection of individuals in relation to the processing of personal data will be identified and considered in conjunction with charting a viable approach for implementation. 4. CLEARING HOUSES AND ELECTRONIC COMMERCE Clearing houses provide administrative, legal and technical infrastructure which support various computer- based commercial trading services to bolster the reliability and enforceability of electronic transaction records, reduce legal uncertainty, and generally facili- tate electronic trade. The scope of implemented clearing house services depends upon available technology, legal and security requirements, potential liability, the availability of insurance, and, of course, business needs and costs. Clearing house services also extend well beyond "traditional" clearing house functions to provide broad-based support as a trusted entity. This session will detail how clearing houses affect electronic commerce controls and security. SESSION 2: 10:30 - 11:50 - ------------------------ 1. US EFFORTS IN COORDINATING ELECTRONIC COMMERCE STANDARDS POLICY U.S. public and private sector planning for global electronic commerce requires coordination of the various standards supporting electronic commerce, and developing and presenting comprehensive U.S. positions in the various international standards setting fora. This panel will present proposals for improving such coordination and charting a path forward, and provide an expert's view on the future. The session will also address the relevant implications of the recently released report of the National Performance Review and endorse initiatives that will potentially catalyze national and international electronic commerce reform for years to come. Will these initiatives be successful and how will they impact business? 2. HOW TO AUDIT A THIRD PARTY/VALUE ADDED NETWORK This session addresses the 'how to' of conducting audits of third party service providers including third party claims clearing houses. What is needed to obtain clearance to conduct an audit? What questions are appropriate during the audit? Who should participate in such an audit? The impact of diverse relevant auditing standards and guidelines, including those of the IIA, the AICPA's SAS 70 and other relevant materials will be discussed. 3. WHAT IS COST EFFECTIVE COMMERCIALLY REASONABLE SECURITY? How much security is required in an electronic trade relationship? What is commercially acceptable and must commercially reasonable security be cost effective security? Experts will provide useful guidance on this very difficult issue. 4. ANTICOMPETITIVE RESTRAINTS ON TRADE IN ELECTRONIC COMMERCE This session will identify and provide approaches concerning three important and frequently asked questions: Can we force our trading partners to trade electronically, or can we be forced to do so? Can we be forced to use particular VANs, or one of a limited number of specified VANs? Can we charge (or be charged) a premium for failing to trade electronically? Antitrust counsel and electronic trade professionals will provide their perspectives. MONDAY, JANUARY 17TH AFTERNOON SESSIONS - --------------------------------------- SESSION 3: 13:30 - 14:50 - ------------------------ 1. TRADING PARTNER AND BUSINESS AGREEMENTS IN ELECTRONIC COMMERCE This session will present case studies that illustrate how trading partner agreements (agreements among parties to electronic trade transactions) have been implemented by industry and government to facilitate electronic trade. Agreements that accommodate sales, services and other types of electronic commerce will be treated. The session will consider approaches to modifying model agreements, accommodating scaling and automating computer-based contracting mechanisms. Various model agreements, including the soon-to-be released European/TEDIS agreement will be addressed. 2. ELECTRONIC NEGOTIABILITY - WHAT SCARES THE EDI USERS AWAY? Few EDI issues cause such angst in the EDI community as the issue of negotiability under EDI - whether it is for securities, bills of lading, letters of credit, or any other device that depends upon paper to transfer things of value. Is it the horrendous legal pitfalls that EDI negotiability presents as some would claim? Or is it that last vestige of paper that we all are reluctant to let go of, that causes us to hesitate before committing ourselves to an all EDI world of commerce? The history of and current efforts to develop electronic mechanisms in substitution for paper-based documents of title will be examined during this session. The panel will address the major initiatives intended to substitute or accommodate negotiable and nonnegotiable documents of title in electronic form, and will explore possible solutions. 3. INFOSEC STANDARDS - POLICY, COORDINATION AND INTERWORKING This panel will deal with current and future policy on information security standardization at the international, regional and national levels, in particular, with regard to information security standards as they apply to electronic trade and commerce. It will also share thoughts and perspectives concerning future standards direction, work programs, interworking, and coordination. 4. TIME/DATE STAMPING - OPTIONS AND CONSTRAINTS Time and date stamping of computer-based transactions is increasingly recognized as being critical to nonrepudiation, effective public key certificate and certificate revocation management, and EDI in general. This session will survey the technology, implementations and legal requirements for time and date stamping and consider the extent to which trusted entities are needed to implement time and date stamping procedures and devices, as well as the implications of electronic rather than human time stamping. SESSION 4: 15:00 - 16:20 - ------------------------ 1. UNITED NATIONS ELECTRONIC COMMERCE INITIATIVES This session surveys and opines on some of the UN's legal initiatives in support of electronic commerce. UN representatives to both predecessor and current activities will share their viewpoints on legal developments, relationships to other international organizations and will describe their visions for the future. 2. DIRECTORY CONTROL ISSUES IN ELECTRONIC MESSAGING AND EDI This session presents an overview of the audit and security capabilities and legal implications of international messaging and directory standards and recommendations, including X.400, X.435, and X.500. Industry experts will describe how they have implemented these standards and addressed the security issues surrounding their use. Directory-based trading partner information, including security credentials, is increasingly indispensable for electronic commerce. However, privacy, ownership, use, revenue and accuracy of directory information remain compelling challenges. The session will also examine directory models, explore the critical issues and present a path forward. 3. COMPARING CRITICAL CRYPTOGRAPHIC ALGORITHMS AND STANDARDS How do I know you are who you say you are? Inventors, visionaries and pioneer algorithm standards developers will discuss how cryptographic techniques have been developed and standardized to address the authentication of business documents. The practical application of such technologies and their integration into small, medium and large business systems will provide an indispensable road map for improved business processes and reduced legal and control risks. 4. FINANCIAL CLEARING HOUSE RULES - A FOUNDATION FOR EDI? Major funds transfer clearing houses (such as the ACH, CHIPS, Fedwire) have developed highly sophisticated rules that address the apportionment of liability among users, financial institutions and the clearing house. As clearing houses and other trusted third parties provide various assurances to the trading public, these clearing house rules and procedures deserve close attention. A panel of the counsel and commentators to the major funds transfer clearing houses will share their collective experience with a view towards the development of generalized electronic commerce clearing houses and electronic security credentialing authorities. SESSION 5: 16:30 - 17:50 - ------------------------ 1. MODEL ELECTRONIC PAYMENTS AGREEMENTS Financial EDI is increasingly a growing and indispensable aspect of electronic commerce. However, it also presents additional challenges beyond those covered by standard EDI trading partner agreements and practices. This session outlines the legal treatment of financial EDI, its relationship to EFT and funds transfer mechanisms, and the responsive model financial EDI agreements, guidelines and critical law reform initiatives. 2. WHAT TO SAVE, WHEN TO SAVE IT, AND FOR HOW LONG How long should transactions be saved? Are electronic documents subject to different retention rules? International trade rules are in play respecting retention matters. In the U.S., the Internal Revenue Service published Revenue Procedure 91-59 to address the electronic retention period and audit procedures for the electronic trade environment. To what extent does this Revenue Procedure as well as other national and international procedures provide useful models for international harmonization? This session will address the pros and cons of using such procedures to change company internal records retention policies. 3. DO "SMART CARDS" PROVIDE AN "ULTIMATE" CONTROL SOLUTION? The need for, and use of, card technologies, including magnetic stripe, smart cards, and PCMCIA, presents new options and challenges for the audit, legal and security communities. The policy issues associated with card technologies have already surfaced within the electronic benefit transfer, healthcare informatics, financial services and many other environments. The panel will identify the various card technologies and explore the relevant issues, including those concerning ownership of data on the card, impact on satisfaction of signature requirements and cost justification. 4. THE "FAST" INITIATIVE - BUSINESS TRUST IN THE COMPUTER ERA? The International Bureau of Chambers of Commerce (IBCC) - world forum of Chambers of Commerce (of the International Chamber of Commerce (ICC)), is setting up an international "registration" and "certification" chain within EDI. Coordinated by the Belgian Federation of Chambers of Commerce and Industry, the backbone of the Certified Electronic Data Interchange For Administration, Commerce and Transport (CEDI- FACT) concept included in "FAST" (First Attempt to Security Electronic Commerce), a trans-European and trans-sectoral pilot project that will soon commence under the auspices of the TEDIS program of the Commission of the European Communities. TUESDAY, JANUARY 18TH - MORNING SESSIONS - ---------------------------------------- SESSION 6: 8:00 - 9:20 - ---------------------- 1. NEGOTIATING ELECTRONIC TRADE AGREEMENTS A common stumbling block in implementing electronic trade is the length of time it takes for companies to negotiate electronic trade agreements. In this session you will witness a simulated negotiation session between two trading partners and their counsel. The dialogue will communicate the benefits and costs of using standard agreements that are recognized by the majority of industries, as well as the benefits and cost of not using a trading partner agreement. 2. BACK-UP, ARCHIVAL AND CONTINGENCY PLANNING SERVICES IN ELECTRONIC COMMERCE ACCELERATED TRANSACTION PROCESSING OR J.I.T. ENVIRONMENT Increasingly, the failure to contract for contingency services may create significant exposure, perhaps extending to consequential damages. Moreover, the impact of expedited electronic transactions such as just- in-time and quick response demand further consideration of contingency services. This session debates an appropriate definition of "due diligence" in electronic commerce; the issues addressed in most commercial contingency services agreements, and concludes with predictions on future issues by a panel of recognized experts. 3. SECURITY POLICY IN A GLOBAL INFORMATION ENVIRONMENT This session provides an opportunity to hear two of the key security policy makers from the Commission of the European Communities and the United States, respectively. The speakers will address critical developing information security policy issues of far reaching consequence, including whether public key infrastructure can or should be implemented for both authentication and confidentiality services or instead for authentication only; the scope and impact of pilot projects on cryptographic and secured open systems policy development; the impact of patents on the development of ubiquitous secure infrastructure; and cooperative approaches to a global path forward that will minimize national and regional fragmentation. 4. ELECTRONIC SOFTWARE DISTRIBUTION (ESD) - A PANDORA'S BOX? As in every industry, there are commercial conduct rules that apply to the software industry. As new methods of distribution are introduced (discussed) in order to make it easier for customers of software developers to obtain and manage software assets within a corporation, domestic and global legal implications are raised. This session will discuss issues surrounding ESD and the proposals to remedy them. Additionally, critical new technologies and actual implementations will be identified and demonstrated, with a view towards their security and control capabilities. SESSION 7: 9:30 - 10:50 - ----------------------- 1. VALUE ADDED NETWORK AND INTERCONNECT AGREEMENTS - WHO IS LIABLE AND FOR WHAT? Third Party Service Providers ("TPSPs") including Value Added Networks ("VANs") and service bureaus have been quite successful in limiting their liability. This session examines the history, present status and future liability of VANS and other TPSPs. The extent to which VANs can or should be trusted to assure the confidentiality of user data will be addressed. The panel will provide practical legal and technical advice at grappling with these trends. The panel, which includes general counsel to VANs, will address these issues, including the enforceability of liability caps, the enforceability of trading partner terms within their "system agreements", VAN interconnects and special considerations for consumer-users. 2. CRIMINAL LAWS REALLY PROTECT ELECTRONIC COMMERCE? Liability for computer-based criminal acts is a developing area of the law and therefore, the extent and adequacy of current law remains uncertain. This session will identify the critical elements of criminal law relevant to electronic commerce and describe its inadequacies. Proposals will be presented for legislative reform. International prosecution of computer-based crime will also be considered. 3. DIGITAL AND ELECTRONIC SIGNATURES AND THE LAW Historically, the written signature has been an important (and in many cases an indispensable) aspect of commercial trade. This session will compare conventional, electronic and digital signature requirements and techniques, and explain how they are (or should be) treated in the law. The most authoritative private and administrative, legislative, judicial and audit-related decisions, rulings and pronouncements affecting digital signatures will be presented, and their future impact explained. You will learn about new methods for "tying" digital and electronic signatures to pre- established expectations and purposes. The speakers will also discuss the format and intent of relevant computer based "signature" standards and how they can be implemented in your company/industry. 4. ACCREDITATION AND CERTIFICATION - THE NEW FRONTIER? Because deserved confidence and trust in electronic credentials and the infrastructure that issues such credentials is of vital importance, mechanisms to assure its accountability, consistency and quality are indispensable. Certification and accreditation provide a process of approval or recognition by a trusted body representing that the subject of such certification and accreditation has satisfied recognized criteria, typically concerning quality, performance, ethics, experience, safety, education or competence. This session considers the legal, policy and organizational issues associated with accreditation and certification and its relevance to the satisfaction of obligations to implement "commercially reasonable security." SESSION 8: 11:00 - 12:20 - ------------------------ 1. THE INTERNATIONAL CHAMBER OF COMMERCE ELECTRONIC COMMERCE INITIATIVES The ICC and its national affiliates (such as the U.S. Council for International Business) have played a continuing role in the development of electronic commerce rules and practices, beginning with the seminal publication of the "UNCID" rules, and subsequently with initiatives for "EDI-TERMS", "EDI- ready" INCOTERMS, and other projects. This session will identify relevant ICC electronic commerce initiatives, describe the ICC's future role, including with regard to other international organizations, and consider the ICC's and USCIB's work in addressing other information policy and security issues confronting the global business community. 2. ADMITTING, PROVING, AND ENFORCING EDI TRANSACTIONS This session will focus on the evidentiary requirements for electronic trade records and will contrast requirements for records in paper and electronic form. Diverse interpretations of foundation requirements of the Federal Rules of Evidence, key regulatory requirements, and related issues, including a status report on efforts to reform the Federal Rules of Evidence that are relevant to computer-based practices will be presented. 3. RE-ENGINEERING THE TAX FILING PROCESSES Tax authorities will explain how they are dealing with the electronic trade environment; and the policy, legal and security issues involved in electronically interfacing with national Governments. The implications of these activities on electronic commerce generally will be the focal point for this session. Additionally, it will consider intergovernmental relationships concerning authority to operate as a VAN or service bureau for the other, including the TaxNet Government Communications Corporation (TGCC) initiatives. 4. EDI INSURANCE - THE NEXT CONTROL APPROACH? This panel will discuss the issues and opportunities associated with offering and underwriting electronic information-related risks.. This session surveys important insurance issues that are either directly applicable to electronic commerce and cryptography, or that indirectly provide useful structures which can benefit the thoughtful consideration of competing approaches to such infrastructure. The discussion considers insurance issues in EDI, EFT, VANS, and certification authorities. To the extent insurance exists, the panelists will discuss general restrictions and what electronic information users and vendors can do to standardize and structure their systems to assist the insurance industry with broadening the scope of coverages. TUESDAY, JANUARY 18TH - AFTERNOON SESSIONS - ------------------------------------------ SESSION 9: 14:00 - 15:20 - ------------------------ 1. CENTRAL AND EASTERN EUROPEAN ELECTRONIC TRADE - LEGAL STATUS AND FUTURE OPTIONS This session will discuss the present position of several normative acts and legislative proposals in the Central and East European countries that are of importance for the development and use of EDI including: the status of electronic evidence, the possibilities for electronic contracting, and the legal requirements of "writing" and "signature". The case for new legislation in Central and Eastern Europe, assimilating the consequences of the development and use of computer applications on the traditional legal system, as well as the recent proposal for a new Civil Code of the Russian Federation that contains a specific regulation on an electronic version of negotiable documents, will be discussed. 2. THE ROLE AND FUTURE OF NOTARIES IN COMPUTER-BASED COMMERCE This session defines and explains conventional notary laws and practice in both common law and civil law countries; and considers the business and legal need for notarial reform to accommodate electronic transactions. It will also examine the use and sufficiency of forms of identification as a prerequisite to the issuance of electronic credentials. Furthermore, the session will provide perspectives on notarial reform, including whether current notarial practice can accommodate electronic commerce, or whether there is a need for an "electronic notary," a "super notary" or other such "trusted entities." A panel of distinguished notaires from around the world will consider whether a Latin-style notary can or should be introduced in non-civil law countries and will forecast the future for notaries in a computer-based world. 3. WILL HEALTHCARE REFORM PROFOUNDLY RESHAPE EDI LAW, POLICY AND CONTROLS? Privacy and security issues surrounding the use of EDI are advancing to the top of the priorities in the health- care field. Healthcare costs are a prime concern of governments and individuals. However, with the rapid growth of health care information networks and regional or community healthcare networks, the capture, storage and retrieval of health care data is essential to the quality of the health care delivered. Data ownership and access rights are unresolved, as well as the apportionment of liability for erroneous or improperly disclosed data. Moreover, the lack of a national (U.S.) personal ID/national identifier presents privacy and security challenges for healthcare and electronic commerce generally. These issues, with a focus on confidentiality and privacy issues will be discussed in depth by leading experts in health care law and EDI. 4. THE USES OF ESCROW IN ELECTRONIC COMMERCE The scope of escrow agents is much broader in electronic commerce than in the computer software industry. Escrow agents are increasingly being used to hold cryptographic keys associated with the privacy or authenticity of business transactions. This session will explain the world of escrow and how it can improve electronic commerce. The escrow implications of the Clinton Administration's "Clipper Capstone" proposal will also be addressed. Copies of escrow agreements will be distributed and discussed. SESSION 10: 15:20 - 16:50 - ------------------------- 1. WHO OWNS THE STANDARDS, FUNCTIONALITY AND SYSTEMS? CHARTING A COURSE THROUGH COPYRIGHT ISSUES IN EDI This session evaluates the ownership, use, repudiation, licensing, and transfer of rights associated with the development and use of electronic trade standards in both paper and electronic form, nationally and internationally. Representatives from major standards making entities as well as "vocal" users of the standards will present the issues and a road map to the future. The extent to which companies can obtain or enforce proprietary rights in screen displays, data formats and similar working aspects of an EDI system will be considered. 2. RISK ANALYSIS IN ELECTRONIC TRADE Prior to decision making, an evaluation process occurs that determines the advantages and disadvantages of an investment decision. A piece of this process is sometimes known as "Risk Analysis." This session will review the process steps necessary to conduct an effective risk analysis for electronic trade and investments. The panel will explain the critical limitations of this process and how it is evolving to meet the needs of important applications. 3. JUDICIAL ELECTRONIC DATA INTERCHANGE ("JEDI") The current events, issues and projects associated with the development of EDI within the Judiciary will be discussed. The panelists will also review the procedural and evidentiary rules affecting JEDI, bankruptcy court JEDI, integration of JEDI with law office and judicial automation of justice in the future. The most noteworthy JEDI implementations throughout the world, as well as JEDI X12 transaction sets and UN/EDIFACT messages will be surveyed. 4. EDI TRANSLATION SOFTWARE CONTROL AND LEGAL CONSIDERATIONS As the heart of an EDI implementation, the adequacy of EDI translation software is increasingly important to the legal and control communities. This session will explain the important audit and security control features of EDI translation software and address concerns, pitfalls and remedial actions available to the purchaser of such software. REGISTRATION INFORMATION - ------------------------ HOTEL & AIRLINE INFORMATION - --------------------------- American Airlines is offering discounted air fares for the Worldwide Electronic Commerce Conference. Arrangements may be made by calling American Airlines at 1-800-433-1790 and referencing "Star" Code S1814P7. Continental Airlines is also providing discounted air travel for the Worldwide Electronic Commerce Conference. To make reservations, call 1-800-468-7022. Please reference Identification Code ZAB58. International travelers: please contact your local Continental phone number for specially discounted fares. For this conference, Continental Airlines has waived the need to stay over a Saturday night to obtain the lowest possible fare. The beautiful Waldorf-Astoria Hotel in the heart of New York City will be the sight of the Worldwide Electronic Commerce Conference. This prestigious internationally- acclaimed hotel provides the finest in accommodations and is offering a special room rate of $159 to all conference attendees. Reservations can be made by calling 1-212-355-3000. CONFERENCE HIGHLIGHTS - --------------------- INTERNATIONAL SCOPE: Most conference sessions will include one or more persons from a country other than the United States, or one or more representatives from international organizations, to provide a diversity of perspectives and experiences. CONFERENCE PROCEEDINGS: Conference papers of all sessions will be bound and distributed to all participants. GROUP & STUDENT DISCOUNTS: Discounted registration fees will be offered to companies sending 3 or more individuals and to qualifying students. Call: 1- 214-516-4900 for more information. CONTINUING LEGAL EDUCATION: For information concerning C.L.E. points, call 1-214-516-4900. HOW TO REGISTER - --------------- REGISTRATION FEE: $550 total conference registration fee. BY MAIL: Completed forms must be accompanied by a money order, check, or credit card number (American Express, MasterCard, or Visa). All checks should be made payable to Worldwide Electronic Commerce Conference, P.O. Box 743485, Dallas, Texas 75374, USA. BY FAX: Completed forms, when paying be credit card, may be faxed to 1-214-424-0562. BY PHONE: Call 1-214-516-4900 for payment by credit card or questions about the conference. BY E-MAIL: Worldwide Electronic Commerce can also be reached on Compuserve at 76520,3713. REGISTRATION FORM: - ------------------ To register, please print out a copy of the form below, complete it by typing or printing the registration information and return one completed form with payment for each registration. Mail to P.O. Box 743485, Dallas, TX 75374, USA or Fax to: 1-214-424-0562. _____ I am registering for the Worldwide Electronic Commerce Conference (Total: $550) _____ I plan on attending one of the Pre-Conference Tutorial Sessions. (Select one below): _____ Electronic Trade Overview _____ Security & Audit Overview _____ General Counsel's Perspective _____ Electronic Commerce Policy A check is enclosed for $___________ -OR- Please bill my:___VISA ___MasterCard ___American Express Card No.______________________ Exp. Date_________________ Name on Card_____________________________________________ Signature________________________________________________ Registrant's Name________________________________________ Title____________________________________________________ Preferred First Name for Badge___________________________ Company / Organization___________________________________ MS / Dept._______________________________________________ Address__________________________________________________ City________________________ State______ Zip_____________ Telephone________________________ Fax____________________ Do You Require Special Handicapped Access? ____Yes ____No Will you be staying at the Waldorf? ____Yes ____No Final agenda subject to change, especially as the program expands and additional speakers are added. CANCELLATIONS must be received in writing and postmarked no later than December 22, 1993 to receive a 50% refund of the paid registration. No refunds will be issued after December 22, 1993, regardless of when the registration is received. NO SHOWS are liable for the entire conference fee. SPECIAL ARRANGEMENTS for the handicapped will be made if requested in advance. To make a request, contact the "Conference Coordinator" at 1-214-516-4900. ------- End of Forwarded Message

1 0

A New Enemy
by L. Detweiler 17 Dec '03

17 Dec '03

Hello, I just thought I would show one of my most hostile hate mail messages I have seen so far, from someone I didn't even know was my enemy. This was really painful. This was posted to the public cypherpunks list in Colorado moderated and founded by N.Sammons. I have met members at the first meeting and the more recent PRZ lecture. I have found I don't even have any friends in the Colorado group either, despite my belief up to this point to the contrary. I was thrown off the list without my knowledge, supposedly because someone asked. I swear, I had not written a single annoying thing on that list in my LIFE and hadn't posted for MONTHS and I was censored. This is really getting ugly, getting out of control. Whatever happened to, `its just ASCII text'? Look everyone, I apologized to every cypherpunk in the world in my posting, Embarrassment, Humiliation, Shame, and an Apology, for my past actions on this list. Please reread this to see that I was sincere. These further efforts just amount to beating a man when he is down. This stuff is getting extremely vicious. I took a vacation and have really mellowed out, I assure you. Have you seen any disruptive postings by me here at all? I have stopped! I'm just out in the newsgroups, nothing else. Not even touching your list. Do you begrudge me even that? Please do not send me such painfully excruciating searing spiteful mail. I really do have feelings. I am just another human being. By the way, I will let you in on a secret. I admit that I was really out of control a few weeks ago. But you know what? Here is my dirty little secret. The only reason that I was able to harass you guys so much was that you reacted to it. If you trully followed your own philosophies, such as taking all text impartially (`there is only a message') I would have gone away a long time ago. The amazing secret: if something *really* offends you, the most devastating response is to IGNORE IT. That bastard S.Boxx seems to understand this. He is *driven* by responses to flamebait, clearly. Ignore him and he will go away. I ask that everyone distinguish between me and S.Boxx. He is the one causing all the trouble now, and I have nothing to do with it. Forward him all your vicious hate mail comparing him to Stalin. If you continue to attack me for something from every lame anonymous address in the world, perhaps you will successfully drive me to the madness you claim I am in! As far as this person's threats, I would advise the author that the postmaster bit hasn't worked so far. Please do not bother my postmaster. There is no need. I HAVE STOPPED, DAMNIT! The author does say he has extensive L.D. archives. Mine are in disarray. If anyone wants any of my past rants to try to blacken me further, contact him for the exact one. p.s. edited to preserve anonymity. ===cut=here=== From: W.B. Subject: Re: N.S. is a Liar To: "L. Detweiler" <ld231782(a)longs.lance.colostate.edu> cc: colorado_cypherpunks(a)VIS.ColoState.EDU Dear Detweiler, Now you have seriously pissed ME off. Not being content with disrupting the content of the CA cypherpunks list, you are now attacking Mr. S. And wasting my time on this list. > Mr. S., either someone asked you or they did not. You will tell me > if someone asked you or not. You will tell the truth. If you do not, I > will go to every single person on this list and ask them if they asked > you to take me off the list. Detweiler, If I DIDN'T ask N. to take you off the list, then I was seriously remiss. I hereby pubicly ask Nate to remove you and all your tentacles from the list. Further, I want a anti Detweiler filter on postings. > You continue to evade on this point. I will not allow it. You won't WHAT ? Listen, asshole this little repartee is gonna get *REAL* nasty if you don't shut the fuck up and crawl back into your diseased little hole. Just for the record, Just WHO do you think you are anyway ? Jesus ? Stalin ? Some poor villified martyr who is being tortured for his attempts at telling the truth ? > Call me Hitler if you like Oh, You think you are Hitler. Naw, Hitler was dangerous, you are simply annoying. > N.S. > >There is nothing that I sent to you that I will give a flying fuck about being > >posted to this list (althought the other on the list may want to get some > >work done, and may not give a shit about you). I might need to talk to > >Dempsey about you lance account if you do this, though. > > Interesting threat. For everyone who may not know, Mr. D. is an > administrator here in the Engineering dept., distinct from Mr. > S.'s dept. And Mr. S. has now stooped to the wretched level > of the legendary D.Barnes. Mr. S., would you like the phone number > of my girlfriend? Perhaps you can get her to get me to stop harassing you. THANK YOU FOR THE NAME THAT I NEED TO CALL TO GET YOUR INTERNET ACCOUNT YANKED ! > > CO cypherpunks, I am deeply disappointed in this sordid display of > depravity. I was sincerely interested in staying in this group and > making contributions. In fact, I had a topic that was perfect for the > list I was about to talk about. Sure you do. I'll just bet you did. Gee i really feel a keen loss. > CO Cypherpunks, please send me mail, > all of you. OK, here you go. > Tell me whether you sent N.Sammons a letter to kick me off > the list. Tell me if you received a letter from him that he had kicked > me off. Tell me if you hate my guts and would like to see me bleed a > slow death. Tell me what the @#$%^&* is going on the list, because I am > obviously no longer on it. Tell me if you don't ever want to see me at > a meeting again. Tell me I am worthless human scum. I promise to go > away if you do so. > OK, you are a worthless human scum. Once i thought that you were at least human and worth hearing out. Now I know better. Go away. Far far away. Before you cry censorship, folks, try on this scenario. Two or more adults are carrying on a conversation on a topic of their choosing. A small child starts interrupting the adults conversation. continually, incessantly. The adults ignore it. The child increases it's efforts, and throws a tantrum. The adults ignore it. Finally the child craps on one of the adults shoes. The adult picks the kid up, spanks it, and sends it off to bed. It ain't censorship, people. This loon hasn't made a significant contribution to the cypherpunks since the FAQ way back when. You seem to like ultimatums, Detweiler, try this one on for size. Either you stop posting on this list immediately, AND the CA cypherpunks list Immediately, or I call Mr Dempsey. And email him a list (about 300K) of ALL your postings. I have been saving them. And go ahead and show anyone you want the private email I sent to you. MAKE sure the signature matches the text, folks. Detweiler, go ahead and call me a tentacle. say anything your slimy and demented litle heart desires. But do not even think about threatening me. I PUSH BACK. Feel Lucky, Detweiler ?

3 2

Regarding "Free Willy"
by Michael E. Marotta 17 Dec '03

17 Dec '03

I'm sorry to have to confess this, but I don't understand how I as a mere user receiving mail am supposed to know that the Free Willy message did not come from the President. Here is what I got: ----------------------------------------------------------------- Message 5/12 From President(a)whitehouse.gov Dec 19 '93 at 2:13 pm pst Return-Path: <heifetz!toad.com!owner-cypherpunks> Return-Path: <President(a)whitehouse.gov> Date: Sun, 19 Dec 93 14:13:02 PST I Love encryption. I Love PGP. I Love PseudoSpoofing. Please send me lots of mail about my Health Care Plan. And always remember... Free Willy! --Slick ----------------------------------------------------------------- Looks good to me. But, ferguson says he knows better > Return-Path: <President(a)whitehouse.gov> > Received: from [144.92.136.35] by toad.com id AA13485; > Sun, 19 Dec 93 14:16:03 PST > Which ferguson shows as TELGATE.ADP.WISC.EDU 144.92.104.20 To me, 144.92 could be wisc.edu or telgate.adp but in any event, I didn't see this at all and would have ignored it if I had. Messages get routed all over the place. You call Detroit from Lansing and it goes via Chicago. 144.92 proves nothing. Then charliemerritt offers another solution. > Return-path: President(a)whitehouse.gov > Received: from delphi.com by bix.com (CoSy3.31.1.45) id > <9312191740.memo.19248(a)BIX.com>; Sun, 19 Dec 1993 17:40:07 -0500 (EST) > Received: from relay2.UU.NET by delphi.com (PMDF V4.2-11 #4520) id > <01H6O7JJ9BJK94H43Q(a)delphi.com>; Sun, 19 Dec 1993 17:37:58 EDT > Received: from toad.com by relay2.UU.NET with SMTP > (5.61/UUNET-internet-primary) id AA10179; Sun, 19 Dec 93 17:37:09 -0500 > Received: by toad.com id AA13572; Sun, 19 Dec 93 14:19:04 PST > Received: by toad.com id AA13552; Sun, 19 Dec 93 14:17:31 PST > Received: from [144.92.136.35] by toad.com id AA13485; Sun, > 19 Dec 93 14:16:03 PST > From: President(a)whitehouse.gov > Date: Sun, 19 Dec 1993 14:13:02 -0800 (PST) > To: charliemerritt(a)bix.com > Message-id: <9312192216.AA13485(a)toad.com> > Content-transfer-encoding: 7BIT > X-Envelope-to: bix.com!charliemerritt > Apparently-To: Cypherpunks > Wex himself was also on top of this, and what did he find? >Received: by toad.com id AA13552; Sun, 19 Dec 93 14:17:31 PST >Return-Path: <President(a)whitehouse.gov> >Received: from [144.92.136.35] by toad.com id AA13485; Sun, 19 Dec 93 14:16:0 >3 PST >Date: Sun, 19 Dec 93 14:13:02 PST >From: President(a)whitehouse.gov >Message-Id: <9312192216.AA13485(a)toad.com> Which does show the wisconsin 144 stuff, but none of the Delphi- Bix-UUnet nonsense. So what I am to make of this? Two sharp 'punks finger this as coming from (through?) wisconsin 144. So, I conclude that this spoofer goes to U-Wisc. He has accounts on Bix and Delphi. He forwards Free Willy from 144 to Delphi to Bix and from there to toad. But ferguson didn't have Delphi and Bix in his solution. And, again, the message came to me with just the address of the Presidential Palace in Federal City. Seems to me, the most reasonable explanation is that the message probably did not come from The President, but that conjecture is based on the CONTENT, not the addressing. As for Wex, ferguson, and charliemerritt, perhaps these are merely tentacles of Hillary who is discrediting Willy's desperate shot at freedom.

2 1

Re: Writable CD-ROMS as o
by smb＠research.att.com 17 Dec '03

17 Dec '03

>Or your enemy has to penetrate your site or your correspondent's site, >and copy five CD-ROMs instead of one. Yes - but that should be *HARD* to do... In a reasonably secure setup, any of these things are *HARD* (to use your word). But there's no such thing as absolute security; at best, you can balance relative risks. >CD-ROMs have one advantage: there's a lot of data. But that's not >all good, because you *really* want to destroy any keying material >you've ever used. Yes - but it is a writable CD rom - Write over the data when it's used. Have you overwritten it beyond recovery by sophisticated agents? What if the CD-ROM is compromised before you us it? >I've heard People Who Know say that in the spook and government world, >one-time pads are falling out of favor --- because their practical >security isn't as good as a really high quality conventional cipher >with a dynamically-negotiated session key. I repeat: *practical* >security; your enemy isn't going to hit you or bribe you with a copy >of Shannon's theorems. Ok but one time pads DONE RIGHT (an d that's the optimum term - are VERY STRONG Again -- there's no such thing as ``right''. There is only relative risk. Bob Morris Sr. once observed that the real lesson of ABSCAM was not that politicians are bribable -- we all knew that -- but that he could afford one. And if a U.S. Senator costs $50K, what does the janitor cost? Look at the Walker family spy ring -- not that they sold out for money, but just how little money they cost! You're talking about your home machine? Sure -- how resistant is your house to a black-bag job pulled off by professionals? With one-time pads on CD-ROM, they only have to win once to capture your future traffic for a very long time to come. With something like a STU-III, there's *nothing* that can be captured that will give that sort of information. The risk there is cryptanalysis of the underlying system -- but maybe NSA knows enough about cryptosystems that they think that that risk is very low -- lower, at any rate, than the risks of one-time pads. Remember that the goal is not fancy cryptography. The goal is information security; crypto is just one tool to help achieve that. Your enemy isn't going to be sporting and attack where your defenses are. The proper response to a strong security barrier is not to go through it, but to go around it. Let me suggest that folks read @inproceedings{crypt-fail, title = {Why Cryptosystems Fail}, author = {Ross Anderson, Proc. 1st ACM Conference on Computer and Communications booktitle = {Proceedings of the First ACM Conference on Computer and Communications Security}, month = {November}, year = 1993, pages = {215--227} } It's an extremely important paper. I'll quote the beginning of Section 4: As we have seen, security equipment designers and government evaluators have both concentrated on technical weaknesses, such as poor encryption algorithms and operating systems which could be vulnerable to trojan horse attacks. Banking systems do indeed have their share of such loopholes, but they do not seem to have contributed in any significant way to the crime figures. The attacks which actually happened were made possible because the banks did not use the available products properly; due to lack of expertise, they made basic errors in system design, application programming and administration. In short, the threat model was completely wrong. How could this have happened? --Steve Bellovin

1 0

Re: "Free Willy"
by rclark＠nyx10.cs.du.edu 17 Dec '03

17 Dec '03

Michael E. Marrotta writes: > Which does show the wisconsin 144 stuff, but none of the Delphi- > Bix-UUnet nonsense. So what I am to make of this? Two sharp > 'punks finger this as coming from (through?) wisconsin 144. So, > I conclude that this spoofer goes to U-Wisc. He has accounts on > Bix and Delphi. He forwards Free Willy from 144 to Delphi to Bix > and from there to toad. But ferguson didn't have Delphi and Bix > in his solution. And, again, the message came to me with just the > address of the Presidential Palace in Federal City. Not necessarily; I tried telgate, and it accepts connections from anywhere. This makes it ideal for spoofing, as only if a log is kept of remote connections could the true location of the spoofer be discovered. Even in that case, a savvy user of PADs and other non-Internet functions could easily add another layer of concealment to an already fairly clever spoof. The spoofer _may_ be at uwisc, but it is also possible that a telnet gate collector is at work here. There are dozens of cisco servers, X.25 gateways, etc. which allow public access from any site. The wise choice is, of course, to disable both incoming and outgoing interdomain telnet connections from these gateways. However, this is not always done. ---- Robert W. F. Clark rclark(a)nyx.cs.du.edu

1 0

FWD: Internet without Ma Bell
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

I seem to remember this subject being discussed here a few months ago (speculating). Now here's the reality! This was posted to a local newsgroup on this BBS. Here is an article from WiReD magazine, issue 1.6, December 1993 page 28. ---->8--clip here--8<-------- TUNING INTO THE NET Data networking is a tiresome topic at best, butmany staid analysts in the high-tech world perked up and took notice when Microsoft co-founder Paul Allen recently purchased US $17.5 million worth of stock in Metricom Inc. based in Los Gatos, California, this networking company specializes in providing low-cost, high-speed networking services over unlicensed radio spectrum. Analysts call Metricom "daring," "bold," and "innovative." Why? It's managed to build a high-bandwidth data service over the 900-MHz band of unlicensed radio spectrum. The cost: just US$9.95 a month for unlimited, high speed 14.4-Kbps connection or US$2.95 if all you need is a 2400-baud connection so that you can keep track of, say, your network of coke machines(don't laugh, this is a very real application). If you want an ultra-speedy 56-Kbps connectivity(the kind businesses currently pay hundreds of dollars a month for), it'll cost just US$19.95 a month. Please go back and read those prices again. They're not typos. Developed for te utility industry, Metricom's technology has Paul Allen all aflutter because it works like the net does: Hundreds of independent, intelligent, IP-addressable "nodes" - essentially radios linking Metricom's network together - are hung all over the place. Small and inexpensive, these devices can piggyback unobtrusively on lampposts and buildings, so there's no need to rent or buy real estate for huge radio towers (competitors like Ram Mobile Data and Ardis use licensed radio spectrum and large transmission towers). And Metricom's radio modems, which mimic regular modems so computers and applications can't tell the difference, sell for less than US$500 and will more likely than not be miniaturized from their current size, roughly the heft of a TV remote, to PCMCIA cards, ideal for all the PDA's we're waiting to buy. "It's neighborhood networking," says Paul Allen, an analyst for Forrester Research of Cambridge, Massachusetts. "This technology has a lot of potential." Flush wit Allen's cash, Metricom plans to extend it's networking infrastructure from it's base in Silicon Valley to the rest of Northern California, then throughout the major cities in the United States. Metricom +1 408 399 8200 -John Battelle -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

Distribution of Secure Drive
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Dec 10 I posted the following: On Nov 30, I sent a private msg to Eric Hughes asking him to put Mike Ingle's Secure Drive program for MSDOS SECDRV10.ZIP 68155 11-19-93 Secure Drive 1.0 with SRC. On the Soda.Berkeley FTP site and to advise me of its location. I have not received any response at all. I'm on a UUCP system, so I have to do FTP requests via an E-mail server, which is cumbersome if one has to "fish around" for a file one doesn't know the exact directory & filename for. I'm aware that Mike said he hadn't submitted Secure Drive to the FTP site because of "export concerns." But since this site is already distributing PGP, I wouldn't think this a "concern" to the site administration. So I'm asking any public-spirited Cypherpunk (perhaps even an anonymous one) to place Secure Drive on an FTP site or a site with an E-mail file server and to post the location of the file either here or to me privately. So far I still haven't heard from Eric. I did get two responses. The first was anonymous and sent me a copy of Secure Drive with a request for me to post it to foreign FTP site(s). The second was a request from a foreign site for me to send them a copy. Perhaps I didn't state my desires clearly enough. I already have a copy of Secure Drive. I would like to get it uploaded to a -USA- FTP site (like soda.berkeley) or e-mail fileserver site. In my (non-professional) opinion, this is completely legal. I would rather not -unnecessarily- break the ITAR law (or even openly conspire to do so), by sending Secure Drive overseas myself. Once Secure Drive is on a domestic FTP site, some furriner may hear about it and flout our sacred law and have a copy sent to him. But that won't be my fault. Matt Blaze commented on Dec 16: Please, please don't do this without checking with the author of the package first. He went out of his way to say that he doesn't want to a make it available for ftp because he doesn't want to deal with potential export problems. So respect his wishes; it's his work, after all. I must politely but strongly disagree! My recollection of Mike Ingle's comment is that Mike said that -he- had not acted to put Secure Drive onto a domestic FTP site. He has -not- said that anyone - -else- could not do so. I suspect that by "checking with the author ... first", you would put Mike in the position of having to go on record as either approving or disapproving placement on a domestic FTP site, which he so far has managed to avoid doing! Mike is free to jump in here if he -wants- to go on record. I hope he will just pretend he didn't see this series of posts so he can maintain his plausible deniability that he approved allowing SD to "leak" overseas like PGP did. You all recall that Mike asked testers of the Beta version of Secure Drive not to ship it overseas or even distribute it at all. But I, at least, was -not- asked to agree to those conditions for the -release- 1.0 version and I did not. I have good records of my correspondence with Mike & can quote it if challenged. I will quote Mike briefly. This is his response to my suggestion for a cosmetic change to LOGIN and CRYPTDSK: Me: >I wish I had gotten this to you sooner. At least make sure it >gets in the next release, please. Mike: Ok, the next release (if I do it; I'm hoping the net will take this over the way it took over PGP) will also include ... Well, when the "net" took over PGP, it "leaked" overseas, didn't it. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLRcv994nNf3ah8DHAQFAOwP/UwPp8h/8WrCe8Gs1k6BOCSKo4OrwB8bW kOoLet3qa8bNmDPoWccfaHP5PZDD4TR6oGkqxXqWposvgs+Zl5oN1WDAQqnTBykF OCBdsIHsnIshrLxahD7SCT/s8QxfYsl/hqqL0phOOA5DjCM8sSOEAocOWhywuUYE vRDXy+hQLns= =Fe/M -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

2 1

Swank's comments on Secure Drive
by frc＠bwnmr4.bwh.harvard.edu 17 Dec '03

17 Dec '03

Punks' Actually Mike Ingle has commented on his position on the distribution of Secure Drive. He asked that it not be placed for anonftp just because of the fact that he doesn't want ot run the same kind of risk that PRZ is currently in... I didn't save a copy of the msg but I'm sure that some one did. FRC -- #include <hdrs/disclaim.std> /* Neural Nets catch only dreaming fish. */

2 1

One-Time Pads an Overall Lose for Cypherpunks
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Cypherdenizens, There's always a lot of speculation about one-time pads, schemes for rewritable CDs and CD-ROMs, etc. Stuff about how to generate sufficiently random bits to fill the CD or DAT, how to distribute the media securely (and isn't that always where the rubber meets the road?), and so on. I don't wish to quash this enthusiasm, but one-time pads are an overall "lose" for the Cypherpunks cause. In fact, the whole modern era of crypto came about with the invention by Diffie and Hellman of assymmetric, or public-key crypto. A return to "secret codes" and symmetric cyphers--except as used inside the guts of public key systems, of course, as with DES or IDEA--is a return to the old days where the economics of transporting and securing key material left crypto in a limited number of niches. The "key distribution" problem is of course the killer. Even if rewritable CDs come down in price (machines are currently a few K, blank disks are at least $25 apiece....more than I plan to pay!), who wants to have, say, a hundred or more disks to communicate with the hundred or more e-mail recipients one might reasonably have (these numbers are not central)? And I'll trust a public key cypher with a key disk (or Newton-like PDA) and a memorized passphrase a lot more than I'll trust a stack of CD-ROMs which I can't reasonably carry with me at all times. All in all, a lose. The "Crypto Phase Change" (tm) won't happen because we convince ordinary folks to start burning one-time pads into CDs and CD-ROMs. Face it. Sorry to sound grumpy about this, but the advocates of one-time pads need to do some strategic thinking about this issue. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

2 1