December 2003 - cypherpunks-legacy

Re: Infomercial, Clipper
by tomh＠bambi.ccs.fau.edu 17 Dec '03

17 Dec '03

>Tom Holroyd says: >> Most people couldn't care less. They don't encrypt data, and will >> never use a clipperphone. The FBI can *already* listen to all their >> phone calls and see all their medical records. Why should people >> do anything to protect something they don't have anyway? Perry says: >I disagree that secure phones don't have an extensive market. If they were >cheap enough, people would want the feature just for the hell of it. I'd >say that most people would pick up a cryptophone if it only costs a couple >bucks more and is transparent to use. And if the FBI could listen in, it would be *no different* from what they have today. The point is, Clipper does not take anything away from most people. They might get a Clipperphone if they thought the building superintendant was hiding in the phone closet listening in (thus getting some real value from the thing), but they aren't hiding from the FBI today, and they won't care if the FBI might listen in tomorrow, too. Note that I'm not saying that Clipper isn't the tip of an iceberg giving the spooks bigbrother-like powers. All I'm saying is, you won't be able to convince Joe Public that he's losing anything. If they start arresting people for using PGP, that's another problem, and Joe Public won't care about that, either.

1 0

Re: Digitally Signing Physical Objects
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

>> 3. The shop or customer wishing to authenticate the part takes the >> number stamped on the part, runs it through the *public* key of the >> manufacturer (widely available, not kept secret, of course) and gets >> back the feature vector, which he can then compare to what he actually >> sees on the object. .... >This seems to have a tricky dependence on the tolerance. The forger can >get a valid plaintext and signed feature vector. So, if the tolerance >for error is too low, you get false positives, but if it's too high, a >forger could create something starting from the feature vector. An >interesting CAD/CAM problem. To keep black market forgery part off the market, a 30% tolerance is way more than enough. There should be no false negatives (making a real part look fake), but if 1/3 of the forgeries slip through (i.e. 2/3 don't), this has the affect of driving the forgery price up by a factor of 3, effectively pricing them out of the market. (Unless the real goods are overpriced a factor of 3...:-) ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, 20525 Mariani Ave, MS 305-3B * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

1 0

Re: Net restructure
by drzaphod＠brewmeister.xstablu.com 17 Dec '03

17 Dec '03

> . . . I think > our biggest concern when it happens will be that Clipper like encryption > and monitoring will be implmented as a standard. Who knows maybe the net > will be run by the government. > Reuben Halper > -anger is a gift- rage aginst the machine/Freedom This doesn't stop ordinary [or extraordinary] people from running their own net. This net, with in and out ports to other nets, would follow none of the rules enforced upon our current net. If they try to cut us out we simply change our logical location. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - DrZaphod #Don't Come Any Closer Or I'll Encrypt! - - [AC/DC] / [DnA][HP] #Xcitement thru Technology and Creativity - - [drzaphod(a)brewmeister.xstablu.com] [MindPolice Censored This Bit] - - 50 19 1C F3 5F 34 53 B7 B9 BB 7A 40 37 67 09 5B - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

Re: Net Restructure
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

> This doesn't dtop ordinary [or extraordinary] people from running their > own net. This net, with in and out ports to other nets, would follow none of the rules enforced upon our current net. If they try to cut us out we simply change out location. I don't think that is logical or feasible, and my point is that the net is becoming something for the masses now. The masses won't be as crafty as you . I feel that if or when it is restructured the people logging on won't be aware of the lack of security or they will have false security. Reuben Halper

2 1

MacPGP help
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

Would anyone with fair knowledge of MacPGP help me out. I mean I REALLY need help. Thanks, Reuben Halper

1 0

New Security/Encryption Corporation - INFORMATION INSIDE (long)
by Matthew J Miszewski 17 Dec '03

17 Dec '03

THIS IS NOT AN ADVERTISEMENT BUT INFORMATION OF GENERAL INTEREST TO CYPHERPUNKS. IF YOU HAVE NO INTEREST IN DATA SECURITY THROUGH APPLIED CRYPTOGRAPHY PLEASE DELETE THIS MESSAGE NOW. SORRY FOR ANY CROSS POSTING. -------------------------------------------------------------------------------- Information Defense Strategies (IDS) Information Security Services Developed for the World And Applied to Your Office Hello All, You might be wondering, "Who is this Information Defense Strategies"? And, "Why is this in my mailbox"? And I would say, "Well, that's a good question". About three months ago I announced that a new data security corporation would be started soon. Its emphasis would be in the application of cryptographic protocols already in existence and the possible development of new ones. Well, that idea has been born into IDS. Why have you received this note? The reasons are varied. Either you contacted me with interest in getting involved, or I have been exposed to your interests in data security through public exposition of such, or a member of the security community referred you to me as an entity interested in what we are doing. Regardless, you have received this note because you are qualified in one or many ways to get involved. Many of you are already related to some sort of computer profession right now. This note is to let you know we are out there, and are interested in building bridges to your organization. Please read through the information provided below and provide feedback if you can. Many people have been anxious to see this get started, as of course I have been also. Finally, a description has been put together. Through the next round of feedback, we will be ready to begin. It is exciting to be starting out and applying ideas that have floated around for some time. This might be one of the first virtual corporations to have been born as such. I would like that sort of cutting edge to remain our vanguard at IDS. And I would like all of you to be a part of it. Matthew J. Miszewski Information Defense Strategies (IDS) -----------------------8<-------------------------8<------------- Please Distribute To Qualified Parties of Interest Direct all electronic correspondence to: mjmiski(a)macc.wisc.edu Snail Mail to: Matthew J. Miszewski 509 N. Lake Street, Suite 504 Madison, WI 53703 608-255-9871 Applied Cryptography No not the book (although I highly recommend it). IDS will base most of its robust security strategies upon encryption. Being well aware of ITAR we will be careful and yet aggressive in our application. I have targeted two areas for immediate concentration, Smart Card technology and encrypted challenge/response access systems. I am, of course, interested in much research and future development in other areas. These two are merely the most immediate opportunity. To remain on the cutting edge, IDS will need to be very active in Research and Development. Many people are moving towards applied cryptography. It is personally important to me that IDS be there at the same time if not before others. Security Services We will basically provide four security services. Consultation, evaluation, Tiger Teams, and IDS Custom Installs. We will consult for firms with a general interest in security as well as those that are well established in the field. This consultation will be general in nature and very affordable. IDS will also evaluate a firm's current security status. This service will offer our clients the opportunity to have a third party objectively review their security. A report of weaknesses will be generated from our evaluation. IDS may offer clients a Tiger Team ongoing contract. This will consist of teams actively attempting to covertly breach security in order to actively discover and immediately close undiscovered security holes. The insurance provisions of this area are tentative and pending and therefore this aspect of IDS is still tentative. Finally, we will offer IDS Custom Installs. These will vary from unique IDS developed Strategies to already developed strategies. Our custom security front ends will be constantly updated and evaluated. Third party product partnerships will increase our viability as well as increase the availability of robust security products. Platforms The data related operating system platforms we will deal with will attempt to be comprehensive if not exhaustive. In order to tap our targeted market we must be diverse. While I personally would love a concentration in Unix work, the reality is that many of our clients will be LAN based machines of the personal variety. We will therefore need specialists in lower level systems (PC, MAC, etc). Telephony Toll fraud can be devastating to smaller businesses. The days of "blue boxing" exploration appears to be over in this country. Unfortunately, the replacement, at least to a certain extent, is PBX and VMS abuse. In fact most people in business have been told that it is not a matter of if your PBX will be hit, but rather when. In addition Voice Mail Systems (VMS) are being utilized across the country without authorization. While some unauthorized users might mean no harm, there is no way to assure that malicious abuse does not occur. Valuable information may be left to the conscience of the underground community. Applying cryptography to this problem will be part of our charge. From front ends to challenge/response, there are many opportunities in this market. Making this security affordable will be our answer to this dilemma. IDS Basic Philosophy Data Security is VERY important. It is no longer just important to huge corporations, but to everyone. Affordable security consulting and products will help make small business information more secure. While CERT attempts much, it is slow to respond and many questions are still unanswered about its funding and allegiances. It is time to not only make security available but accessible. That is why IDS will exist. An incredibly large market is being overlooked by the elite of security professionals. IDS will address this void in the market. All people deserve good data protection. We can offer it. The plan is that IDS will actively pursue the myriads of offices around the nation with data to protect. From every small law firm with a voice mail system to an accounting firm with several LANs to a sales force that needs easy access but is still concerned with protecting its data, we can offer tailor made security strategies. Our profit (future) will be based on horizontal integration, in other words we will not profit by selling high price tickets to the few that can afford it but rather massive application of moderate priced strategies to everyone we can contact. There are a number of other points I will make in future communications. I plan on having a virtual office that may offer digital cash sales in the future. We may develop a low level net for our own communications. Partnerships will need to be developed as well as some manufacturing research. But I wanted to give those interested an introduction. If you are still interested I will send you the next update. Please respond either way so I know whom to keep on the list. More details to come.... Matthew J. Miszewski IDS ______________________________________________________________________________ In defense of liberty, encrypt for all purposes, civil and professional. In defense of privacy, encrypt all correspondence, personal and professional. In defense of sanity, do not encrypt your dry cleaning invoice! ++++++++--------mjmiski(a)macc.wisc.edu (c)1993

1 0

No Subject
by Ophir Ronen 17 Dec '03

17 Dec '03

hmmmmm, The meeting was not too interesting, we did not get into Clipper or the FBI wiretap proposal. That will be discussed in a few weeks. -Ophir

1 0

Re: Digitally Signing Physical Objects
by fnerd＠smds.com 17 Dec '03

17 Dec '03

i wrote- > >[Physical signature] > > seems to have a tricky dependence on the tolerance. The forger can > >get a valid plaintext and signed feature vector. So, if the tolerance > >for error is too low, you get false positives, but if it's too high, a > >forger could create something starting from the feature vector. An > >interesting CAD/CAM problem. Allen J. Baum replied- > To keep black market forgery part off the market, a 30% tolerance is way > more than enough. There should be no false negatives (making a real part > look fake), but if 1/3 of the forgeries slip through (i.e. 2/3 don't), this > has the affect of driving the forgery price up by a factor of 3, > effectively pricing them out of the market. I don't see how you factor out the variables of the resolution, what physical property is scanned, etc. For some combinations, it would be easy to forge 100% matches. For others, it would be hard to get a 30% match on the original object... Maybe the whole scheme could be improved by a trap-door function that has built-in error-tolerance. (By the way, if anybody knows about fuzzy hash functions, please write me; I'm curious for other reasons.) > (Unless the real goods are overpriced a factor of 3...:-) Isn't Great Art overpriced by thousands of times, in terms of reproduction cost? Anyway, a 2/3 rejection rate would be tough. -fnerd quote me - - - - - - - - - - - - - - - We shall have to evolve Problem solvers galore As each problem they solve Creates ten problems more. --Piet Hein -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

Re: Clipper
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Clipper is currently only rated for non-classified use. It could be done securely, assuming there aren't any unannounced backdoors, by simply using chips for which the keys are not escrowed, or are only held by the military and protected with certain classification levels, but they'd have to do a couple of things to use it. The most important is making sure that a secure Clipperphone is only used to talk to other secure Clipperphones, and in addition you'd probably want to make sure the users have some way of knowing they're talking to appropirately cleared users, since it's sometimes hard to tell if the voice on teh other end of the phone really has the authorization it claims it does. Features like these are built into STU-II and other classified-use approved phones, but aren't likely to be built into vanilla Clipperphones. It may be possible to do that with Tessera, though; I'd have to see more information than they're likely to give out.... Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1

Re: ironic
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

For that matter, it's ironic, though not at all surprising, that they're crying foul so loudly that this KGB mole in the CIA is giving away the identities of CIA moles in the KGB. Fair 's fair, after all.... Though that doesn't mean he has any room to complain if he gets treated teh way the Russians treated the CIA spies in their midst. On the other hand, the papers did make a big deal about how they used wiretaps to help catch the guy, and that they've known about him for a while; is this all timed to support the "voluntary" Clipper and the mandatory Digital Telephony wiretap projects? # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

3 2