December 2003 - cypherpunks-legacy

Re: Idle question...
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Roger Bryner wrote: On Tue, 12 Jul 1994, Graham Toal wrote: > Subject: Didn't anyone note the A5 posting? Does anyone have a copy of this posting? Before I get many more requests for this - I'm sorry, I don't seem to have a copy. I could have sworn I saved it but I've spent all morning grepping my disk and it just ain't there. Coincidence or Conspiracy - you make the call ;-) G PS If anyone has a *big* newsspool, look in uk.telecom or sci.crypt somewhere between 17th and 21st June.

2 1

NSA technology transfer (fwd)
by Dan Harmon 17 Dec '03

17 Dec '03

I'm reposting this in response to a few recent posts inquiring about the NSA flyer. ---------- Forwarded message ---------- Date: Tue, 14 Jun 1994 00:21:30 -0500 (CDT) From: Dan Harmon <harmon(a)tenet.edu> To: cypherpunks(a)toad.com Subject: NSA technology transfer The following was posted on the list in the middle of May. Being curious I called the number list at Ft. Meade. The person on who answered was real shaken, for lack of a better term, that I called, it seems that this was the second inquiry that day. He wanted to know various things, like where did I get the information, was my name Bruce.... After a few minutes he finally took my name and said, to call him in a week to 10 days if I did not here from him. A few day later he called and said I needed to send a letter to expressing my interest in the technology. About 10 ten days after that I called to inquire if he received my letter and what was the next step. It seems that there had been quite a few requests and that they were trying to determine whether or not they were going to allow the technology to be transferred to individuals. The person said to call back in 4 or 5 days. I called today and they said in essence that they were not going to let individuals have a shot at it. They said that they were going to charge stiff license fees, that you would need to show a plan of how you were going to develop the product..... You get the point. It is obvious that they really don't want to transfer the technology. And if they do it will be to someone with deep pockets and who they like. I wonder where the fees that they want to charge will go, to the general treasury or to their own budget? More later. Dan Harmon On Thu, 19 May 1994, Anonymous wrote: > > > Newsgroups: sci.crypt,alt.security,alt.privacy > From: schneier(a)chinet.chinet.com (Bruce Schneier) > Subject: "Interesting Stuff" Checkers at the NSA > Message-ID: <Cq2934.q0(a)chinet.chinet.com> > Organization: Chinet - Public Access UNIX > Date: Thu, 19 May 1994 17:40:15 GMT > > This is from a flyer that NSA people have been distributing: > > NATIONAL SECURITY AGENCY -- TECHNOLOGY TRANSFER > > Information Sorting and Retrieval by Language or Topic > rest elided

3 3

sci.crypt archive ftp site
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

There's one at ftp://rpub.cl.msu.edu/pub/crypt/sci.crypt But I just looked and it only has up to April 94. By the way, everybody should check out http://www.quadralay.com/www/Crypt/Crypt.html ftp://furmint.nectar.cs.cmu.edu/security/README.html These are two budding cypherpunks WWW sites. Somebody's been busy. "Cypherpunks weave Webs!" Jim_Miller(a)suite.com

1 0

Re: Security for under a buck fifty
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 9:42 AM 7/12/94, Mike Johnson second login wrote: >>[Ben.Goren(a)asu.edu [me] wrote about generating pass phrases from >>true random numbers, mapping into a character set, creating mnemonics.] > >I already do this -- except that I use a keystroke- timing program for >the true random source, and I do the mnomonic generation with my brain >instead of the program. My program just converts the random numbers to >uniformly distributed printable ASCII (values between space and del), for >a little more entropy than 6 bits per character. The tradeoff is between number of characters needed (length of passphrase) and diversity of character set. I'd probably have better luck with the mnemonic if I didn't have to fit in a whole string of %*$@!, but that should probably be a user setting. >A more automated way to generate a pass phrase might be to convert every >16 bits of random numbers to one of 65536 words and names in your >favorite languages. That way, you would have real words to memorize, but >in a strange order. For example, a 128 bit key might be: >tree elephant action roof xymurgy eight top slash. > >You could try to think of some story to link the 8 originally unrelated >words together and help you to remember it. Another possibility: have a dictionary of different parts of speech and assemble them in order. For a short example, each passphrase could be in an order such as: Article adjective modifier noun verb article adjective modifier noun. Our favorite would fit: The quick brown fox jumps over the very lazy dog. This looses entropy (Mallet knows the order, and probably the dictionaries) and so you would want either a longer sentence or some other modification, like random--not decided by the person--capitalization or character substitution. Or have two sentences: The quick brown fox jumps over the very lazy dog; a lovely ermine glove fits into the hazy slumping bucket. Figure thirteen bits each with dictionaries of ten thousand each adjectives, modifiers, nouns, and verbs--your final dictionary would be 40 thousand words, total; you'd need about ten words to get 128 bits. Make that two shorter--eight word--sentences, restricted to easy-to-remember orderings, and you've more than made up for whatever entropy was lost in having a known structure. Umph. I think I need to start making time to write code, if I want to see this work. b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): Protect your privacy; oppose Clipper. Voice concern over proposed Internet pricing schemes. Stamp out spamming. Finger ben(a)tux.music.asu.edu for PGP 2.3a public key.

2 1

Re: Gov't eyes public-key infrastructure
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>>The U.S. government intends to operate a public-key certification >>system for government users that will also serve the private sector, >>as well. But a report just completed by Mitre Corp. for the National >>Institute of Standards and Technology (NIST) puts the price tag at >>$1 billion for the start-up of the government alone, with a possible >>$2 billion annual operational cost for managing certificate-revocation >>lists. > >All in all, I'd say this is a pretty good argument for PGP's web of trust >model... Especially given that urban folklore about everyone being only 5 hops away on the network of life. I.e. Everyone is a friend of a friend of a friend of a friend of a friend of anyone else. This was sort of troped upon in "6 degrees of Separation", the John Guare movie/play. If anyone had any concrete data about this, then it might be interesting to calculate the optimum number of people you should get to cosign your public key. Anyone remember enough about Ramsey numbers and Graph Theory? -Peter > >Phil

3 2

Re: Idle question...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)netcom.com (Timothy C. May) on Tue, 12 Jul 12:14 PM >I used to know the ftp site that had archives of all >sci.crypt articles. If it's still active, anybody know >what it is? >From Cyptography FAQ of July 7, quote: Sci.crypt has been archived since October, 1991 on: ripem.msu.edu:pub/crypt/sci.crypt/ (available only to US and Canadian users) Another site is rpub.cl.msu.edu:/pub/crypt/sci.crypt/ from Jan 1992. End quote.

1 0

space contractors must use only "approved" encryption devices?
by Stanton McCandlish 17 Dec '03

17 Dec '03

[The person that forwarded to us noted: "It is relevant to the current efforts regarding encryption systems, specifically, it is the first instance that I have seen where the Federal Government will require non-government entities to use only government approved encryption...So much for the contention that no one would be forced to use Clipper."] Please note that the included article was NOT written by the person who actually posted it to the network. The author currently does not have Internet access, and has had to have a friend-of-a-friend post it for him. See the note from Bill Higgins just after the headers below. From: higgins(a)fnalv.fnal.gov (Bill Higgins-- Beam Jockey) Newsgroups: sci.space.policy Date: 28 Jun 94 19:49:02 -0600 Organization: Fermi National Accelerator Laboratory [Wales Larrison has been off the Net for a while and still can't post. But, through a friend's account, he has managed to send me a fresh installment of his commercial-space newsletter. Glad to help post it. This is part 1 of three parts. --Bill Higgins] SPACE TECHNOLOGY INVESTOR/COMMERCIAL SPACE NEWS -- No. 24 [edited for brevity] 3- US COMMERCIAL REMOTE SENSING POLICY FINALLY SET On 9 March, the Clinton administration finally released the official administration policy on commercial collection and sale of high- resolution satellite images. This policy allows the US Department of Commerce to license U.S. companies to operate private remote sensing space systems and sell images from those systems to domestic and foreign customers. Notably, it sets no limits on the resolution of imagery that can be sold. Under this policy, US firms desiring to operate such space systems must apply for a license from the Department of Commerce, in accordance with the Land Remote Sensing Policy Act of 1992. To get a license, each firm must: - maintain a record of all satellite tasking for the previous year and to allow the US government access to this record. - operate the satellite in accord with the characteristics submitted in the license application (although changes can be submitted for approval) - obtain appropriate export licenses for foreign sales of data or hardware. This specifically includes transfer of export sensitive components, subsystems, and information concerning remote sensing space capabilities which are on the US Munitions Control List. Transfer of such sensitive technology can be made available to foreign entities only on the basis of a government-to-government agreement. [*****************************************************************] - use only approved encryption devices, since the US government retains the right to deny unauthorized access to this data to others during periods when national security, international obligations and/or foreign policies may be compromised (as provided for under the LRS Policy Act). [*****************************************************************] - use a data downlink format that allows the US Government access and use of the data during periods when national security, international obligations and/or foreign policies may be compromised (also as as provided for in the Act). - allow the US government to limit data collection and/or distribution when national security or international obligations and/or foreign policies may be compromised. Such a limitation may only be imposed when the Secretary of Defense or the Secretary of State, and the Secretary of Commerce agree to this. Any such decision can be appealed directly to the President. - Pursuant to the Land Remote Sensing Policy Act of 1992, licensees must notify the government of intentions to enter to significant agreements with foreign customers. Under these policy guidelines, a license to Lockheed for a high- resolution space remote sensing satellite was granted on 22 March. [Commentary: I was starting to wonder if any more of the commercial remote sensing licenses would make it through the licensing system. Lockheed originally submitted their license application back in June of 1993, and under the statues which govern the licensing process, they were supposed to have had a ruling on their license within 120 days. The policy apparently hung up until the National Security Council (in particular the State Department, DoD, and CIA) could come to an agreement about how to handle such data in times of crisis. The concern expressed was legitimate -- similar data could have compromised US and allied forces during another situation like Saddam's War in Kuwait/Iraq. During that crisis, SPOT and Landsat voluntarily limited access to data from the Middle East -- but everyone involved recognized some procedure needed to be agreed upon and put in place rather having to work the situation on an ad-hoc basis. The commercial firms planning for high-resolution commercial remote sensing systems seem to fairly pleased with the new policy, and other announcements of license filings are rumored to be in the works. (See below.)]

1 0

Administration Buys Off EES Patent Holder (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

Date: Mon, 11 Jul 1994 14:53:56 -0700 From: "Brock N. Meeks" <brock(a)well.sf.ca.us To: com-priv(a)psi.com Subject: White House Pays CyberWire Dispatch // Copyright (c) 1994 // July 11 // Jacking in from the "Blank Check" Port: Washington, DC -- The Administration will today announce it has sidestepped the threat of patent infringement lawsuit involving its Escrow Encryption System, commonly known as Clipper. The solution: Toss the original patent holder a blank check and buy him off. The National Institute of Standards and Technology (NIST), the agency walking point for the White House on its proposed encryption Clipper encryption standard, has agreed in principle to license two key patents relating to the technical workings of the key escrow system from patent holder Silvio Macali, an MIT professor. The government's key escrow system depends on the capturing of digital "keys" that allow authorized law enforcement officials to unscramble Clipper encoded speech or Capstone encoded data, including electronic mail. Macali, as it now turns out, thought up the idea and had the moxy to patent his scheme. Macali's inventions detail the process whereby a digital key is divided into pieces. Those pieces are then held by separate "key escrow agents" which now turn out to be hand picked government agencies; one is NIST the other a division of the Treasury Department. Those keys must be combined to successfully unlock the code that allows law enforcement officials to listen in. The license agreement effectively eliminates "concerns Macali raised about possible infringement of his patents," said NIST spokeswoman, Anne Enright Shepherd. It also sidesteps a potentially ugly lawsuit in which Macali lawyers could have uncovered all sorts of currently unknown information about the Clipper program. According to sources familiar with the negotiations, the government's agreement with Macali grants the Administration a nonexclusive license to the patents for use in current implementations of Clipper and Capstone and for future implementations, Shepherd said. It's not known whether the government will make a single payment to Macali or pay royalties. "The procurement phase of the agreement is still continuing," Shepherd said. Disclosure of the amount paid to Macali and details of the license agreement are expected to be made public sometime early next month, she said. That agreement, however, wont result in any user fees, Shepherd said. Questions Raised ================ Although the government's action today nullifies a pesky problem, it also continues to raise serious questions about the Administration's -- and more pointedly -- about the National Security Agency's ability to ramrod an encryption policy that has been elevated to the status of a national security issue. Surely the NSA or NIST can dial up the U.S. Patent Office and query its database, looking for patent conflicts. Apparently the clock and dagger crowd was too busy with other matters. Arrogance or oversight? "Macali made the existence of his patents known during the public comment period," Shepherd said. "He let the government know he had some patents that he felt were similar to some technology used by the key escrow system. So the discussions kind of began at that point," she said. Unfortunately, the "public comment" period was launched only after the White House trotted out its Clipper policy as set in stone. Nobody expected Macali to piss the parade. Privacy and civil liberties groups have roundly criticized the government for developing Clipper in secrecy, not allowing public debate on the issue. If that debate had taken place, Macali would have come forward years ago. Despite the Administration's continued efforts to push Clipper into the deep waters of the mass market, there are rumblings that it may not be christened after all. At very least, it may not be the only encryption standard blessed by the government. Several groups are now floating their own alternatives to the Clipper program. And although the National Security Agency is working behind the scenes to sink such efforts, NIST, at least, is making the appearance of listening. Earlier this year, NIST put out a call for the Cooperative Research and Development Agreement (CREDA), which was an effort to draw publicly interested parties into a cooperative venture to develop a key escrow alternative. Those that came forward have now thrown off working formally with CREDA, but have instead formed their own working group, government sources said. Those efforts are being heard and taken seriously, according to several government sources familiar with the discussions. "Encryption isn't a front page issue, but those [inside the Administration] working on this issue are tired of being beat up over it," said a White House official. Discussions on Clipper alternatives "are continuing," Shepherd said. "And we're still open to other alternative ideas and we're working with the people who have presented their own ideas at this point." Meeks out...

1 0

Re: Idle question...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by berzerk(a)xmission.xmission.com (Berzerk) on Tue, 12 Jul 10:8 AM >On Tue, 12 Jul 1994, Graham Toal wrote: >> Subject: Didn't anyone note the A5 posting? > Does anyone have a copy of this posting? I would appreciate getting a copy of this posting also. John Young

1 0

The Detweiler Files
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

jamiel(a)sybase.com (Jamie Lawrence): > I have a writing assignment coming up (nothing to do > with much that is talked about on this list), and some > example posts by Detweiler could be really handy as > references. I have one from a long time ago, but could > use some others- anybody save any for posterity? If so, > could you forward me a couple of juicy ones? I have about 580k of 'Detweiler files'. These are sorted by mail from his presumed identities, mail to them and relevant mail about him. Separately stored are some of his gems, including his roman torture piece and S Boxx's poetry. You can't ftp _in_ to my SLIP node, but I can ftp it to some place convenient. Compressed, it should be about 200k (ZIP). ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1