December 2003 - cypherpunks-legacy

NYT on SuperGrassley
by John Young 17 Dec '03

17 Dec '03

The New York Times, July 28, 1995, p. A26. [Editorial] Senator Grassley's Surf Police An academic study suggesting that the Internet is awash in bestiality, pedophilia and other kinky sex turns out to have been seriously flawed. Politicians like Senator Charles Grassley who waved the study around as an argument for intrusive regulation have stopped doing so. But Mr. Grassley and his allies have not backed off from their drive to draft unnecessary legislative restrictions on computer communications. Earlier this summer, Senator James Exon attached an amendment to the Senate version of a telecommunications bill that would impose Federal penalties on those who made available material deemed unsuitable for children. The unreliable study that did much to spur this bad legislating was conducted by Marty Rimm, then an undergraduate at Carnegie-Mellon University. It was reprinted in the Georgetown Law Journal and served as the basis for a credulous Time magazine article early this month. Mr. Rimm's academic supervisors have since made clear that the study had serious defects. The likelihood that children will be accidentally deluged with sexually charged computer graphics is much smaller than Mr. Rimm and his promoters suggested. Furthermore, to the extent that any problem exists, the best response is not through heavyhanded, constitutionally dubious legislation but parental education and discretionary user controls. Mr. Rimm's study looked at the computer habits of adults. He focused not on generally accessible areas of the Internet but on separate, commercial adult bulletin board services that require special procedures to find and use. This, critics note, is like visiting an adult bookstore and using the percentage of gamey titles to generalize about the contents of all bookstores. He also looked, less carefully, at specialized areas of the Internet that would be hard to stumble upon by accident. By Mr. Rimm's own calculations, less than 1 percent of all material on the Internet itself is raunchy, although this tiny percentage is unusually popular among the adults he surveyed. Another Carnegie-Mellon study, focusing on families with high school children, suggests that sexually explicit material is much less popular among these users. To be sure, sexually explicit material that would be offensive to some users can be found on the Internet. It is within the reach of computer-literate children using the networks without parental supervision. But the problem is being exaggerated to create a pretext for restricting the material available to adult users of computers. Some members of Congress, out of political greed or ignorance, want to censor what can be put on the Net and prosecute those who post legal but raunchy material. The approaches being advocated by Mr. Exon and Mr. Grassley are unwarranted and unconstitutional. They are also impractical. Material posted to the Internet in foreign countries, beyond the reach of American law, is as available to users as domestically posted material. Items can also be posted through anonymous mailers that make it impossible to identify the original source. Censorship would also have the unwelcome effect of restricting adults to reading and viewing material deemed suitable for children, and would stunt the future of the networks as a medium for artistic expression. Parents who want to restrict what their children are able to call up on their computers can avail themselves of software now available on the market that can block out unwanted material. Filtering out such material at the user end is a more practical, and far less objectionable, approach than limiting a nation of computer users to baby talk. Such devices are not foolproof, of course. The surest defense is for parents to try to teach their children the kind of healthy values that would make them uninterested in, or immune to, sexually exploitative material. [End]

1 0

Banks and Crypto - Again
by KDAGUIO＠aba.com 17 Dec '03

17 Dec '03

I apologize for the earlier transmission error/offense. Our server has been down intermittently so I have not received many flames yet. The meeting mentioned has already taken place resulting in significant progress toward our goals. The server is now up. Flame away my friends. ...kawika... ****************************************************************** CONTACT: Sonia Barbara FOR IMMEDIATE RELEASE (202) 663-5469 (1995) ABA REAFFIRMS SUPPORT FOR PRIVATE-SECTOR CONTROL OF CRYPTOGRAPHY Association Recommends a 10-year Extension for the Data Encryption Standard WASHINGTON, July 21 -- The Data Encryption Standard (DES) should be recertified for at least 10 more years to allow interested financial institutions adequate time to convert to any new cryptography standard, the American Bankers Association said in a policy statement issued today. Encryption is the process whereby sensitive data communications, such as wire transfers, credit card and automated teller machine transactions, are protected by secret codes to protect their confidentiality. DES, released in 1977, is the primary method used by financial institutions to encrypt information. Critics say that the longer DES is used, the more likely its code could be broken. While realizing this could limit its life span as a government certified standard, ABA warned that requiring banks to convert to a new standard by 1998 (the year DES's certification expires) could be prohibitively costly due to the high level of electronic funds transfers secured by DES. ABA therefore encouraged the National Institute for Standards and Technology (NIST) to continue to endorse DES as a Federal Information Processing Standard (FIPS) for use by the financial community. There has been an ongoing debate regarding who should control the development and support of private-sector computer security standards: the government or the private sector. ABA strongly recommends that the U.S. government work with the private sector and Congress in an open forum to develop a comprehensive policy on the commercial use of cryptography. In its newly-revised policy statement on cryptography, ABA proposed alternatives to DES and outlined other criteria that must be met before changes in cryptographic standards can be accepted by the banking industry. These criteria -- which will be presented next week to representatives of the White House, U.S. Department of Commerce, National Security Agency (NSA) and federal banking agencies -- were developed following a two-day meeting held in June of bankers, vendors and crypto experts concerned about the federal government's direction regarding private-sector information security. Specifically, ABA recommended: * The financial services industry be allowed to continue to use DES based on risk assessment (e.g. value of the transaction) and the business application involved. * A security framework encompassing a family of commercially available algorithms, including DES, be developed. This framework should include a process for negotiated algorithm selection based on the level of risk and other business requirements. * Opposition to government mandated key management systems for financial applications where keys would have to be stored outside the financial institution (e.g. key registration/surrender or the mandatory escrow of cryptographic keys). Instead, banks should continue to be responsible for key management and continue to cooperate with government for law enforcement purposes, as required by law. * Export of cryptography for financial applications must not be restricted. * Full participation of Congress and the private sector before establishing a U.S. policy for the commercial use of cryptography, instead of being carried out solely by Executive Order. [Note: These recommendations were summarized. For the full statement, please call Sonia Barbara at 202/663-5469.] The American Bankers Association is the only national trade and professional association serving the entire banking community, from small community banks to large bank holding companies. ABA members represent approximately 90 percent of the commercial banking industry's total assets, and about 94 percent of ABA members are community banks with assets less than $500 million. ###

1 0

Re: copyrighting algorithms
by Wolfgang Roeckelein 17 Dec '03

17 Dec '03

Hi, >Wolfgang Roeckelein writes: >> No, I was referring to a case, where a third party game cartridges >> manufacturer reverse engineered the specifications of the game >> cartridges slot for producing his own cartridges for this game. > >Sounds like _Sega v. Accolade_, 977 F.2d 1510 (9th Cir., 1993). >I don't have it in front of me, but Terry Carroll's Copyright FAQ >(ftp://rtfm.mit.edu/pub/usenet/news.answers/law/copyright/faq/part2) >cites it for the proposition that dissasembly of a copyrighted work >can be fair use if there is no other way to reach noncopyrightable >(functional, not expressive) elements of an existing work. Yes, thank you for pointing this out. I'm glad that I was right with Sega... Wolfgang --- Dipl.-Wirtsch.-Inf. Voice: +49 261 6509 173 Wolfgang Roeckelein Fax: +49 261 6509 179 WHU Koblenz E-Mail: roeckelein(a)wi.whu-koblenz.de Burgplatz 2 (NeXTmail ok) D-56179 Vallendar WWW: http://www.whu-koblenz.de/~wolfgang/ Germany --rsa--------------------------------8<------------------------------------- #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) -------------------------------------8<------------------------------------- TRY: echo squeamish ossifrage | rsa -e 3 7537d365 | rsa -d 4e243e33 7537d365 Residents of the USA & France *MUST NOT* include this .sig if following up! *** Residents of France & Russia *MUST NOT* make any use of this -sig ! ***

1 0

Re: Java, Netscape, OpenDoc, and Babel (NewsClip)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Responding to msg by merriman(a)arn.net (David K. Merriman) on Fri, 28 Jul 3:24 AM >Still tentative, or is there a Web address? The mall will be accessible July 31 from a pointer at http://www.org.com . ---------- OSF Opens Software Web Mall For Java Cambridge, MA, July 26 (NB) -- In a teleconference today, the Open Software Foundation (OSF) unveiled plans to open an Open Software Mall on the Web on July 31, and to start distributing software there this fall that will include Java Ports technology for the Web, DCE (Distributed Computing Environment) Web, and Microkernel Unification Specification, a new technology for building cross-platform applications. At the teleconference, which was attended by Newsbytes, Dr. Ira Goldstein, chief scientist and executive VP, said that the OSF sees the Open Software Mall as a place for users to access and help to beta test new technologies like Java Ports, DCE Web, and Microkernel Unification -- being sponsored by the OSF in conjunction with major vendors -- as well as software from universities and other research collaborators, and eventually, outside "open systems" efforts that are "germane to core OSF technology." Java Ports, a series of ports of Sun's Java technology for the Web, is being produced by the OSF with Sun, Hewlett-Packard, and Novell, Goldstein told the journalists and analysts. The technology will be available on the Open Software Mall in September, he added. DCE Web, an application designed to provide the Web with DCE mechanism for encryption, access control, and naming, is a collaborative project from the OSF, Hitachi, HP and AT&T. DCE Web is "consistent with HTTP and secure HTTP," but able to provide additional services to DCE sites, according to Goldstein. Microkernel Unification -- from the OSF, Hitachi, HP and IBM -- is a technology for building cross-platform databases and other applications by writing directly to a standard, common microkernel application programming interface (API). IBM plans to produce a product that is "mostly compliant" with the new specification in the product's first release, and "completely compliant" in its second release, Goldstein noted. Digital Equipment Corp. might also be participating in the Microkernel Unification specification project, Goldstein reported, adding that he expects to have an answer on this from Digital within a week. >From the OSF's Open Software Mall, users will be able to browse, download, and comment on software executables and software, documentation plans, design documentation, specifications, and commentary in hypertext format, according to Goldstein. The Web mall will also provide Web links to "relevant products, services, education and consulting available from the community," he told the teleconference participants. Java, DCE Web, and Microkernel Unification will each have their own Web stores on the Open Software Mall's ATO (Advanced Technology Offering) Plaza. ATOs are software technology projects, which may or may not lead to productization, where participants seek to minimize risk by obtaining feedback from users, noted the OSF's Peter Shaw. ATO development costs typically range from $300,000 to $600,000. For ATO technologies that become productized, licensing rights are estimated at $25,000 per licensee. The OSF also sponsors other vendor efforts, known as PSTs, in which vendors are closer to "productization" of their work, and development costs tend to be higher, said Shaw. Current PSTs include DCE 1.2 and Motif/CDE (Common Development Environment). In addition, four potential PSTs are "being actively pursued," Shaw maintained. "We expect to have some announcements on these later this week," he added. The PSTs will also be given their own area on the Open Software Mall, to be known as PST Plaza. Aside from the stores for Java, DCE Web, and Microkernel Unification, the ATO Plaza will also include "Web pages for a potpourri of (other) ATOs," according to Goldstein. Additional areas of the Open Software Mall will include "Research Plaza," the Motif/CD Store, and areas for tools, training, and consulting. The mall will officially open next Monday, Goldstein said. Initial offerings will include an explanation of its goals and activities, and the opportunity for user commentary. The mall will be accessible from a pointer at http://www.org.com . (Jacqueline Emigh/19950726/Reader Contact: Open Software Foundation, 617-621-8700; Press Contact: Jane Smeloff, OSF, 617-621-8997)

2 1

Quicken's new version
by Christopher Smith 17 Dec '03

17 Dec '03

If I am out of place for posting here, forgive me; however, I do believe this germane. Compass Bank here in Alabama is joining twenty other banks around the country to offer dial-in banking via Quicken's new software release. Does anyone know or have heard of the security mechanisms which are to be built in to this product, specifically authent and encryption?

2 1

New release (v1.3) of CFS Unix encrypting file system now available
by Matt Blaze 17 Dec '03

17 Dec '03

Source code for the latest version (release 1.3) of CFS, the Cryptographic File System, is now available upon request for research and experimental use in the US and Canada. CFS pushes encryption services into the Unix(tm) file system. It supports secure storage at the system level through a standard Unix file system interface to encrypted files. Users associate a cryptographic key with the directories they wish to protect. Files in these directories (as well as their pathname components) are transparently encrypted and decrypted with the specified key without further user intervention; cleartext is never stored on a disk or sent to a remote file server. CFS employs a novel combination of DES stream and codebook cipher modes to provide high security with good performance on a modern workstation. CFS can use any available file system for its underlying storage without modification, including remote file servers such as NFS. System management functions, such as file backup, work in a normal manner and without knowledge of the key. CFS runs under SunOS and several other BSD-derived systems with NFS. It is implemented entirely at user level, as a local NFS server running on the client machine's "loopback" interface. It consists of about 5000 lines of code and supporting documentation. You must have "root" access to install CFS. CFS was first mentioned at the work-in-progress session at the Winter '93 USENIX Conference and was more fully detailed in: Matt Blaze. "A Cryptographic File System for Unix", Proc. 1st ACM Conference on Computer and Communications Security, Fairfax, VA, November 1993. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfs.ps.) and in Matt Blaze. "Key Management in an Encrypting File System", Proc. Summer '94 USENIX Tech. Conference, Boston, MA, June 1994. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfskey.ps.) Version 1.3 of CFS also includes ESM, the Encrypting Session Manager. ESM provides shell-to-shell encrypted sessions across insecure links and requires no OS or network support. It is useful for typing cfs passphrases when logged in over the network. ESM needs RSAREF 2.0 to compile and is tested only on SunOS and BSDI. ESM is the first released part of a suite of session encryption tools that are described in Matt Blaze and Steve Bellovin. "Session-layer Encryption." Proc. 1995 USENIX Security Workshop, Salt Lake City, June 1995. (PostScript is available from ftp://research.att.com/dist/mab/sesscrypt.ps) The new version of CFS differs from the version described in the papers in a few ways: * The DES-based encryption scheme has been strengthened, and now provides greater security but with the online latency of only single-DES. * Support for the smartcard-based key management system is not included and a few of the tools are not included. * An impoved key management scheme now allows chaning the passphrase associated with a directory. * The performance has been improved. * The security of the system against certain non-cryptanalytic attacks has been improved somewhat. * User-contributed ports to a number of additional platforms. * Hooks for adding new ciphers. * 3-DES and MacGuffin encryption options. * Timeout options allow automatic detach of encrypted directories after a set time or period of inactivity. CFS is distributed as a research prototype; it is COMPLETELY UNSUPPORTED software. No warranty of any kind is provided. We will not be responsible if the system deletes all your files and emails the cleartext directly to the NSA or your mother. Also, we do not have the resources to port the software to other platforms, although you are welcome to do this yourself. The software was developed under SunOS and BSDI, and there are also unsupported user-contributed ports available for AIX, HP/UX, Irix, Linux, Solaris and Ultrix. We really can't promise to provide any technical support at all, beyond the source code itself. We also maintain a mailing list for CFS users and developers; subscription information is included with the source code. Because of export restrictions on cryptographic software, we are only able to make the software available within the US and Canada to US and Canadian citizens and permanent residents. Unfortunately, we cannot make it available for general anonymous ftp or other uncontrolled access, nor can we allow others to do so. Sorry. Legal stuff from the README file: * Copyright (c) 1992, 1993, 1994 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software is subject to United States export controls. You may * not export it, in whole or in part, or cause or allow such export, * through act or omission, without prior authorization from the United * States government and written permission from AT&T. In particular, * you may not make any part of this software available for general or * unrestricted distribution to others, nor may you disclose this software * to persons other than citizens and permanent residents of the United * States and Canada. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. If you would like a copy of the CFS source code, please read to the end of this message and then send email to: cfs(a)research.att.com DO NOT REPLY DIRECTLY TO THIS MESSAGE. You must include a statement that you are in the US or Canada, are a citizen or legal permanent resident of the US or Canada, and have read and understand the license conditions stated above. Be sure to include an email address in a US- or Canada-registered domain. The code will be sent to you via email in a "shar" shell archive (a little over 300K bytes long).

1 0

http://www2.pcy.mci.net/whats-new/editors/meeks/index.html
by alan pugh 17 Dec '03

17 Dec '03

mostly old news for the readers here, but relevant to the list. this was found at the net editors off of mci's webpage. > > The Assault on Private Encryption > > by Brock N. Meeks > > Washington, DC -- The other shoe has dropped now, several times. > > The political backlash and emotional fallout of the bombing of the > federal building in Oklahoma City still lingers here. FBI Director > Louis Freeh is using that event as a lever to wage a kind of private > war against the use of private encryption schemes. > > According to Administration sources, several different proposals are > now being discussed on how the government might go about implementing > a policy of government mandated, government "certified" encryption. > The most hardline of these proposals would outlaw your ability to > choose an encryption scheme which the government couldn't break, under > the authority of a court order. > > Freeh has left no doubts that his next target -- after successfully > getting Congress to pass the $500 million Digital Telephony Bill, > which gives law enforcement agencies an "easy access" method of > eavesdropping on telephone conversations-- his is private encryption. > > During an appropriations hearing in May, Freeh told a congressional > panel: "[W]e're in favor of strong encryption, robust encryption. The > country needs it, industry needs it. We just want to make sure we have > a trap door and key under some judge's authority where we can get > there if somebody is planning a crime." > > That means an end any non-government approved encryption technology > that doesn't have some means of providing the Feds with it's treasured > "back door." Under this scheme, for example, the widely-used Pretty > Good Privacy (PGP) encryption program would be, essentially, illegal > to own or at least, illegal for a U.S. citizen to use inside U.S. > borders. > > Private encryption schemes allow a person to scramble an electronic > message so that, if intercepted by an unintended party, it is rendered > unreadable. These scrambling programs are useful to a wide range of > people and interests, including researchers that want to keep their > proprietary breakthroughs safe from prying eyes to corporations > sending trade secrets to a distant office across the Net to ordinary > folks sending a steamy love letter to a lover. > > But these same encryption programs are being used by "terrorists and > international drug traffickers," as well, claims FBI Director Freeh, > and that makes private encryption schemes a threat to national > security. > > Freeh's crusade against encryption is being backed by been joined the > Justice Department, with the gleeful back alley goading of the > nation's top spook group, the National Security Agency. > > To meet the "challenges of terrorism," Freeh said, several things must > be done, among them, deal with "encryption capabilities available to > criminals and terrorists" because such technology endangers "the > future usefulness of court-authorized wiretaps. This problem must be > resolved." > > While Freeh has used the Oklahoma City bombing as convenient "news > hook" to again make a pitch to "resolve" the private encryption > "problem," the Director was basically reading from a dog-eared script. > Within the last several months he has repeatedly testified publicly > before Congress about the "evils" of encryption. > > On March 30 the House Judiciary Committee's Subcommittee on Crime he > said: > > "Even though access is all but assured [by the passage of the Digital > Wiretap Act] an even more difficult problem with court-authorized > wiretaps looms. Powerful encryption is becoming commonplace. The drug > cartels are buying sophisticated communications equipment.... This, as > much as any issue, jeopardizes the public safety and national security > of this country. Drug cartels, terrorists, and kidnappers will use > telephones and other communications media with impunity knowing that > their conversations are immune from our most valued investigative > technique." > > Then during a May 3 appearance before the same Committee, Freeh said: > "Encryption capabilities available to criminals and terrorists, both > now and in days to come, must be dealt with promptly. We will not have > an effective counterterrorism strategy if we do not solve the problem > of encryption." > > But there's nothing to be alarmed at here, according to Freeh. Just > because he's asking the Congress and the White House to strip you of > the right to choose how you scramble your messages, using a program > that the government doesn't hold all the keys too, doesn't mean that > the Director isn't a sensitive guy or that he has suddenly taken a > liking to wearing jackboots. > > Freeh steadfastly maintains all these new powers he's asking for are > simply "tools" and "not new authorities." These new powers are "well > within the Constitution," Freeh told Congress. > > Freeh hasn't publicly outlined just how he proposes to "resolve" the > "encryption problem." However, according to an FBI source, several > plans are in the works. The source refused to detail any specific > plan, but added: "Let's just say everything is on the table." Does > that include outlawing private encryption schemes? "I said > 'everything,'" the source said. > > The encryption debate has been raging for years. Two years ago the > Clinton Administration unveiled a new policy in which it proposed to > flood the market with its own home-grown encryption devices -- a > product of the National Security Agency -- called the "Clipper Chip." > > The Clipper is based on a "key-escrow" system. Two government agencies > would hold the keys "in escrow", which are unique to each chip, in a > kind of "data vault." Any time the FBI-- or your local sheriff -- > wanted to tap your phone conversations, they would have to ask a judge > to give the two government agencies to turn over the keys to you > Clipper chip. With those keys, the FBI could then unscramble any of > your conversations at will. > > That policy raised a huge firestorm of controversy and the Clipper > sunk from sight, down, but not out. The intent of the White House, > acting as a front man for the NSA and other intelligence agencies > along with the FBI, was to have Americans adopt Clipper voluntarily

1 0

Re: The Net (short movie review)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 3:04 AM 7/29/95, Joel McNamara wrote: >Don't bother. Better to wait until it hits the video shelves then have a >party and see who can find the most (of many) technical flaws and gaffs. >Would be much more entertaining in that context. Agreed. In television interviews Ms. Bullock talks about how she's "on the net all the time" while in further conversation it's clear that all she does is hang out in AOL auditoria and chat-rooms, probably with some net.flack at her elbow.... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Banks and Crypto - Again
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> Critics say that the longer DES is used, the more likely its code > could be broken. While realizing this could limit its life span > as a government certified standard, ABA warned that requiring banks > to convert to a new standard by 1998 (the year DES's certification > expires) could be prohibitively costly due to the high level of > electronic funds transfers secured by DES. ABA therefore encouraged > the National Institute for Standards and Technology (NIST) to > continue to endorse DES as a Federal Information Processing Standard > (FIPS) for use by the financial community. "Breaking DES keys in a reasonable amount of time could be prohibitively costly for Banks due to the high level of electronic funds transfers secured by DES." andrew

1 0

Re: Java, Netscape, OpenDoc, and Babel
by Rich Salz 17 Dec '03

17 Dec '03

>Just a quick note to chime in. The OSF just did a deal with Sun >to port Java to several platforms. The OSF is opening a "web mall" >where you can grab software objects and run them. Well, not quite. The "Open Mall" is part of OSF's new advanced technology offerings. Free source for non-commercial use, fetchable from the Open Mall, a Web server. You'll be able to find the mall (in a week or two) from OSF's home page, http://www.osf.org/. The Java ATO includes ports to SVR4 (dunno whose) and HP, and more importantly, a study of the security aspects and implications of Java: is it truly a "safe" language to write in? And what does safe mean, and for whom (server, client, user, hardware, etc)? The study will be a paper, also avail from the mall. See http://www.osf.org/comm/press/950276-ato.html for mroe details. /r$

2 1