December 2003 - cypherpunks-legacy

RE:NRC Panel, Law Enforcement questions
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Hello Jim, I apologize that I didn't answer immediately. I have subscribed to several mailing lists and sometimes get some hundred mails a day. I don't have the time to read everything and therefore I have to select. I didn't read this thread, but I found it in my archives. > I wonder, and perhaps my kind friend Hadmut can help me here, if there is > an English translation of any and all Nazi-era German laws/regs regarding > cryptography. As I [dimly] recall, Enigma was born as a private enterprise > and the patent was only later taken over by government and classified after > it was offered for sale to businesses (without much luck). These laws, if > they exist, might make for interesting reading in side-by-side comparison > with either Sen. Grassley's latest proposals, or with anything regarding > cryptography coming from our paranoid FBI director. I fear I have to disappoint you. :-( First of all I don't know of any english translation of such laws. The only english translation of law I know about is the translation of our current basic law. It might be easier to find english translations in english or american libraries than in german libraries. Second, I don't know whether they had a certain law about cryptography. AFAIK Enigma was a commercial product first and was taken over by the government. But I don't know they way they did. Third, there was no need to have laws. I don't want to restart the discussion, but the Nazis didn't understand laws as so important. I have read a book about their justice some time ago. The 'idea' and the 'public feeling' was seen as more important than laws. But perhaps another telecommunication law may be interesting. It was forbidden to receive foreign radio senders. If they came into the house and the radio was tuned to foreing frequencies, you got into serious trouble. I just don't know where to find the text of the law. regards Hadmut

1 0

Re: Java, Netscape, OpenDoc, and Babel
by strick at Jihad 17 Dec '03

17 Dec '03

> But in which framework or language, given the profusion of frameworks and > languages? > > We had some TCL advocates a while back (Strick, Hal...)...any reaction to Java? TCL solved my specific problem at that time. Unfortunately I haven't studied Java. PM's comments (as usual) intrigue and bother me; I need to study it. TCL's biggest problem is that it's slow -- it's designed to be used in the parts where speed doesn't really matter -- and it sounds like java sovles that. Perry -- do you have the same basic objection to Safe-TCL that you do do to Java? I would think so. strick > And so it goes. > > --Tim May

3 2

to usura
by NSA Spook 17 Dec '03

17 Dec '03

usura cfs coming send note to list if you receive

1 0

to usura
by Chris Brenton 17 Dec '03

17 Dec '03

Original-From: NSA Spook <remailer(a)spook.alias.net> Original-Date: Fri, 4 Aug 1995 10:37:00 -0500 >usura >cfs coming >send note to list if you receive Thank you for posting this to the list. I needed some more useless mail...

1 0

NIST/NCSSC National Information Systems Security Conference
by droelke＠spirit.aud.alcatel.com 17 Dec '03

17 Dec '03

A couple of days ago I got a booklet about the "18th National Information Systems Security Conference (formerly the National Computer Security Conference) " being held October 10-13 in Baltimore. Just a little excerpt about it: One of the tracks is "The Internet and Beyond" Several of the sessions look rather interesting. The "Management and Administration" track includes at least two sessions by D. Denning of Georgetown Univ. One of them is "Legalities: Will Encryption Keep Out Hackers" and the other is "Critical Factors of Key Escrow Encryption Systems". The first of those has a panel of S. Bellovin of AT&T, M. Higgins of DISA, S. Kent of BBN, and E. Spafford of COAST. So, is this a converence that is really worth something, or something that the management heads might learn something at? ;-) I guess that ordering my personal set of the Rainbow books gets me on more lists than I thought :-) Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX http://spirit.aud.alcatel.com:8081/~droelke/

1 0

Re: Java and Safe-TCL security
by Hal 17 Dec '03

17 Dec '03

The safe-tcl mailing list has not been active for a few months. I think a lot of interest has transferred to Java. One problem is that safe-tcl was oriented around email, so it lacks facilities for accessing web pages. I agree with Ray that the security of safe-tcl leaves something to be desired. I implemented a safe-tcl mail filter which would automatically run incoming mail scripts which were in safe-tcl format. This would be a generalization of a remailer, so that users could write scripts which would determine when the remailing would occur, etc. However I ran into a number of problems, particularly related to persistent storage (e.g. disk file access). This is a hard problem for a "safe" system to solve. One solution is to just forbid it, but beyond that you need to have rules about how much disk space a script can use, whether they can access each other's space, etc. There are some nice applications if they can do so, for example the telescript model where two software agents come together and exchange some information. Another tricky issue is if you are going to let the script talk to the outside world via email or tcp connections. How do you prevent abuse of this feature (sending junk email, or connecting to a web page and entering bogus data into a form)? But again, without this capability the script is pretty much limited to drawing pretty pictures on your screen, which isn't very useful. Here is one message I sent to the safe-tcl list earlier this year describing some of these problems in a little more detail. Note that there were also several bugs in the implementation which left security holes, things being checked in the wrong context and such. This is similar to what Ray was citing. Hal > From owner-safe-tcl(a)CS.UTK.EDU Fri Feb 10 22:30:35 1995 > X-Resent-To: safe-tcl(a)CS.UTK.EDU ; Sat, 11 Feb 1995 01:22:02 EST > Date: Fri, 10 Feb 1995 22:21:28 -0800 > From: Hal <hfinney(a)shell.portal.com> > To: safe-tcl(a)CS.UTK.EDU > Subject: setconfigdata and delivery time > Status: R > > The spec appears to allow delivery-time scripts to do setconfigdata. > This is a mechanism for a script to store persistent data. One application > would be a telescript-like interaction between scripts. Some data could > be stored by one script and later read by another. More interesting, a > script could even store some script, perhaps some or all of itself, into this > persistent store. That script could then be read and eval'd by a later > script. This way scripts could in effect call subroutines in each other, > providing somewhat similar functionality to telescript's procedure calls > between agents. > > At activation time the user gets asked whenever a script does > getconfigdata, although oddly not when a script does setconfigdata. > Also, the .safetcl.conf file is written on any getconfigdata after the > user has supplied or confirmed a database value. This will have the > side effect of writing out any setconfigdata values which have been > previously set by the script. > > At delivery time the current implementation will not ask the user since > there is no user to ask, which causes the writing out of the config data > base never to happen. So there is actually no way for a delivery time > script to set a persistent value right now. It would be easy to change > the code to allow delivery time scripts to set persistent values with > setconfigdata. > > However, this does open up a possible avenue for abuse. There is > presently no limit on how much data is written with setconfigdata. And > actually if the idea above were used where scripts put themselves into > the database for later running then the database could legitimately be > quite large. The problem would arise if a script abused this capability > by filling the disk with junk database entries. > > Maybe something is needed analogous to AutoConfirmMailHook to determine > whether a given SafeTcl_setconfigdata should be able to go out to the > disk. It would want to be given the data as input and possibly also > the size of the current database. Maybe there should be a counter of how > many times the current script has written to the database (or perhaps the > hook could retain this information itself). > > Two other points: as mentioned before the use of the database to retain > "system" information conflicts with its use for this purpose. If > database entries like "mailer" or "external-site" are changed and saved > to .safetcl.conf, that could break later invocations of swish. I think > this system data should be somewhere else (or else there needs to be > another form of persistent store for scripts). > > Secondly, the code right now checks the SafeTcl_evaluation_time > variable in the restricted interpreter to decide whether it should ask > the user. This is not reliable as the untrusted script could change > SafeTcl_evaluation_time. In other places the code checks > SafeTcl_InterfaceStyle and if it is empty then it doesn't ask. That > seems safer. > > Hal Finney > hfinney(a)shell.portal.com

2 1

PC E-cash (NewsClip)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Secret Service Says Student Used PC To Print Money Lubbock, Tex., Aug. 3 -- PC graphics programs have come a long way since their inception, but not far enough to fool the Secret Service. That's what a Texas Tech student tried to do when he used his personal computer to print counterfeit money, according to Secret Service agents. "He really put his whole heart and soul into it," according to Lubbock, Texas Secret Service Resident Agent David Freriks. Freriks said the man is an engineering student at Texas Tech, but told agents he plans to change his major to computer science. The 20-year old student hasn't been identified by name since he hasn't been formally charged yet, according to Freriks. But officials apparently aren't concerned that he will flee. "At this point, he's more afraid of his dad than anything," said one agent. Freriks said the Pakistani national, who resides in affluent southwest Lubbock, scanned a real $50 bill into his PC, then printed the image to an Epson inkjet color printer. Agents said the money looked real at a distance but up close the designs were blurred, the coloration was faulty, and the paper was slick and didn't have a watermark strip. Freriks said agents are confident that all of the approximately $3,300 that was circulated has been recovered except for about $1,000 which he said he is sure will show up eventually, since the quality makes it easy for bank employees to spot. ... Investigators seized the home computer, printer and scanner from the student's home. They said they also found a suitcase containing almost $260,000 in fake $50 bills. --

1 0

Re: Object Oriented Crypto API
by Hal 17 Dec '03

17 Dec '03

I enjoyed Ray's message about the crypto library interface. I haven't had time to study it closely, but I have a couple of quick comments: I thought Wei's library looked pretty easy to use already. Maybe Ray could show an example of what would be needed with Wei's library to do some "typical" crypto function, say encrypting a message with someone else's RSA key. Then we could compare it with how the same function would look with Ray's proposed interface. The other point is that there needs to be the ability to encrypt only a bit of a message at a time. Particularly with public key the first message may be special in that it generates a session key which is used for the remainder. So an interface for piecewise encryption and decryption is necessary. I hope we will see more discussion about the library. Hal

3 2

House Adopts Exon-Like Speech Crimes, Also Adopts Cox/Wyden Amendment
by ACLUNATL＠aol.com 17 Dec '03

17 Dec '03

8/4/95 ACLU Cyber-Liberties Alert: House Adopts Exon-Like Speech Crimes, Also Adopts Cox/Wyden Amendment --------------------------------------------------------- At 9:10 am today, the House of Representatives voted to adopt an omnibus "Managers Amendment" to the telecommunications bill (HR 1555), which included new Exon-like speech crimes that would censor the Internet. At 11:58 am, the House of Representatives voted 420 to 4 to adopt the Cox/Wyden amendment to the telco bill. The Cox/Wyden amendment, however, was not designed to -- and does not -- affect the Exon-like speech crimes provisions added to the telco bill by the House. Speech Crimes Provisions in Managers Amendment: The Managers Amendment containing the new speech crimes provisions also contained some forty other unrelated amendments. The Exon-like provisions were not a focus of the debate, and it is likely that most members cast their votes for reasons unrelated to these provisions. The Managers Amendment adds an entirely new Exon-like provision to the existing federal obscenity laws. The provision would make it a crime to "intentionally communicate by computer ... to any person the communicator believes has not attained the age of 18 years, any material that, in context, depicts or describes, in terms patently offensive as measured by contemporary community standards, sexual or excretory activities or organs." (18 U.S.C. 1465) This provision, like the Exon amendment passed by the Senate, would effectively reduce all online content to that which is suitable only for children. It also raises the same questions about service provider liability that were raised by the Exon amendment. The Managers Amendment would also make it a crime to "receive" prohibited material "by computer," thereby subjecting both Internet users and service providers to new prosecutions (18 U.S.C. 1462). Assuming that the House telco bill (HR 1555) is approved (which is highly probable by 3 pm today), both the House and Senate versions of the telco bill will include severe attacks on cyber-liberties. Cox/Wyden Amendment: The ACLU has supported the general approach of the Cox/Wyden amendment because it prohibits FCC regulation of content on the Internet and generally supports private sector initiatives, not government censorship, on cyberspace. As the ACLU has said before, there are several ambiguities and some real problems with the Cox/Wyden amendment. The two sponsors have committed to working with us on resolving the problems. (See previously posted ACLU Online Analysis of the Cox/Wyden Bill.) ----------------------------------------------------------- For the online community to take comfort in what is done in the final telco bill in the conference committee, at a minimum the following must occur: 1. The Senate's Exon/Coats amendment (the Communications Decency Act) must be rejected -- that is, deleted from the bill, not merely modified in some way. 2. The House's Exon-like speech crimes amendment must be rejected -- that is, deleted from the bill, not merely modified in some way. 3. The ambiguities and problems in the Cox/Wyden amendment must be resolved and then the Cox/Wyden amendment as modified should be included in the telco bill. The ACLU urges all those who care about free speech and personal privacy to focus their energized efforts on all three fronts of the fight. The ACLU will continue to fight all aspects of the cyber-censorship battle, including the Exon-like speech crimes provisions just passed by the House, the Exon/Coats amendment in the Senate, the Dole/Grassley anti-computer pornography bill, the Grassley anti-electronic racketeering bill, and the Feinstein anti-explosives information amendment to the counter-terrorism bill.

2 1

Re: PRA_fix
by rah＠shipwright.com 17 Dec '03

17 Dec '03

> 8-4-95. NYPaper: > > > "A Contract Is Awarded To Improve Navigation." [snip] > The geosynchronous satellite would radio a correction > factor back to planes in flight, or any other user. The > plane would also receive signals from the G.P.S. > satellites, calculate a position, apply the correction > factor and fix its location. This is called an active location system, and it was originally disigned by G.K. O'Neill (The Princeton Physics Prof., Space Studies Institute founder, the guy who came up with all those spiffy space-settlement ideas in the late seventies -- see Babylon 5 for a picture ;-) -- and the inventor of the mass driver, among other things), under the name of Geostar, in the early 1980's. It's accuracy was supposed to be 6 inches in 2 dimensions, and 6 feet in 3 diminsions. The FAA didn't like it because they didn't invent it, the DOD hated it because they wanted to commercialize GPS and they didn't want anything so accurate for civilian purposes. The transponders were going to be beensy little things about the size of pagers relying on high-energy burst transmissions. ObCrypto/Privacy: It relied on a fast computer on the ground to calculate where you were, it allowed short messages, and presumably it was going to send them in the clear. It also had a "panic" button function, where someone in trouble could summon help no matter where they were. ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1