December 2003 - cypherpunks-legacy

The Information Silk Road
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 29 Aug 1997 13:18:43 -0400 (EDT) To: e$(a)thumper.vmeng.com Subject: The Information Silk Road Cc: rah(a)shipwright.com, "R. Jason Cronk" <rjasonc(a)pobox.com> From: Ted Anderson <ota+(a)transarc.com> Sender: <e$(a)vmeng.com> Precedence: Bulk List-Software: LetterRip 2.0 by Fog City Software, Inc. List-Unsubscribe: <mailto:requests@vmeng.com?subject=unsubscribe%20e$> List-Subscribe: <mailto:requests@vmeng.com?subject=subscribe%20e$> -----BEGIN PGP SIGNED MESSAGE----- Subject: The Information Silk Road In this note I criticize recursive auction markets as a good model for the global market in public information. Instead I suggest an agent based model where data merchants compete to be suppliers of information to clients based almost entirely on value they above and beyond the value of the information itself. I ignore issues of data ownership and data privacy. I realized that e$ is perhaps not the best forum for this message and welcome redirection to a more appropriate venue. The Information Silk Road I would like to draw a distinction between trading in digital services and trading information. There are interesting proposals to use market-based mechanisms to manage computer resources such as memory and CPU cycles[1] or network bandwidth[2]. Attempts have been made to extend this idea to trading information, such as the recursive auction market[3]. While the similarities between computer resources and the material world are close enough to make market-based ideas quite successful, I don't think the same is true for markets in information. Differences stem from the fact that information can be copied with perfect fidelity and essentially zero cost while both physical commodities and computing resources are strictly limited in quantity. - From another point of view, the problem is that the responsibilities of ownership are different. Market-based mechanisms work by clearly identifying an owner for each resource. The owner (in computational contexts this is usually a software agent) then tries earn enough income from its asset to pay expenses. The job of the owner is then to avoid overuse (the tragedy of the commons problem) and underuse. However, with information, overuse is impossible (maximizing the use of information is actually beneficial to general good) and only underuse is a risk. Underuse of information can even lead to a problem not shared with other limited commodities, it may be lost altogether. Practically speaking there is another difference between computer resource commodities and information products. For example, any memory page can be sold to a software agent and numerous agents will compete for a fixed pool of identical pages. However, while I can endlessly replicate a piece of information, each customer won't need more than one of each datum. While different agents may occasionally request the same piece of information, this is often rare. Partly this is because a even small cache near the customer will mean that the server only gets a single request from each cache miss, not from each customer request. Therefore, an information seller must stock a huge selection of data and only expect a very tiny fraction of them to be to be in high demand. Still, I would like to see both the digital silk road (markets for computer services) and the information silk road (markets for data) built. I am particularly interested in the design of the data merchants that will be the traders on the information silk road. Recursive Auction Market A useful contribution of the recursive auction market idea is that it denigrates to concept of information ownership. While ownership of information may still be useful to prevent valuable information from disappearing altogether (by being replaced in every supplier's inventory by more profitable data) it has nowhere near the standing of ownership of finite commodities. The recursive auction market idea assumes that data in high demand would propagate from suppliers or intellectual property producers, through intermediate distributors, to consumers as fast as the network could carry it. At each stage the data is auctioned to the highest bidder who must factor into his bid price the network transfer charges[2] and his ability to further resell it. As the data is distributed, the rarity premium available to early sellers disappears, leaving only the basic network delivery costs. These auctions require multiple simultaneous buyers. However it would seem that this would be a very unusual case. Except for a few extreme cases, the market for data will consist of multiple buyers spread out in time. This means that a significant expense of the seller is for the storage of the data between buyers. This storage rental must be factored into the data's price. This is a hard cost that depends on the interval between requests of each piece of data. Rarity, and the premium it adds to the price, is usually an ephemeral, even self-defeating, property of data. This suggests that an auction is not a good general paradigm to use for trading information. Data Merchants A better model of the information silk road has a large population of data merchants spread throughout the network. Their mission is to maintain an inventory of data in anticipation of being able to resell it profitably at a later time. Viewed individually these data merchants provide a data caching service. While viewed collectively, the information silk road is a replicated data storage facility[4]. So what services can a data merchant offer which customers might be willing to pay for. In other words, how can they add value. Locality. Assuming some distance (as the packets fly) sensitivity to network transport charges, data will be cheaper from a local supplier than from a distant one. This means that a merchant can pay the transport charges to obtain the distant data once and attract local buyers by charging less than it would cost them to fetch it from a remote source. As long as there are multiple local buyers and the data storage costs incurred between requests is small compared to the differential between remote and local network transport charges then the local vendor can turn a profit. Authoritativity. For small data, where the cost of transferring the data is comparable to the cost of requesting it, it will be useful for a client to pass its requests to a single merchant and expect a high probability of obtaining the data. Without consulting an authoritative source the client will potentially have to contact many merchants before finding the data it seeks. Unless the data is large this cost may dwarf the actual transfer cost. Being an authoritative source does not have to be a global property, but might apply to narrowly defined types of data: hostname to IP address mappings, perl scripts, or Cypherpunks messages. Being authoritative depends upon the data merchant maintaining a persistent reputation. Interestingly an authoritative source doesn't actually have to store any data, it may operate purely as a locator service. Speed. Some data merchants may strive to provide data rapidly but spending more on rotating media, doing more aggressive prefetch and caching, and having bigger servers and network connections. For some customers and some data, paying a premium for speed could be quite desirable. Anonymity. Guaranteeing privacy for a client's requests could be an attractive option. This is an other feature that would depend upon the merchant maintaining a good reputation. [1] Mark S. Miller and K. Eric Drexler, "The Agorics Papers", http://www.webcom.com/~agorics/agorpapers.html. [2] Norman Hardy and Eric Dean Tribble, "The Digital Silk Road", http://www.webcom.com/~agorics/dsr.html. [3] http://www.transarc.com/~ota/RecursiveAuctionMarket.txt [4] eternity data storage service -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNAcEPgGojC9e/wyBAQE0QAP+IGeBTV4WAOG2IlP+ACh8PXShQdAe4bph 4HNPZt6HD8shdHrqgbtl4j1GXOa9VLrYtuhgoPdLAFQHTz/W3jQ+eVVJoCwUsQ0a oMYJB2gwSbRB7jFzTaWNE8n3DO42m49SPiys3jCuAg2GSteA+ar9cLWNIPClqLWw 8jkrjKjP7MI= =PltB -----END PGP SIGNATURE----- --------------------------------------------------------------------- Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk --------------------------------------------------------------------- Like e$? Help pay for it! See <http://www.shipwright.com/beg.html> Or, for e$/e$pam sponsorship, <mailto:rah@shipwright.com> --------------------------------------------------------------------- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

NIST Escrow Papers - Now Web Available
by Joel McNamara 17 Dec '03

17 Dec '03

Several of the scanned hand-outs (courtesy of John Young) for the NIST September 5 workshop on key escrow are now available on my Web page: http://www.eskimo.com/~joelm Papers include: The outlines of meeting topics of Raymond Kammer of NIST and Michael Nelson of the White House. (KAMMER.TXT - 7kb) Discussion Paper No. 4, "Example Potential Solutions for the Draft Export Criteria for Software Key Escrow Encryption," which offers example solutions for each of the ten criteria. (CRITERIA.TXT - 7kb) The Business Software Alliance's dissenting blast at the government's key escrow proposal and export limit. This paper was loudly applauded. (BSA.TXT - 19kb) Trusted Informations Systems's "Thoughts on the NIST Escrow Issues Meeting Discussion Papers." (TIS.TXT - 27kb) TECSEC Incorporated's "Private Escrow Key Management: A Method and its Issues." (TECSEC.TXT - 13kb) Dorothy Denning's "Comments on Draft Criteria for Software Key Escrow Exportability" and "Comments on Issues for Key Escrow Agents." (DENNING.TXT - 8kb)

1 0

ON OFF-TOPIC
by gjeffers＠socketis.net 17 Dec '03

17 Dec '03

ON OFF-TOPIC THE UNITED STATES "FEDERAL" GOVERNMENT HAS NO LEGITIMACY! CRYPTO CODERS SUPPLY THE MEANS! CONSPIRACY THEORISTS SUPPLY THE MOTIVATION! conspiracy theorist = alternative political theorist NOT= AP/ABC/CBS/NBC/CIA/FBI/U.S GOV'N./New York Times/Washington Post opinion moulders syndicate "extremist right-wing kook" = old fashioned American patriot Left term used often by left-wing extremist liberal statist kooks. The United States "Federal" Government - we'll be even more American without it. PUSH EM BACK! PUSH EM BACK! WWWAAAYYYY BBBAAACCCK! BBBEEEAAATTTT STATE!

9 12

Usenix symposium on crypto applications
by Rich Salz 17 Dec '03

17 Dec '03

Newsgroups: comp.org.usenix,comp.org.uniforum,comp.org.sug,comp.unix.admin,comp.unix.large,comp.org.decus,comp.security.unix Path: paperboy.osf.org!bone.think.com!blanket.mitre.org!agate!spool.mu.edu!howland.reston.ans.net!tank.news.pipex.net!pipex!in2.uu.net!usenix!toni >From: toni(a)usenix.org (Toni Veglia) Subject: 6th USENIX UNIX Security Symposium - Call-for-Papers Message-ID: <DEI0Mp.4L7(a)usenix.org> Reply-To: toni(a)usenix.org (Toni Veglia) Organization: USENIX Association, Berkeley, CA Date: Wed, 6 Sep 1995 19:25:37 GMT Lines: 218 Xref: paperboy.osf.org comp.org.usenix:3623 comp.org.uniforum:20 comp.org.sug:940 comp.unix.admin:33851 comp.unix.large:1699 comp.org.decus:6147 comp.security.unix:19702 Announcement and Preliminary Call for Papers 6th USENIX UNIX Security Symposium Focusing on Applications of Cryptography July 22-25, 1996 Fairmont Hotel San Jose, California Sponsored by the USENIX Association, the UNIX and Advanced Computing Systems Professional and Technical Association Co-sponsored by UniForum (pending) In cooperation with: The Computer Emergency Response Team (CERT), and IFIP WG 11.4 Important Dates Dates for Refereed Paper Submissions Extended abstracts due: Mar 19, 1996 Program Committee decisions made: Apr 15, 1996 Camera-ready final papers due: June 10, 1996 Registration Materials Available: End April 1996 Program Committee Program Chair: Greg Rose, Sterling Software. Fred Avolio, Trusted Information Systems, Inc. Steve Bellovin, AT&T Bell Laboratories Brent Chapman, Great Circle Associates Diane Coe, Mitre Ed DeHart, CERT Dan Geer, Open Market Inc. Peter Gutmann, University of Auckland Kent Landfield, Sterling Software Clifford Neuman, Information Sciences Institute Avi Rubin, Bellcore Eugene Spafford, COAST Laboratory, Purdue University Ken van Wyk, Defense Information Systems Agency Karen Worstell, The Boeing Company Readers: Matt Bishop, U.C. Davis; Phil Karn, Qualcomm Overview The goal of this symposium is to bring together security and cryptography practitioners, researchers, system administrators, systems programmers, and others with an interest in applying cryptography, network and computer security, and especially the area where these overlap. The focus on applications of cryptography is intended to attract papers in the fields of electronic commerce and information processing, as well as security. Please note that papers about new cryptographic algorithms are not solicited; however new applications are. This will be a four day single track symposium with tutorials, refereed and technical presentations, and panel discussions. Tutorials will take place the first two days followed by two days of technical sessions. Tutorials July 22-23 Tutorials for both technical staff and managers will provide immediately useful, practical information on topics such as local and network security precautions, what cryptography can and cannot do, security mechanisms and policies, firewalls and monitoring systems. Technical Sessions July 24-25 In addition to the keynote presentation, the technical program includes refereed papers and invited talks. There may be panel sessions. There will be Birds-of-a-Feather sessions and Works-in- Progress Reports on two evenings. You are invited to make suggestions to the program committee via email <security(a)usenix.org>. Papers that have been formally reviewed and accepted will be presented during the symposium and published in the symposium proceedings. Proceedings of the symposium will be published by USENIX and will be provided free to technical session attendees; additional copies will be available for purchase from USENIX. Symposium Topics Presentations are being solicited in areas including but not limited to: *Anonymous transactions *Applications of cryptographic techniques *Attacks against secure networks/machines *Cryptanalysis and codebreaking as attacks *Cryptographic tools *Electronic commerce security *Firewalls and firewall toolkits *Legislative and legal issues *Case studies *Computer misuse and anomaly detection *File and File system security *Network security *Security and system management *Security in heterogeneous environments *Security incident investigation and response *Security tools *User/system authentication *Penetration testing *Malicious code analysis Note that this symposium is not about new codes or ciphers, or cryptanalysis for its own sake. How to Submit a Refereed Paper Submissions must be received by Mar 19, 1996. Authors are encouraged to submit an extended abstract which discusses key ideas and demonstrates the structure of the finished paper. Extended abstracts should be 3-5 pages long (about 1500-2500 words), not counting references and figures. The body of the extended abstract should be in complete paragraphs. The object of an extended abstract is to convince the reviewers that a good paper and presentation will result. Full papers can be submitted if they are complete in advance of the date. Full papers should be 8 to 15 typeset pages. Authors will be notified of acceptance on April 15, 1996. All submissions will be judged on originality, relevance, and correctness. Each accepted submission will be assigned a member of the program committee to act as its shepherd through the preparation of the final paper. The assigned member will act as a conduit for feedback from the committee to the authors. Camera-ready final papers are due June 10, 1996. Please accompany each submission by a cover letter stating the paper title and authors along with the name of the person who will act as the contact to the program committee. Please include a surface mail address, daytime and evening phone number, and, if available, an email address and fax number for the contact person. If you would like to receive detailed guidelines for submission and examples of extended abstracts, you may send email to: securityauthors(a)usenix.org or telephone the USENIX Association office at +1 510 528 8649. The UNIX Security Symposium, like most conferences and journals, requires that papers not be submitted simultaneously to another conference or publication and that submitted papers not be previously or subsequently published elsewhere. Papers accompanied by "non-disclosure agreement" forms are not acceptable and will be returned to the author(s) unread. All submissions are held in the highest confidentiality prior to publication in the Proceedings, both as a matter of policy and in accord with the U.S. Copyright Act of 1976. Where To Submit Please send one copy of an extended abstract or a full paper to the program committee via each of two, for reliability, of the following methods. All submissions will be acknowledged. o Preferred Method: email (Postscript or ASCII) to: securitypapers(a)usenix.org o Alternate Method: postal delivery to Security Symposium USENIX 2560 Ninth St., Ste. #215 Berkeley CA 94710 U.S.A. Phone: +1 510 528 8649 o Fax: +1 510 548 5738 Registration Materials Materials containing all details of the technical and tutorial programs, registration fees and forms, and hotel information will be available at the end of April 1996. If you wish to receive the registration materials, please contact USENIX at: USENIX Conference Office 22672 Lambert Street, Suite 613 Lake Forest, CA USA 92630 +1 714 588 8649; Fax: +1 714 588 9706 email: conference(a)usenix.org Information can also be found under the USENIX Association WWW page URL: http://www.usenix.org

1 0

Website highjacking -- Cybercrime Conf Announcement
by Lynne L. Harrison 17 Dec '03

17 Dec '03

[Apologies for the duplication if the following has already been posted here.] --------------------------- >Approved-By: lewrose(a)ARENTFOX.COM >X-Sender: oceana(a)popserver.panix.com >X-Mailer: Windows Eudora Pro Version 3.0 (32) >Date: Thu, 28 Aug 1997 14:14:25 -0400 >Reply-To: Lawyers and the Internet <NET-LAWYERS(a)PEACH.EASE.LSOFT.COM> >Sender: Lawyers and the Internet <NET-LAWYERS(a)PEACH.EASE.LSOFT.COM> >From: "Oceana Publications, Inc." <oceana(a)PANIX.COM> >Subject: [NET-LAWYERS] Website highjacking -- Cybercrime Conf Announcement >To: NET-LAWYERS(a)PEACH.EASE.LSOFT.COM > >PRESS RELEASE > >AUGUST 18, 1997 > >(Dobbs Ferry, NY) Oceana Publications, Inc. in cooperation with the >University of Florida Centre for International Financial Crimes Studies; >Kroll Associates, Warroom Research LLC; and the National Computer Security >Association announce two international conferences on CYBERCRIME, >ELECTRONIC COMMERCE, CORPORATE, BANK & COMPUTER SECURITY, FINANCIAL CRIMES >AND INFORMATION WARFARE to be held at the Washington, D.C. Omni Shoreham >Hotel on October 29, 30, 31, 1997 and the New York City Hilton on November >17, 18, 1997. > >Discussions by Commissioners from The President's Commission on Critical >Infrastructure Protection (PCCIP) and Leaders of the Manhattan Cyber >Project and WarRoom Research will high-light the upcoming Conferences, >CYBERCRIME, ELECTRONIC COMMERCE, CORPORATE, BANK & COMPUTER SECURITY, >FINANCIAL CRIMES AND INFORMATION WARFARE, to be held at the Washington, >D.C. Omni Shoreham Hotel on October 29, 30, 31, 1997 and the New York City >Hilton on November 17, 18, 1997. > >General Robert T. Marsh, U.S. Air Force (Ret.), Chairman of The President's >Commission on Critical Infrastructure Protection will lead the discussion >of the Commission's work and recommendations. Commissioners Brent Greene >(the DOD Representative), Steve Mitchell (the DOJ Representative) and Dr. >Mary Culnan, Professor of Business Administration of Georgetown University >will be panelists with Gen. Marsh. > >Over fifty faculty members, including Mr. Alan E. Brill, Managing Partner >of Kroll Associates, the world's foremost computer crime investigator, Mr. >Donn Parker, Senior Management Systems Consultant, SRI Consulting, Dr. >Eugene Spafford, Professor of the Computer Science, Purdue University, Dr. >Dorothy Denning, Professor of Computer Science, Georgetown University, Mr. >Winn Schwartau of Security Experts, Inc. And Peter S. Tippett, President of >the National Computer Security Association will speak and lead panel >discussions. Dr. Barry Rider, Director of the Institute of Advanced Legal >Studies, University of London and a Fellow in Law at Jesus College, >Cambridge University will address the connections between the Global Mafias >and Cybercrime. Dr. Rider is recognized as the world's authority on money >laundering, organized crime, banking law and economic crime. Professor >Fletcher N. Baldwin, Jr. of the UF College of Law will address electronic >privacy. > >The Conferences are sponsored by Oceana Publications, Inc. of Dobbs Ferry, >NY, The Centre for International Financial Crimes Studies of the College of >Law of the University of Florida, Kroll Associates, Inc., WarRoom Research >LLC and the National Computer Security Association (NCSA). > >For further information concerning program content, contact Dr. Robert J. >Munro, Conference Program Coordinator and Co-Director of the Centre for >International Financial Crimes Studies, College of Law, University of >Florida, Gainesville, FL 32611, tel: 352-392-0417, fax: 352-392- 8727, >e-mail: munro(a)law.ufl.edu. > >For information on registration, group discounts, exhibitors and vendors >and media, contact Mr. John Downey, Vice President and Director, >International Seminars Division, Oceana Publications, Inc., 75 Main Street, >Dobbs Ferry, NY 10522 USA, tel: 914-693-8100 or 1-800-831-0758, fax: >914-693-0402, e-mail: oceana(a)panix.com. > > > > > > > > >Annual International Conference on >CYBERCRIME, ELECTRONIC COMMERCE, CORPORATE, BANK & COMPUTER SECURITY, >FINANCIAL CRIMES and INFORMATION WARFARE > > Sponsored by Oceana Publications, Inc. > in cooperation with > The Centre for International Financial Crimes Studies, College of Law, >University of Florida; > Kroll Associates, Inc.; > WarRoom Research LLC; > and the National Computer Security Association (NCSA) > >To be held in two locations: > > October 30-31, 1997 > Omni-Shoreham Hotel > Washington, DC > > November 17-18, 1997 > New York Hilton and Towers > New York, NY > >For more information contact Oceana's International Seminars Division >Telephone: 800/831-0758 or 914/693-8100 >Fax: 914/693-0402 >E-mail: oceana(a)panix.com >WEB: http://www.oceanalaw.com (go to seminars subpage) > >DAY 1 (Washington. DC & New York, NY): > >Potholes on the Information Superhighway and Prospects for Crime on the >World Wide Web > >Security in Cyberspace >- Includes: Manhattan Cyber Project Update > >U.S. Government and Legal Perspectives on Cybercurrency & Cybercrime > >Luncheon Address > - Mr. Mark Gembicki & Mr. Steven Shaker > WarRoom Research LLC > >The President's Commission on Critical Infrastructure Protection (PCCIP) > - Threats and Vulnerabilities of Infrastructure > - Global Infrastructure Implications > - Commission Recommendations > - Information Warfare & Assurance > >Banking and Information Security > >DC ONLY: >Keynote Addresses >- Dr. Eugene Spafford, Professor of Computer Science, > Purdue University >- Mr. Donn Parker of SRI Consulting > >Information Warfare & National Security: An Introduction > >NY ONLY: >Plastic Card Fraud, Internet Banking, The Electronic Purse & Smart Cards > >Denial of Service Scenarios: From Meltdown to Survival > >DAY 2 (Washington, DC & New York, NY): > >Corporate Managers: Their Vision of Managing Risk Through the 2000s > >Solutions to International Corporate Espionage and Intellectual Property >Crimes > >Global Electronic Money > >Luncheon Addresses >- (DC & NY) Mr. Michael Zboray, Gartner Group >- (DC only) Mr. Winn Schwartau, Security Experts, Inc. > - (NY only) Mr. William Boni, Intelligence & Information Protection >Services > >The Impact of Technology and Encryption on Domestic & International >Organized Crime > >The Future of Encryption > >None of Your Cyber-Business! Privacy in the Age of the Internet > >Information Warfare, the Threat of an Electronic "Pearl Harbor" and Hackers >as a "National Resource" > >DC ONLY: >Military Intelligence Applications > >NY ONLY: >Security Lessons from the Financial Services Industry >- Effective Management of Security: >- Top-Down/Bottom-Up Accountability and Vision >- The Importance of Having Internal Controls Outside of the Information System >- The Value of Having Multiple Overlapping and Mutually Reinforcing >Security Measures > >Ask about: >*Optional Pre-Conference Institute: Cybercrime and/or Money Laundering >Workshops, Oct. 29th, Washington, DC only. > >Distinguished Faculty include: > >Mr. Robert Ayers, Former Chief of the DOD Intelligence Information System >Computer Security Program; Former Director of the Department of Defense >Defense-Wide Information Systems Security Program > >Professor Fletcher N. Baldwin, Jr., Conference Chairman, S.T. Dell Research >Scholar, Professor of Law & Director of the Centre for International >Financial Crimes Studies, College of Law, University of Florida, >Gainesville, FL > >Mr. William E. Baugh, Currently, Vice President, Information Technology and >Systems Section, SAIC; Former Assistant Director, FBI > >Major Brad Bigelow, U.S. Air Force, Washington, DC > >Mr. William Boni, Manager, Intelligence & Information Protection Services, >Amgen, Thousand Oaks, CA > >Mr. Arnaud de Borchgrave, Director, Center for Strategic and International >Studies, Washington, DC > >Mr. Alan E. Brill, Managing Director, Kroll Associates, New York, NY; Mr. >Brill is an International Authority on the Information Superhighway and >Computer Crimes; Manager of Kroll's Global Information Security and >High-Technology Investigations Group > >Mr. Francis Bunting, Chief, Money Laundering Investigative Unit, Citicorp, >Tampa, FL > >Col. Alan D. Campen, U.S. Air Force (Ret.), Midlothian, VA; Adjunct >Professor, School of Information Warfare and Strategy, National Defense >University, Ft. McNair, Washington, DC > >Mr. Scott Charney, Chief, Computer Crime Division, Department of Justice, >Washington, DC* > >Mr. Jim Christy, USAF, On detail to the Information Protection Task Force, >Federal Bureau of Investigation, Washington, DC > >Mr. Guy L. Copeland, Director, Technology, Computer Sciences Corporation, >Herndon, VA > >Ms. Mary Culnan, Commissioner & Associate Professor, School of Business, >Georgetown University, Washington, DC > >Mr. Kawika Daguio, Electronic Money Specialist, American Bankers >Association, Washington, DC* > >Dr. Dorothy E. Denning, Professor, Computer Science Department, Georgetown >University, Washington, DC > >Mr. Alan Fedeli, Manager, IBM Internet Security Services, Suffern, NY > >Mr. Thomas Firnhaber, FinCEN, U.S. Treasury > >Ms. Susan J. Galli, Vice-President, Office of Legal Affairs, Citibank, >N.A., New York, NY > >Ms. Tatiana Gau, Vice President for Integrity Assurance, America Online, >Dulles, VA; Former Executive Vice President, Parvus International > >Mr. Kenneth M. Geide, Chief, Economic Espionage Unit, Federal Bureau of >Investigation, Washington, DC > >Mr. Mark Gembicki, Executive Vice President, WarRoom Research, LLC, >Baltimore, MD; led collaborative Information Systems Security Survey with >the U.S. Senate's Permanent Subcommittee on Investigations and Present >Project Coordinator of the Manhattan Cyber Project. > >Mr. Brent Greene, Commissioner, Department of Defense Representative, >President's Commission on Critical Information Infrastructure (PCCIP), >Washington, DC > >Mr. Mike Higgins, Assistant Vice President, Science Applications >International Corporation, Center for Information Protection, McLean, VA; >Former Chief, Countermeasures, DISA > >Mr. Steve Katz, Vice President & Chief Information Security Officer, >Citibank, New York, NY > >Ms. Kathleen Kincaid, Director of I/T Security Programs, IBM, Somers, NY > >Mr. Herb Lin, Senior Staff Officer, National Research Council, Washington, >DC > >Mr. Shaun Lonergan, FinCEN, U.S. Treasury, Washington, DC > >General Robert T. Marsh, U.S. Air Force (Ret.), Chairman, President's >Commission on Critical Information Infrastructure (PCCIP), Washington, DC > >Mr. John McClurg, FBI Computer Investigations and Critical Infrastructure >Threat Assessment Center, Washington, DC; Economic Espionage Unit, Federal >Bureau of Investigation, Washington, DC * > >Admiral Michael McConnell, Vice-President, Booze-Allen & Hamilton, McLean, >VA; Adm., U.S. Navy (Retired); Former Director, National Security Agency > >Mr. Bruce McConnell, Co-Chair, Inter-Agency Working Group on Crypto Policy, >OMB, Washington, DC > >Mr. David McMunn, President, McMunn Associates Inc./Borders Unlimited >Corporation, Vienna,VA > >Dr. Robert J. Munro, Conference Co-Chairman and Co-Director of the Centre >for International Financial Crimes Studies, College of Law, University of >Florida, Gainesville, FL > >Mr. Donn Parker, Senior Management Systems Consultant, Information Security >Program, SRI Consulting, Menlo Park, CA > >Mr. Mark Pollitt, Supervisory Special Agent and Program Manager, Computer >Analysis Response Team, FBI Laboratory, Washington, DC > >Mr. Marcus J. Ranum, CEO, Network Flight Recorder, Inc., Baltimore, MD > >Mr. Mark D. Rasch, Director of Information Security Law, Science >Applications International Corporation, McLean, VA > >Mr. Richard Rees, Supervisory Special Agent, Washington Field Office, >Computer Crime Squad, Federal Bureau of Investigation, Washington, DC > >Dr. Barry A.K. Rider, Director of the Institute of Advanced Legal Studies, >University of London; Fellow in Law of Jesus College, University of >Cambridge; Executive Director of CIDOEC and Barrister at Law > >Mr. Thomas H. Roche, Deputy General Counsel and Vice President, Federal >Reserve Bank of New York, NY, NY > >Mr. Shalom Rosen, Vice President, Emerging Technologies, Citibank, NY, NY > >Mr. Daniel J. Ryan, Corporate Vice President & Division General Manager, >Science Applications International Corporation, Falls Church, VA > >Mr. Charles S. Saphos, Currently Attorney at Law, Fila & Saphos, Columbia, >MD; formerly General Counsel, National Central Bureau - INTERPOL, U.S. >Justice Department, Washington, DC > >Mr. E. Eugene Schultz, SRI Consulting, Menlo Park, CA > >Mr. Dan Schutzer, Vice President and Director of Advanced Technology, >Citibank, New York, NY > >Mr. Winn Schwartau, COO, Security Experts, Inc., Seminole, FL. Mr. >Schwartau, a leading expert on information security and electronic privacy, >is an author of several books including, " Information Warfare: Chaos on >the Electronic Superhighway." > >Mr. James C. Settle, Currently, Settle Services in Technology, LLC, >Springfield, VA; Former Head, National Computer Crime Squad, Federal Bureau >of Investigation, Washington, DC > >Mr. Steven Shaker, President, WarRoom Research, LLC, Baltimore, MD; noted >futurist and authority on competitive intelligence and "war room" >applications > >Mr. Jeffrey H. Smith, Attorney at Law, Arnold & Porter, Washington, DC; >Former General Counsel of the Central Intelligence Agency > >Dr. Eugene Spafford, Professor of Computer Science, Purdue University, West >Lafayette, IN > >Mr. Daniel Stipano, Director of Enforcement and Compliance, Comptroller of >the Currency, U.S. Treasury, Washington, DC > >Mr. Edward M. Stroz, Supervisory Special Agent, Computer Crimes Squad, >Federal Bureau of Investigation, NY, NY > >Professor Betty Taylor, Professor of Law, College of Law, University of >Florida, Gainesville, FL > >Dr. Peter S. Tippett, President, National Computer Security Association, >Carlisle, PA; Director, Computer Ethics Institute and is a trained >scientist with both a Ph.D. and M.D. > >Mr. Steve Walker, President, Trusted Information Systems, Glenwood, MD > >Mr. Ira Winkler, CISSP, Severna Park, MD; Mr. Winkler is the author of >"Corporate Espionage." > >Lt. Gen. C. Norman Wood, U.S. Air Force (Ret.); Former Director of the >Intelligence Community Staff and now Vice President/General Manager of BDM >Federal, McLean, VA* > >Mr. Michael Zboray, Vice President and Program Director, Gartner Group, >Stamford, CT* > >* Invited > >For more information contact Oceana's International Seminars Division >Telephone: 800/831-0758 or 914/693-8100 >Fax: 914/693-0402 >E-mail: oceana(a)panix.com ************************************************************************ Lynne L. Harrison, Esq. | Destiny: Poughkeepsie, New York | "A tyrant's authority for crime lharrison(a)mhv.net | and a fool's excuse for failure." http://www.dueprocess.com | - Ambrose Bierce ************************************************************************ DISCLAIMER: I am not your attorney; you are not my client. Accordingly, the above is *NOT* legal advice.

1 0

Ring: Server problem
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- AAAAAAAAAAAKKKKKKKKK My server has had problems with both incoming ftp and rz. Not only is it very flakey, but they've mis-applied a timeout lately, meaning I have to press a key every 10 minutes during ftp or the process gets killed. Oh, and they did that just before becoming very busy. I delayed announcing my keyring until I could physically transfer the keyring by disk. After getting mail reporting it being corrupted, I had to delete it. It's possible that when I mounted my disk, it could have defaulted into an ascii conversion. I am currently trying to uuencode the entire file and mail it to myself from my local machine. (Heh) If that fails, the keyring will unfortunately not be available until tomorrow, when I can physically transfer it. Sorry for the delay. Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBME9UYcLa+QKZS485AQFiAAL/bOEgCAeQVPfIzaU3fbRzowK+Wh+lwgaY TY/O9DssheM34qbQcaM3qx9/7Gv4J+kamvhNOgNPhInsQ9ZATKFFtfbPTKimH/jm dP6g51WxbhdQV6mUdXoPT1z1yFAUPEiL =HaPy -----END PGP SIGNATURE-----

1 0

A Distributed Network Cache Service
by Mike Duvos 17 Dec '03

17 Dec '03

I've been thinking a bit about the micropayment-based distributed network file system of the future. It should be scalable, with the addition of servers being a simple process. Anyone should be able to run a server. Kidnapping a server should disclose nothing about the contents of files stored there. Which files are stored on which servers should be concealed from mere users of the network. Anyone should be able to use the system by connecting to the server nearest them. Deterministic routing between servers should be used by servers to provide files to other servers. The system should provide for replication of files on a fixed number of servers, with "k of n" parts being sufficient for reconstruction. Aside from replication done for reliability, there should be only one copy of a file in the system at any time. If multiple users submit the same file, there should be no more copies than if one user submitted it. The architecture of the system should be completely independent of any specific file system organization, and any user should be able to sync all or any part of his file system with the network file system, or cache against the network file system on his local machine. The system should be completely secure, even from operators of servers. The person submitting a file receives a secret necessary for its reconstruction, and the file may only be accessed by the owner and those to whom the secret is communicated. The war room at the Pentagon and TCMay should be able to use the same server as an extension of their local file systems without any security worries. Let's consider the following service... Bob has an string of 100,000 octets he wants to make available to Alice and a few of their closest friends. Bob makes a secure connection to a Trusted Agent doing business with the network file system, and gives the Trusted Agent the string, and a micropayment of $1/MB or 10 cents. Working in a secure box, the Trusted Agent batch compresses and scrambles Bob's string into a much smaller string of seemingly random bits, and gives Bob two 128 bit values, a TAG, which will identify Bob's data to Bob, and to anyone else Bob may wish to share his data with, and a CONTEXT, which will unravel Bob's data back into its original form. The Trusted Agent then signs Bob's data, declaring that the resulting digital coccoon produced from Bob's data is associated with the TAG, and that the CONTEXT necessary to recover the data has been communicated to Bob and all copies destroyed. The agent gives Bob the TAG and CONTEXT, and sends the processed data and the TAG to the distributed file system, and it is stored on one or more of its servers for the next 100 days, after which it expires. For the next 100 days, Bob and all of his friends may use the 256 bit TAG/CONTEXT pair in place of Bob's data and may serve that data for free any number of times off any network file system server. They simply make a secure connection to any server, and send the TAG. The server returns to them the seemingly random stream of bits, after which a freeware program takes that data and the CONTEXT, and regenerates the original data. After 100 days, bob may fork over another 10 cents for another 100 days, or his data will disappear. The TAG assigned to an Octet String is unique, and no two strings have the same TAG, and no string is ever assigned multiple tags, no matter how often it may be entered and purged from the system. Now, almost everything you could want from a network wide distributed file system can be carried on top of this simple service, which might be considered a system of temporary lodging for popular Octet Strings. You rent your Octet String a room, where you and people you authorize may have unlimited visits for 100 days, and at the end, your Octet String checks out for parts unknown. One can do an almost unlimited number of useful things with such a service which, given a fast network connection, allows you to store any file in 256 bits for a period of time ranging from 100 days to forever, for a small fee. Bob could back up his entire file system to the network, sending each individual file or directory as an Octet String, with hard links to files replaced with TAG/CONTEXT pairs. The TAG/CONTEXT pair for Bob's root directory would then be used to access Bob's file system off any network server. If Bob changed some files, he could resync his FS with the server by only updating a few Octet Strings. If Bob synced his FS with the network daily, and jotted down the TAG/CONTEXT pair for his root directory, Bob could mount his file system as it appeared at backup time for any of the last 100 days, with no replication of material on the servers that contained it. Bob could write a "compression" program, Bobzip, which would produce an "archive" where each file only took 256 bits of space, and which could be "unBobzipped" on any machine connected to the Network for the next 100 days. Bob could mail this small "archive" to his friends. If browsers understood URLs referencing the distributed file system, Usenet binaries could be replaced with appropriate pointers in Usenet articles, ending the endless replication of binaries on thousands of machines, and reducing Usenet back to a managable volume of data. Users could boot their machines off the Network, and instantly see gigabytes of software available to them. After syncing their cache file system with the network, they could drop their PC off the roof, buy another one, and by typing in just one TAG/CONTEXT pair, see all their files again. Cache proxys could be set up which would grab files from the servers and provide NFS access to them, permitting other hosts to export NNTP, HTTP, and FTP access to the distributed network data. I would imagine a typical useful node in such a distributed system would need about 10 gig of disk, a fast network connection, and a reasonably fast processor. Such a node could hold 100 meg of compressed data for each of the 100 days until the space was reused. At full utilization, each node would generate in excess of $100 a day of revenue at $1/MB. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

2 1

Magazine / Goodbye
by dr261＠cleveland.Freenet.Edu 17 Dec '03

17 Dec '03

Hello, everyone.. <warning: semi off-topic post> I am posting this to let everyone know that I am starting a semitechnical magazine titled _The_Carrier_Wave_. It will be published every two months to begin with, and hopefully monthly if I receive enough material. I am requesting articles, columns, news, bits, etc.. Whenever anything -interesting- happens, I'd appreciate it if someone could write a long or short blurb about it and forward it to me. Events, meetings, tradeshows, milestones, new algorithms... Stories about PGP, Clipper, etc... Use this to get the word out. If someone could run a "Cryptography Column" or "CryptoNews" or a Cypherpunks column, that would be great... If you are interested, please send me mail at dr261(a)cleveland.freenet.edu.. Also note, I have unsubscribed to Cypherpunks because I will be very busy lately and an overflowing mailbox is undesirable. Thanks! !!! -- Tobin Fricke (aka LightRay) The Digital Forest BBS (714)586-6142 dr261(a)kanga.ins.cwru.edu KE6WHF Amateur Radio, 1:103/925 fido

1 0

Announce: Web of Trust Ring
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- WEB OF TRUST KEYRING GENERATION PROJECT I have completed my project to make a condensed version of the keyserver PGP keyrings, containing only the "web of trust" inter-related keys. My methods were rather crude, and unfortunately only extracted those people who have signed someone (already on the list) else's key. That means that people who are well connected on the web of trust are included, while those people who only receive signatures from well-connected people are not included. The keyfile is approximately 1 megabyte, as opposed to 5-6 in the keyservers. Building it required 12 successive passes to the MIT keyring, each requiring 4-6 hours on my poor 386. I also made a subsequent pass using the UNIMI keyring. To seed the list I used warlord(a)mit.edu (Uh Derek? Hello??) and those keynumbers that cpunks mailed me. (Unfortunately some people sent only their key blocks, which I didn't use. Also, my server "lost" mail _twice_ due to "disk crash" while I was collecting key numbers.) I assume that requiring 13 passes means that the longest possible chain with a single connection (not necessarily a trust connection) to one of the seed keys is 12 keys. All included keys are exactly as they are on keyservers. The keyring can be trivially validated as much as possibly simply by validating one of the well-connected keys, like the ones that come with PGP. Warning: not responsible for assigning trust levels for all those people. That's your job. Have fun. Why did I do this: 1) Because I wanted to. 2) Because I really had nothing better to do with my CPU time. 3) wait, wait, ok for reals: 1) Because I want a web of trust keyring for myself, and that big old 5+ meg clunker keyfile is tooooo slow to use. 2) Because I feel that a DNS-style keyserver would not suit many web-of-trust activities that I wanted the keyring for, IE: pgp aware tools like news and mail readers for on-the-fly validation. 3) Because I feel that a system like this would encourage strengthening the web-of-trust, ie, trusting the KEYS. The current system has a lot of disjointed keys (uh, 4 meg worth I guess, eh?) which I found myself trusting simply because they were on the Keyservers. While this facilitates creation of a stable nym(*), real or not, I found myself even trying to justify to others trusting a key simply because it was on a keyserver. * = I agree with Bill Steward that we are a bit obsessed on True Names(tm) bit. I understand when Someone(tm) like Derek Atkins wants to see a True Name ID card(tm), but I'm sympathetic to having Nym signing, with the problem to overcome being simply the man-in-the-middle thwarting. Updates: Currently I am not really planning to do much in the way of updates to this, unless people actually are interested in updates. To be frank, this keyring is what I'm dropping into my own PGP, other than that it's not too exciting. If you get a copy, please tell me what you think of the project. The location is ftp to bert.cs.byu.edu, pub/donring.pgp. Unfortunately I don't know if you can tack that together as a ftp:// address. If you do, try ~ftp/pub/donring.pgp for good measure. I have suggested in the past that keyserver software could be modified to update the web of trust (using a keyfile such as mine for a base) instead of accepting just any key. I am not capable of making such modifications to the keyserver program, nor do I know of a keyserver operator who is willing to run such a system. A "for real" web of trust keyserver would want to fully expand my keyring by adding what I left out - those keys who are signed by included keys, but are not themselves included because they were not a seed and have not signed an included key. Having coded that, an update system that checks for a relation to a already-included key would be trivial. A second issue is that "The Web" of trust depends on the keys used to seed it. It's very possible that many of unimi's (for example) key file (500k bigger than MIT) keys do not have signatures connecting them to the people who came out with PGP, but have a robust web of trust none the less. Unless the project can obtain a seed which connects to that web, none of it is included. However, as I stated, that is a fact which will _encourage_ people to seek each other out for key signing. I suppose I could also make a list of the keyring generation script, if anyone actually wanted to ftp it. It would take between 15 and 35 hours to run on a 386 Linux box such as mine, mere hours on a big, fast box. There is really no need for it except to regenerate the keyring, for paranoia purposes or other reasons. Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBME6dqsLa+QKZS485AQFiBwL/boAb6BOdvcVHVyV+rGRmMTNk8iibcXvX kdngbRLrBEc2r4pJkuNpDvT2M/GmmGEGYxiAXKV9LDmWa7RLnCicjidP1RJVcu+3 xtVeO9PF+4ZecgEUJl4j6JdPEE52guOr =nm0W -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://bert.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Death threats ALWAYS pgp signed * This user insured by the Smith, Wesson, & Zimmermann insurance company *

2 1

Re: Notes from NIS&T Key Escrow Export conference.
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:26 AM 9/7/95 -6, Peter Trei wrote: >"If keys are escrowed, what purpose does a 64 bit limit serve?" A 64 bit limit serves lots of purposes, like letting the NSA crack stuff; I suspect escrow is being used as an excuse to get big vendors to standardize on wimpy 64-bit crypto as much as anything else. >Secondarily, I observe that this apparently precludes the use of OTP. Not to the devious (though the devious may not be able to get export approval) After all, you could escrow a _lot_ of 32-bit OTPs :-) (yeah, I know, the requirement that you identify which escrowed key is being used makes that less than useful, unless the final standard comes out with clear, unambiguous language which fails to cover all cases and can therefore be abused - that's one problem with the current "ask the NSA" rule.) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0