December 2003 - cypherpunks-legacy

128-bit Netscape v4 for Linux???
by ichudov＠Algebra.COM 17 Dec '03

17 Dec '03

Hello, I am wondering if Netscape Communicator version 4.* is available for Linux with 128-bit encryption. Please email me or post a followup. Thank you. - Igor.

1 0

Re: NYT on Netscape Crack
by Holger.Reif＠PrakInf.TU-Ilmenau.DE 17 Dec '03

17 Dec '03

Is it a good idea to use different (unrelated!) seeded PRNG's for the challenge data (which can be seen by sniffing) and the masterkey (which should never leave out of client's memory? read you later - Holger Reif http://remus.prakinf.tu-ilmenau.de/Reif/

1 0

Re: SSL implementation problem at Netscape
by jsw＠neon.netscape.com 17 Dec '03

17 Dec '03

In article <43o47v$fsd(a)cnn.Princeton.EDU>, dawagner(a)flagstaff.princeton.edu (David A. Wagner) writes: > In article <david-1909951219130001(a)192.0.2.1> from sci.crypt, > David Sternlight <david(a)sternlight.com> wrote: > > If the above is, in fact, accurate it appears to apply to previous > > versions of Netscape, not the 2.0 versions for which the public beta goes > > out next week. > > We haven't tried it on v2.0, as we only have a copy of v1.1 right now. > But the front-page New York Times article today said that the next version > also has the same flaw, and that it'll be fixed before release. First off, Sternlight is not an agent working for netscape. :-) The same fix that will be going out to patch old versions will be applied to 2.0 before we do a public beta. As with any code it will be refined as necessary before the final release of 2.0. [ stuff deleted ] > While we don't yet know exactly how long it would take to break Netscape's > PRNG in this threat model, I think it's clear that Netscape's current > implementation is insufficient and insecure. Agreed. See other messages of mine for a more detailed response. > We don't know about e.g. PC's yet -- this is another area we were still > working on. I will note that Netscape didn't try to claim that any version > was safe from this flaw, for what that's worth... Again, see my other messages on this and related topics for more details of what the code was doing on PC and Mac. > Hopefully this will be quickly fixed by Netscape, and then we can all stop > worrying about it! :-) Yup. Then I can get back to working only 16 hours a day. :-) --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

Re: FBI calls for mandatory key escrow; Denning on export ctrls
by Nick 17 Dec '03

17 Dec '03

There was a story a few weeks ago about how the various federal bueracracies are not keen on giving their keys to ANY sort of "trusted third party" whether it is a psuedo private or overtly gov't entity. They don't trust each other and are of course interested in being able to keep their own dirty little secrets to themselves. They seem to realize that the plan gives the administration and it's FBI, Stalanesque powers over every other dept, as well as the citezenry. Then earlier this evening,an administration spokesman, issued a press statement distancing the administration from Freeh's testimony in an effort to deflect some of the resulting fallout. > The on-line NYT's claim today that everyone except the > administration is opposed to its crypto policy is daring > hyperbole. What's your take on that? > > http://jya.com/crypto-tops.htm > >

1 0

Re: netscape's response
by Pat Farrell 17 Dec '03

17 Dec '03

"Jeff Weinstein" <jsw(a)netscape.com> writes: > The issue is that any statement that only mentions the 1 minute figure > is only stating part of the story, just as a statement giving a figure > of several hours is only mentioning a part of the story. All of the > news articles I've seen (not an exhaustive sample) have only mentioned > the 1 minute number, which only really effects a relatively small > number of our customers. The Washington Post ran an article today in the Business section. Its byline said Elizabeth Corcoran. It refered to the four hour attack figure. It appeared to be mostly a rewrite of the Netscape press release -- nearly no quotes, no quoted local sources (TIS, Denning, etc.) I expect that many papers that are far from Silicon Valley will print it with a similar spin. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: NYT on Netscape Crack
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Andrew Loewenstern <andrew_loewenstern(a)il.us.swissbank.com> writes: > Jeff Weinstein <jsw(a)neon.netscape.com> writes: > > Regardless of what Markoff implies, we do not intend to depend > > on security through obscurity. > > Oh, can we now expect to see source to at least the security portions of > Navigator and the Commerce server? An excellent proposal. Well how about it Jeff/netscape? Save Ian and David the effort of reverse engineering it again (which it is obviously pointless, and more: mathematically impossible, to do), and get your self some free advice. Better to have free advice, and quickly now, rather than another disaster later, presume netscapes cred can't take too many more bashings before this starts affecting share prices etc. Posting the code for the random number generator would be an excellent start. Kirkov (sp?) principle and all. Or if that doesn't sit well with copyright interests, how about writing up an open spec about how the random number generator works? Then we can critique it. An algorithm should be something to be proud of, "it's secure, and see: this is how it works, here are the design criteria, here is how you would attempt to break it, and here is the best predicted attack's cost." Lets get something useful out of this, an open system is called for not just a quick switcheroo of another algorithm. Open systems, rule! (I thought netscape was big on open systems, reading some of the blurb, just now). I'm sure you'd get some useful, valuable feed back from publishing an open spec, is netscape still a progressive startup company with hot programmers running the show, or has it slipped into stuffy corporate realms already? Respectfully, Adam

2 1

Louis Freeh's Desire for Domestic "Key Recovery"
by Bill Frantz 17 Dec '03

17 Dec '03

Here is the contents of a letter I sent to the San Jose Mercury News. Any bets on whether it gets published? It is not surprising that FBI Director Louis Freeh wants to be able to read every private communication in the country. After all, he is director of the government agency that rose to its current prominence because Director-for-life J. Edgar Hoover used illegal wiretaps to blackmail prominent politicians. ------------------------------------------------------------------------- Bill Frantz | The Internet was designed | Periwinkle -- Consulting (408)356-8506 | to protect the free world | 16345 Englewood Ave. frantz(a)netcom.com | from hostile governments. | Los Gatos, CA 95032, USA

1 0

Conference: WORLDWIDE ELECTRONIC COMMERCE
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Wed, 20 Sep 1995 06:03:04 +0059 (EDT) From: Michael S Baum <baum(a)world.std.com> Subject: Re: BSDC Update 1.2 To: Robert Hettinga <rah(a)shipwright.com> Mime-Version: 1.0 Robert, Can you please consider letting your Boston list (or other lists) know about the following. Thanks. ---------------- ANNOUNCING: The Second Annual . . . WORLDWIDE ELECTRONIC COMMERCE Law, Policy, Security & Controls Conference October 18-20, 1995 At the Hyatt Regency Bethesda Phone: (214) 516-4900 The Second Annual WorldWide Electronic Commerce; Law, Policy, Security and Controls conference is fast approaching. This important event will feature the world's foremost experts addressing the most important issues of implementation and control related to secure electronic commerce. It will focus on current problems and provide a foundation for dealing with the emerging problems that promise to make the future more complex. We have been fortunate in securing a faculty that is unusually qualified and internationally recognized who will share their experience, knowledge and theories on the wide range of issues being addressed by this program. We are equally pleased to have obtained affiliation for this conference of a number of prestigious and influentual organizations. Please join us and your colleagues at this unique event! Michael S. Baum, J.D., M.B.A. Conference Chair Provided in Affiliation with: ============================================= * American Bar Association Section of Science and Technology Information Security Committee * University of London Queen Mary & Westfield College Centre for Commercial Law Studies * EDI Association of the United Kingdom * Harvard Law School * Internation Union of Latin Notaries * International Chamber of Commerce, Paris * National Institute of Standards and Technology (NIST) * Software Publishers Association * United Nations Commission on International Trade Law (UNCITRAL) * U.S. Council of International Business ============================================= Keynote Speaker: ---------------- Dr. Vinton G. Cerf, Ph.D. Senior Vice President MCI Telecommunications Corp. CONFERENCE PROGRAM ...at a glance GENERAL SCHEDULE ------------------------------------------------- Wednesday, October 19, 1995 6:00pm - 7:30pm SECURE ELECTRONIC COMMERCE FOR THE BEGINNER Thursday, October 20, 1995 8:00am - 9:00am Welcome & Keynote Speech 9:00am - 5:50pm Sessions 1 - 5 Friday, October 21, 1995 8:00am - 4:50pm Sessions 6 - 10 ---------------------------------------------- TRACK - A AGREEMENTS, LEGISLATION, POLICY AND REGULATION ---------------------------------------------- Session 1 So Who's in Charge, Anyway? The Impact of National & Int'l Leadership & Initiatives in Secure EC SPEAKERS: Harold S Burman, Esq., Office of the Legal Advisor Sally Katzen, Office of Management and Budget Bruce McConnell, Office of Management & Budget Renaud Sorieul, Esq., UNCITRAL Session 2 Drafting Agreements for Secure Electronic Commerce SPEAKERS: Michael S Baum, Esq., Independent Monitoring Thomas J Smedinghoff, Esq., McBride Baker & Coles Joe Wackerman, Esq., United States Postal Service Session 3 Are Privacy Requirements Inhibiting Electronic Commerce? SPEAKERS: Kenneth C Bass III, Esq., Venable, Baetjer, Howard & Civiletti Prof. George Trubow, The John Marshall Law School Ian Walden, Ph.D., Commission of the European Communities Session 4 Alternative Methods of Signing: Legal Aspects of the IRS's July 1995 Regulation SPEAKERS: Tom Baker, Esq.,Internal Revenue Service Lynn Casimir, Esq., Internal Revenue Service Celia Gabrysh, Esq., Internal Revenue Service Session 5 Digital Signature Legislation and Electronic Commerce SPEAKERS: Alan Asay, Esq., Utah Department of Commerce Kirk W Dillard, Esq., State Senator, State of Illinois Dean Sutherland, State Senator, Washinton State William E. Wyrough, Jr., J.D., M.B.A., Florida Legislature Session 6 The Legal Status and Effect of Digital Signatures - Perspectives SPEAKERS: Prof. Mads Andersen, University of Copenhagen Mario Miccoli, International Union of Latin Notaries Session 7 On-Line Registration vs. In-Person Registration: What Satisfies Business and Legal Requirements? SPEAKERS: Phillip Hallam-Baker, Massachusetts Institute of Technology Jeff Treuhaft, Netscape Communications Corporation Peter Williams, Verisign Session 8 Antitrust in Electronic Commerce: Shopping, Payments & Certification Authorities SPEAKERS: Prof. Mads Andersen, University of Copenhagen John Greanley, Esq., US Department of Justice, Antitrust Division Session 9 Proving Secure Computer-Based Transactions: Evidence Revisited SPEAKERS: Margaret A Berger, Brooklyn Law School Charles Nesson, Harvard Law School Ian Walden, Ph.D., Commission of the European Communities Session 10 Third Party Service Providers & Certification Authorities-Can They Successfully Limit their Liabilty SPEAKERS: Bruce Hunter, Esq., General Electric Information Services Ellen Kirsh, Esq., America On Line Renaud Sorieul, Esq., UNCITRAL -------------------- TRACK - B INFORMATION SECURITY -------------------- Session 1 Requirements for Implementing Reasonable Security Procedures SPEAKERS: Robert Daniels, Esq., U.S. Social Security Administation Dain Gary, Morgan Stanley Allan M Shiffman, Terisa Systems, Inc. Session 2 Information Security Standards: Policy, Coordination & Interoperability SPEAKERS: Marty Ferris, US Department of Treasury Hoyt Kesterson II, Bull Worldwide Information Systems Peter Landrock, Ph.D., CRYPTOMATHIC David Solo, Bolt, Beranek and Newman Session 3 Who's Really on the Other End: Identification Technologies and Nonrepudiation SPEAKERS: Benjamin Miller, Personal Identification News John E Siedlarz, IriScan, Inc. William Sweet, National Semiconductor Session 4 Security and Security Policy in Internet-based Payments Systems SPEAKERS: Marty Ferris, US Department of Treasury Tim Jones, Mondex Anne Wallace, US Department of Treasury Session 5 When You Forget Your PIN or Die: Key Escrow in Secure Electronic Commerce SPEAKERS: Prof. Michael Froomkin, University of Miami School of Law Jeff Greiveldinger, US Department of Justice, Criminal Div. Frank W Sudia, Bankers Trust Company Session 6 Comparing Critical Cryptographic Algorithms, Protocols, and Standards to Enable Secure Electronic Commerce SPEAKERS: Peter Landrock, Ph.D., CRYPTOMATHIC Ron Rivest, Massachusetts Institute of Technology Miles E Smid, National Institute of Standards & Tech. Session 7 Export Controls & Transborder Data Flows: Is Secure Electronic Commerce in Jeopardy? SPEAKERS: James Bidzos, RSA Data Security Renee H Danckwerth, Export Consultant Session 8 'Certificates-R-US': Trust Models and the Developing Secure Information Infrastructure SPEAKERS: Warwick Ford, Bell-Northern Research Sead Muftic, COST Computer Security Technologies Peter Williams, Verisign Session 9 Professional Accreditation and Certification - The New Frontier in 'Remote Trust' SPEAKERS: Richard C Koenig, Int'l Info. Sys. Security Cert. Consort. Alan M Schwartz, Esq., American Bar Association Session 10 Looking into the Crystal Ball: Certificates Revisited SPEAKERS: Web Augustine, VeriSign, Inc. Warwick Ford, Bell-Northern Research Hoyt Kesterson II, Bull Worldwide Information Systems ------------------------------------------- TRACK - C LEGAL ASPECTS OF SECURE ELECTRONIC COMMERCE ------------------------------------------- Session 1 Do Criminal Laws Really Protect Electronic Commerce? SPEAKERS: Scott Charney, Esq., US Department of Justice William J Cook, Brinks, et al. Richard A Ress, Federal Bureau of Investigation Session 2 Who Owns the Information, Standards, Certificates and Cryptographic Keys? SPEAKERS: Peter Harter, National Public Telecomputing Network David W Maher, Esq., Sonnenschein Nath & Rosenthal James Powers, Esq., Shulman, Rogers et. al Session 3 Consumers on the Net - Fairness, Conspicuousness, Notice, and Reliance SPEAKERS: Nessa Eileen Feddis, Esq., Government Relations/Retail Banking Ray Nimmer, Esq., Weil, Gotshal & Manges Session 4 Electronic Licensing and Distribution of Digital Content: Downloading for Liability? SPEAKERS: James C McKay, Jr., Office of the Corporation Counsel, D.C. Thomas J Smedinghoff, Esq., McBride Baker & Coles Mark Traphagen, Software Publishers Association. Session 5 Insuring Electronic Commerce Transactions and Infrastructure SPEAKERS: Andrew Cockrane, Alexander & Alexander Norman R Nelson, New York Clearing House Association Session 6 Auditing a Third Party/Value Added Network or Certification Authority (and Its Implications) SPEAKERS: Charles H LeGrand, CIA, Institute of Internal Auditors John Stelzer, COMMERCE:Institute Session 7 Electronic Recordkeeping - What to Save, When and How to Save It, and for How Long SPEAKERS: Lynn Casimir, Esq., Internal Revenue Service Celia Gabrysh, Esq., Internal Revenue Service Claude Perreault, Chambre des notaires du Quebec Session 8 Disaster and Contingency Planning Services: What is Needed for EC and Certification Authorities SPEAKERS: Dain Gary, Morgan Stanley Ake Nilson, Marinade Limited Helena Roine-Taylor, The Finnish Data Communication Assoc. FINPRO David Solo, Bolt, Beranek and Newman Session 9 General Counsel's Forum on Computer-Based Trade SPEAKERS: Robert W Barger, Esq., AT&T Bruce Hunter, Esq., General Electric Information Services Ellen Kirsh, Esq., America On Line Session 10 An Audit Model for Your Electronic Commerce Infrastructure SPEAKERS: Gerald R Bielfeldt, NationsBank Phillip Oddo, Ciba-Geigy Horton Sorkin, Ph.D., Howard University ------------------------------ TRACK - D INFRASTRUCTURAL CONSIDERATIONS ------------------------------ Session 1 Securely Shopping on the Web: New Paradigms, Protocols and Opportunities SPEAKERS: Jeff Hilt, VISA International Todd Ostrander, Egghead Software Session 2 What can Trusted Third Parties and Certification Authorities Learn from the Financial Clearinghouses SPEAKERS: Carol Barrett, Federal Reserve Bank of New York Bill Nelson, National Automated Clearinghouse Associa Norman R Nelson, New York Clearing House Association Session 3 Electronically 'Gluing' Computer-based Records SPEAKERS: Phillip Hallam-Baker, Massachusetts Institute of Technology Allan M Shiffman, Terisa Systems, Inc. Session 4 Global Registries for Secure Electronic Commerce SPEAKERS: Jonathan Allen, Barum Computer Consultants Michel Peereman, Federation Nationale des Chambres Peter Robinson, US Council for International Business Session 5 Computer-based Negotiability: What is Needed to Make it Work SPEAKERS: Harold S Burman, Esq., Office of the Legal Advisor James E Byrne, James Mason University Law School Ake Nilson, Marinade Limited Session 6 Time/Date Stamping of Digital Information: Necessities & Options SPEAKERS: Richard Rothwell, United States Postal Service Scott Stornetta, Surety Technologies, Inc. Session 7 Will Healthcare-related Electronic Commerce Require Special Controls and Secure Infrastructures? SPEAKERS: Kathleen Frawley, J.D., M.S., R.R.A, AHIMA Daniel J O'Shea, National Computer Claims Service Session 8 The Role of Notaries in Securing Computer-Based Commerce: the CyberNotary(sm) SPEAKERS: Theodore S Barassi, Esq., US Council for International Business Mario Miccoli, International Union of Latin Notaries Session 9 Electronic Cash and Novel Electronic Commerce Payments Systems SPEAKERS: Nessa Eileen Feddis, Esq., Government Relations/Retail Banking Ron Rivest, Massachusetts Institute of Technology Marvin Sirbu, Carnegie-Mellon University Session 10 Why does Everyone Want to be a Trusted Third Party/Certification Authority (at Least Initially)? SPEAKERS: Sead Muftic, COST Computer Security Technologies Stratton D Sclavos, VeriSign, Inc. ----------------------------------------------------------------- TO REGISTER: ------------- Price: $550.00 (U.S.) Name: Title: First Name for Badge: Company/Organization: Address: City/State/Prov/Zip/Postal code: Country: Telephone: Fax: E-Mail: Check One: ========== [ ] I am Mailing a check in the amount of $______ [ ] I wish to charge this to a credit card (fax or mail only) [ ] American Express [ ] Visa [ ] MasterCard Card Number: Expiration Date: Name on Card: Signature (fax or mail): ----------------------------------------------------------------- HOTEL RESERVATIONS: A special conference rate of $129 has been arranged for our attendees. To make arrangements, please call the Hyatt Regency Bethesda at (301) 657-1234 Hyatt Regency Bethesda One Bethesda Metro Center Bethesda, MD 20814 ----------------------------------------------------------------- For more information or a complete program brochure and schedule, contact the conference coordinators as shown below: HOW TO CONTACT US ================= E-Mail: wec(a)multicorp.com Phone: (214) 516-4900 Fax: (214) 424-0562 Mail: Worldwide Electronic Commerce PO Box 743485 Dallas, TX 75374 =============================================== --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Political News from Wired News
by Syniker＠aol.com 17 Dec '03

17 Dec '03

In a message dated 97-09-06 07:15:18 EDT, vznuri(a)netcom.com (Vladimir Z. Nuri) writes: << maybe I'm not following closely enough, but I haven't seen a *single* reference. that's really eerie. can't we get a *single* senator to bring up that issue? >> me neither... it's fucking mind-boggling.... and where's all the 'censorship' people???? it's like -- no one can make the 'connection' .... the CDA and FCA lists are dead ... not a word ... how can we all have wet powder at the same time? is Leahy saying anything? .... i'll find his site and see..... ldm

6 5

Re: NSA and Netscape Crack
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>>"I'm from the NSA, I'm here to help your crypto..." The quote should be "I'n form the NSA, I'm here to help your crypto. You have where else to go!" (apologies to George Lucas)

1 0