December 2003 - cypherpunks-legacy

"Who shall speak for us?"
by tcmay＠got.net 17 Dec '03

17 Dec '03

The questions "Who are the Cypherpunks?" and "Who shall speak for us?" have come up several times, in different contexts: -- Reporters want "human interest" stories for their other stories on Netscape cracks, SSL challenges, arrests, executions, etc. They want to know who we are, what our agenda is, what motivates us, and who our spokesmen are. -- "Who shall be our Spokesman?" keeps coming up. "Who shall speak for us?" -- There is once again talk about "getting organized" so as to better compete with EPIC, EFF, CPSR, VTW, ACLU, etc. While no one is seriously advocating a formal, dues-collecting organization, their is an undercurrent of thought that we had better get more organized or we'll just be roadkill on the information superduperhighway. -- And there seems to be a sense of uneasiness amongst some of us that there can't be a "Cypherpunks group" without organization, without hierarchy. In contrast, there have been points made that we are "nothing," not even a group, and that we are only a set of mailing list subscribers. I think this is too extreme a view, as we clearly have: * some sense of membership in a group, some sense of cohesion, some sense of "Us" vs. "Them." * regional activities in several parts of the U.S. and in some non-U.S. countries. * a growing archive of postings, of knowledge gained through hard work. So, we are _more_ than just the subscribers to a mailing list, but _less_ than a formal organization with shareholders, voters, elected officials, and a Great Leader at the top. What are we, then? One parallel is to a bunch of folks who meet at a gathering spot, perhaps a bar or pub. Perhaps a reading group, a book club. People who talk, speculate, exchange theories, and even decide on things that some of them will do. Maybe these folks, an ever-changing set of folks, will come to some commonly-held viewpoints, though not held by all folks, and not "voted on" to be the Official Position of this informal gathering of folks at the local bar. Cyberspace allows for all sorts of new kinds of "watering holes" where such emergent, loosely-organized, anarchic groups may develop. These "virtual communities" are an incredibly important development. (My paper given at Imagina '95, in Monte Carlo, "Crypto Anarchy and Virtual Communities," goes into this in detail.) Another parallel is to what is sometimes called an "invisible college." Academic researchers in a country or around the world form a loose kind of invisible college, a network of people at various institutions that share a common interest and that have certain emergent standards. Think of the cryptology researchers, or the fusion researchers, of the world. In this invisible college, reputations matter. Some researchers are more esteemed than others, some play different roles than others. Some of them are mostly teachers, others are buried deeply in their laboratories. And, as with the informal pub gathering, this invisible college does not have to "vote" on an official position, or "elect" leaders. Ah, I hear some of you pointing out, "But in fact some of these invisible colleges _do_ elect officials and _do_ have official positions!" Indeed, many invisible colleges develop subsets that have formal structures and become the de facto _professional guilds_ for their organizations. The American Association of Chiropractic Examiners, the French League of Graph Paper Experts, the Russian Federation of Agriculturists, and on and on. (More seriously, the American Bar Association, the American Medical Associatio, etc.) Often these "professional organizations" are designed to extend the reach of these organizations, to give official titles to the early organizers, and to lobby governments for laws favorable to their members. Often these formal organizations adopt licensing rules and regulations to "police themselves" and also, in well-known cases of "public choice" theory and "rent-seeking behavior," to limit the number of competitors. Often the other hierarchies, such as the State itself, endorse the rules adopted by the professional guilds. (I'm not saying anyone is directly arguing that the Cypherpunks, not even by innuendo, become a professional guild, but some of the clamoring about how we need to adopt a less threatening or strange name, organize ourselves more hierchically, and present a more unified front is often a step toward a rigid bureaucracy.) It's been gratifying to me, at least, that the Cypherpunks group has not fallen prey to this temptation, that in an important sense "we practice what we preach." We claim to be an "anarchy," not a "hierarchy." While it may be the case that each of us has his or her own personal heirarchical ratings of others, it is important that we never have tried to formalize or "vote on" these ratings. Or voted to elect a Great Leader. Our strength is in our numbers and in our ideas, not in the guy we have ensconced in an office in Washington so he can give press conferences and sound bites for journalists. Our strength is in our multi-headed (dare I mention "Medusa"?), multinational, informal lack of structure. "But how will _We_ compete with the organizations that have Washington offices? How will we get "air time" if we have no Spokespunk in Washington, or no list of Official Spokespunks that journalists can call to get The Cypherpunks Slant on things? Who shall speak for us?" The answer is simple: Let no one claim to speak for "us." Let no one claim to be a speaker for others. Let journalists adjust to a new way of speaking, a nonhierarchical way of saying "I think" and "My view is." Let journalists contact the people actually doing something they are writing about. Let journalists call the people directly involved, not the Official Spokespunks. It may be _easier_ for some journalists to simply call the guy they always call, just to get a "reaction quote," but our job is not to make it easier for some lazy journalists. And let those who dislike the name "Cypherpunks" call themselves something else. Nothing's stopping them. Of course, it may be that the people wanting a more conservative, more staid name also wish to "inherit" the mantle the Cypherpunks now have, wish to convey to the "International Association of Cybernetic Privacy Advocates," or whatever, the membership and reputation of the current and past Cypherpunks. This, I think, is the "old way" of doing things, the herd way. If the views many of us have about anarchy and cyberspace are correct, this way of operating represents the future. If not, who cares what we think? --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

HP Lobbies for Exportable Crypto
by bwern＠jax.jaxnet.com 17 Dec '03

17 Dec '03

>From the 28th of September's EDUPAGE: HP LOBBIES FOR EXPORTABLE ENCRYPTION PLAN Hewlett-Packard has developed an encryption strategy with the French company Gemplus SCA that they're hoping will pass the tough scrutiny of U.S. export controllers. The plan takes a two-pronged approach -- an "encryption engine" that works in conjunction with a code-making formula that can be adjusted to any level deemed acceptable by the U.S. government, and a policy card that would be reviewed on a case-by-case basis by the State Department. The flexible system is designed to adapt to changing government policies, and could even accommodate a key escrow system like the Clipper chip. "There was a lot of skepticism when HP first proposed it. But it looks to me that they are well on the way to the next step," says a former encryption specialist at the National Institute of Standards and Technology. (Wall Street Journal 27 Sep 95 B7) Ben Wern bwern(a)jaxnet.com | bwern(a)pathtech.com | bwern(a)unf.edu SAY NO TO TALKING COWS! ------------------------------------------------------------------------- "We are more than the sum of our knowledge, we are the products of our imagination."

1 0

RE: Cryptanalysis of RC4 - Preliminary Results (Repeat)
by Andrew Roos 17 Dec '03

17 Dec '03

Hi Bill You could check for the full three-byte prefix, which further reduces the number of keys you have to discard. Although all keys beginning "00 00" are weak in the sense of my original post, they do not appear to be as exploitable as the prefixes which generate two-byte probable sequences. I also recommend generating and discarding some initial sequence bytes, since the generation process mixes up the state table further. An extra "round" through the state table (i.e. generating 256 bytes) _appears_ to confuse things significantly, since by the time you've generated the initial state table from the key, Index Y is a function of all bytes of the key, so the second time around it's hard to figure out the impact of the byte swaps. But I wouldn't trust this without a significant amount of analysis: as always in this field, appearances can be dangerously deceptive. Of course, this defense is not possible with protocols like SSL where you have to follow the spec - or better still, PCT which conveniently moves the MAC to the *end* of the record, exposing the initial stream... Andrew ---------- From: stewarts[SMTP:stewarts@ix.netcom.com] Sent: 29 September 1995 10:16 To: Andrew Roos Cc: cypherpunks Subject: Re: Cryptanalysis of RC4 - Preliminary Results (Repeat) It sounds like any application using RC4 with random session keys should start by testing session keys and rejecting any that start with 00 00 or 03 FD; it means doing 2**-15 more random key generations, and reducing the brute-force space by 2**-15, but it's a pretty small reduction. ________________________________________________________________ Andrew Roos <andrewr(a)vironix.co.za> // C++ programmers have class (but not much inheritance) PGP Fingerprint: F6 D4 04 6E 4E 16 80 59 3A F2 27 94 8B 9F 40 26 Full key at ftp://ftp.vironix.co.za/PGP-keys/AndrewRoos

1 0

Re: VISA and Microsoft STT Specs available
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:10 AM 9/29/95 -0400, Phill wrote: >Yes, VISA put the ASCII on their site... >We only host the ps version. Thanks! I looked at the Visa site, and it has a usable form of the documents still under construction; I waded through the 73-separate-page HTML version for a while.... There's some good intro material on how you use the stuff and who's responsible for what. Microsoft has the technical specs as one big slightly-HTMLized text file under http://www.windows.microsoft.com/windows/ie/stt.htm ; it's _much_ more readable, and has a pointer to the Visa version. (It's one big <PRE> with a few <B> and hrefs, in black-on-white.) Some cryptographic high points, from a brief scan. - 1024-bit RSA signatures, using PKCS#1 format. - SHA 160-bit hashes - Symmetric bulk crypto includes two options (I haven't yet seen how you choose between them; I assume it's export/domestic?) == RC4/64 with 24 bits of salt leaving 40 bits of real key == DES-CBC - yes, that's single-DES. IV=0. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

This fax list is 95% accurate!
by carolann＠censored.org 17 Dec '03

17 Dec '03

Sorry the whole HTML is here, however, if you now want to make "A CYPHERPUNK SPEAKS....." Press Release, this fax list will do it for you, only two or three numbers are unverified! (and that's as of today!) <html> <head> <title> Fearless Fax Numbers Revised 9-29-95 </title> </head> <center> <h1>Transgender Lobby Days Website</center> </center> <pre> I promised last week that I would send this out when the idea of a blanket-fax-campaign for a c-punks press release was being discussed. Sorry it took me so long to get around to it, but here it is. I was mistaken in my original posting: it includes neither the Fox Network _nor_ the Eye on America show, but I'm sure we'll find those numbers somewhere. I got it from the Iron Feather Journal, volume 14. I have no reason to believe that any of these numbers are incorrect, but some of them may have changed. Also: personal apologies to anyone who considers this to be noise. Please restrict all flames to private e-mail. Anybody wanna fax Ted Turner? :) ABC 20/20 NY 1-212-456-2969 Ann Arbor News Ann Arbor, MI 1-313-994-6879 AP Los Angeles 1-213-748-1200 AP San Diego 1-619-291-2098 AP (Broadcast) Washington, D.C. 1-202-955-7367 Associated Press Los Angeles 1-213-748-9836 Steve Loeper Associated Press Phoenix, AZ 1-602-254-9573 Assignment Editor Associated Press San Francisco 1-415-552-9430 Bill Schiffmann Associated Press MN Minneapolis, MN 1-612-332-4245 Boston Phoenix Boston, MA 1-617-536-1463 Boulder Daily Camera Boulder, CO 1-303-442-1508 C-SPAN Washington, D.C. 1-202-737-6226 Sarah Traheorn CBS Washington, D.C. 1-202-659-2586 CBS (Radio) Washington, D.C. 1-202-659-5578 CBS Eve News NY 1-212-975-2115 CBS Morning Washington, D.C. 1-202-331-1765 CBS News Los Angeles 1-213-651-0285 Jennifer Siebens CBS News San Francisco 1-415-362-7417 John Blackstone CBS TV Los Angeles 1-213-651-0321 CBS TV San Francisco 1-415-362-7417 Chicago Sun-Times Chicago, IL 1-312-321-3084 Chicago Tribune Chicago, IL 1-312-222-3143 CNN San Francisco 1-415-398-4049 CNN President Atlanta, GA 1-404-827-1575 Ted Turner Coloradoan Fort Collins, CO 1-303-224-7726 Denver Post Denver, CO 1-303-820-1369 Der Spiegel Hollywood, CA 1-213-851-9867 Frances Schoenberg Detroit News Detroit, MI 1-313-222-2335 ESPN Bristol CT 1-800-592-3776 Gannett Washington, D.C. 1-202-243-0190 Gannett News Service Sacramento, CA 1-916-446-7326 Becky Lavally KFAN AM Minneapolis 1-612-820-4265 Kostabi Media New York 1-212-925-3055 Mother Jones San Francisco, CA 1-415-863-5136 Douglas Foster NBC Washington, D.C. 1-202-362-2009 NBC News Burbank, CA 1-818-840-4275 Heather Allan NBC News President New York NY 1-212-315-4037 NBC TV Los Angeles 1-818-840-4275 Newsweek Washington, D.C. 1-202-783-6512 NPR Radio San Francisco, CA 1-415-553-2241 NY Times New York, NY 1-212-556-4603 PBS Alexandria, VA 1-703-739-0775 Pulse! West Sacramento, CA 1-916-373-2480 Laurie Macintosh Rainbow Coalition Washington, D.C. 1-202-728-1192 Reuters Los Angeles 1-213-622-0056 Rocky Mountain News Denver, CO 1-303-892-5499 Scripps Howard Washington, D.C. 1-202-408-8116 Shareware Magazine Sunnyvale, CA 1-602-839-2872 Tracy Stephenson Sports Fan Radio Net Las Vegas NV 1-702-737-1906 Time San Francisco, CA 1-415-434-5209 Paul Witteman Time Magazine NY 1-212-522-0451 UPI Boston, MA 1-617-338-9774 Barry Fly UPI Los Angeles 1-213-620-1237 UPI San Francisco 1-415-552-3585 Bill Bucy UPI Seattle, WA 1-206-283-0408 Penny Spar UPI Washington, D.C. 1-202-789-2362 UPI (Radio) Washington, D.C. 1-202-842-3625 US News & Wrld Rprt Washington, D.C. 1-202-955-2713 USA Today Washington, D.C. 1-202-955-2049 Utne Reader Minneapolis, MN 1-612-338-6043 Whole Earth Review Sausalito, CA 1-415-332-2416 Kevin Kelly kelli(a)zeus.towson.edu Geek Code v3.0 http://zeus.towson.edu/~kelli/ GAT dx s++:- a-- C++ uu+++ P+ L++ E- W++ N K W--- O- M- V-- PS+++ PE- Y++(-)> PGP+>++ t+ 5 x+ R tv b+++ DI- D--- G e h* r+ z** Diverse Sexual Orientation Coll.Towson State University DSOC(a)zeus.towson.edu "All the world will be your enemy, Prince With The Thousand Enemies. . . And whenever they catch you, they will kill you. But first, they must catch you. . ." -Richard Adams </pre> carolann(a)censored.org </html> -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

STT is 40-bit for RC4, 56-bit for DES
by Stephan Somogyi 17 Dec '03

17 Dec '03

>From the STT spec, page 73: 6.8 CRYPTOGRAPHY A. Encryption Two bulk encryption algorithms are used in STT - RC4 and DES. 1. STT uses RC4 encryption with 8-byte keys, of which 3 bytes are salt, in the clear. See the RC4Key entry under the Low Level Composites sub-section of this document. RC4 is a stream cipher; there are no pad bytes and the encrypted data is the same size as the plaintext data. 2. STT uses the Cipher Block Chaining (CBC) mode of DES, as defined in Federal Information Processing Standard FIPS 81. The key is 8 bytes long, with each byte having a parity bit in position 0. Thus there are 56 bits of random key. STT uses an all-zero byte Initialization Vector (IV). A maximum of 8 bytes of padding is applied to every plaintext message encrypted with DES to pad the message to a length that is a multiple of 8 bytes. Pad bytes have a value of x = 8 - ((length of the plaintext) mod 8) and the number of pad bytes is also x. For example, if the plaintext message was 17 bytes long, then each of the 7 bytes of padding contains the value 0x07. If x is 0, then there are 8 bytes, each containing 0x08. Padding is appended to the end of the plaintext before encryption and is stripped off after decryption. B. Signatures STT uses PKCS #1 Encryption block formatting for RSA signatures. Total length is 128 bytes for the signature (1024-bit modulus). The following is the plaintext: (TLV_SIGNATURE (BYTE[20] HashOfData) ;Hash of the data being signed (BYTE 0) ;parser initializer (BYTE[105] 0xff) ;padding (BYTE 0x01) ;recom. for private key encryptions (BYTE 0)) ;overflow protection for RSA C. Hashing All hashes in STT are 20-byte SHA hashes. See Federal Information Processing Standards FIPS 181 for the specification of SHA hashes. ________________________________________________________________________ Stephan Somogyi Mr Gyroscope Digital Media

1 0

(Fwd) Internet Euro-Clipper
by Peter Trei 17 Dec '03

17 Dec '03

------- Forwarded Message Follows ------- >From Risks Digest, via www-buyinfo ============================================ F Y I from the RISKS DIGEST----------- Date: 20 Sep 1995 12:24:10 GMT From: rja14(a)cl.cam.ac.uk (Ross Anderson) Subject: European Governments Agree to Ban Strong Crypto According to an article in `Communications Week International', the 34-nation Council of Europe has agreed to outlaw strong encryption products which do not make keys available to governments. The article, `Euro-Clipper chip scheme proposed', is on the front page of the magazine's issue 151, dated 18th September, which arrived in my mail this morning. It relates that the policy was approved on the 8th September at Strasbourg by the Council, and coincides with an attempt by the European Commission to propose a pan-European encryption standard. The Council - unlike the Commission - has no statutory powers to enforce its recommendations. However, Peter Csonka, the chairman of the committee that drafted the document (and an administrative officer at the Council's division of crime problems) says that `it is rare for countries to reject Council of Europe recommendations'. The proposal would make telecomms operators responsible for decrypting traffic and supplying it to governments when asked. It would also `change national laws to enable judicial authorities to chase hackers across borders'. Opposition to this measure was expressed by Mike Strezbek, VP responsible for European telecomms at JP Morgan, who said that his organisation `will challenge any attempt to limit the power of our network encryption technologies very strongly'. Czonka said that the Council had given consideration to business interests but had tried to strike a balance between privacy and justice. However, `it remains possible that cryptography is available to the public which cannot be deciphered,' his document says. `This might lead to the conclusion to put restrictions on the possession, distribution, or use of cryptography.' Apparently another international organisation, the OECD, has called a conference of its members in December to devise a strategy on encryption. I for one will be making clear to my MP that his stand on this issue will determine how I cast my ballot at the next election. I note that John Major stated in a 1994 parliamentary written reply to David Shaw MP that the government did not intend to legislate on data encryption. I am disappointed that government policy has changed to the point of supporting the Council of Europe, and that this change has sneaked through during the parliamentary recess. Ross Anderson Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

SOFTWARE: Filtering ads out of popular web sites
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

On the subject of HTTP proxies, [SEVERAL FWD'S DELETED, ENTERTAINING SUBJECTS RETAINED] - - - Begin forwarded message - - - Subject: The agents/advertising arms race heats up Subject: OH YEAH BABY, FILTER ME HARDER >From: Axel Boldt <boldt(a)math.ucsb.edu> >Newsgroups: comp.infosystems.www.announce >Subject: SOFTWARE: Filtering ads out of popular web sites >Organization: Univ of California at Santa Barbara, Dept of Mathematics >Approved: www-announce(a)boutell.com >Message-ID: <44ercn$nhl(a)holly.aa.net> Several popular web sites have recently turned to putting advertising gifs on their pages. NoShit is a tool that filters these out so that you don't see them - in fact, you don't even download them in the first place, thus saving time, money and brain capacity. NoShit is implemented as a set of patches against Cern httpd to turn it into a "filtering proxy server". This means that the proxy maintains a list of URL templates together with corresponding filter scripts. When a document is requested form the proxy that matches one of the templates, then the page is piped through the corresponding script before being presented to the client. This works together with caching, if desired. The idea is to run your own personalized NoShit proxy server and point your browser to it. The proxy does the filtering; the browser doesn't even know about it. This scheme works with every browser. I have written a ready-to-use library of filter scripts for a couple of well known, ad-infected sites, including Yahoo, Lycos, Netscape, HotWired, CNN, Infoseek and NandO Times. You can change these or add your own very easily. Locations: <URL:http://math-www.uni-paderborn.de/~axel/NoShit/> (Germany) <URL:http://emile.math.ucsb.edu:8000/~boldt/NoShit/> (California) Enjoy, Axel - - - End forwarded message - - -

1 0

Call for IT Sec XX
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

From: <http://www.xiwt.org/secpros1.htm> Call for White Papers Information Technology Security Policy Setting Process issued by the Cross-Industry Working Team Thursday, September 28, 1995 Introduction The Cross-Industry Working Team (XIWT) is seeking inputs from U.S. industry on ways to improve the process by which public policy on information technology systems security is developed. At the invitation of the Information Infrastructure Task Force (IITF) of the U.S. government, XIWT is soliciting ideas broadly from US industry, in the form of White Papers that address this issue. XIWT will, later this year, convene a workshop of industry experts to organize the ideas and suggestions expressed in these White Papers into a report for use by the IITF, and will prepare a report to be made available to the public. XIWT is a multi-industry coalition of organizations committed to defining the architecture and key technical requirements for a powerful and sustainable national information infrastructure (NII). XIWT aims to foster the understanding, development and application of technologies that cross industry boundaries; facilitate the conversion of the NII vision into real-world implementations, and facilitate a dialogue among representatives of stakeholders in the private and public sector. Additional information about XIWT can be found on the Internet at: http://www.xiwt.org/homepage. Information Technology Systems Security In the developing National Information Infrastructure (NII), information technology will be deployed in a wide range of contexts and systems including communications, computing, software systems, and many different types of applications. The ability of this technology, and the systems which employ it, to provide the requisite levels of security and protection, are of concern to almost everyone. Issues of central concern include: physical protection of systems and their contents, potential vulnerabilities at various points within the networked environments of these systems, and the ability to provide or even guarantee reliable and/or uninterruptable service. The infrastructure for such capabilities will need to include mechanisms for the protection of networks, computers and other types of equipment as well as systems that employ these elements, as well as methods for analysis, certification and validation of technology and systems, and for facilitating the setting of standards. It is likely that cryptographic capabilities will need to be available throughout for possible use in protection and authentication of information. Issues involving the management of these capabilities will need to be uncovered, discussed and resolved where possible. At present, the federal government has no formal process in place, in the Congress or in Executive Branch agencies, which adequately involves the private sector in the determination of public policy in this area. Responsibilities for this broad area within the federal government are widely diffused and do not necessarily insure that all the relevant concerns of the private sector are taken into account. Further, no single process is used by the various parts of the federal government and a variety of policies, reflected in laws, regulation and practice, usually result. A methodology is required by which private sector interests can be adequately expressed and factored into resulting policies. The purpose of this call for white papers is to request written inputs from interested and knowledgable parties on how the formal process to developing information technology systems security policies may be improved, and particularly on how private sector inputs can be most effectively incorporated. Specifically, industry is requested to identify those areas, domains, and issues that are especially relevant for consideration, and to recommend specific suggestions or approaches by which the policy determination process in these areas may be improved. This may entail, for example, the establishment of one or more bodies dedicated to this purpose, within or across domains; the creation of a broad set of principles for the government or other bodies to employ; the setting of national goals or other specific recommendations for federal action. Submissions White papers are specifically solicited from U.S. industry; other individuals who wish to contribute are welcome to do so. Submissions may be made on paper or electronically by sending electronic mail, document files, or via a form located on the XIWT World Wide Web server (addresses below). Submissions made on behalf of companies will be taken to represent the views of the firm; these will be verified if it is not made clear in the submission that the document represents a company position. Individual submissions will not be verified if they do not claim to represent company positions. Submissions should be: 1) responsive to the primary goal of this call, (focused specifically on process improvement and not the presentation of view on policy deficiencies or on desired policies); 2) clear in terms of specific topics, areas or domains of policy; 3) reasonably direct, brief and timely. Any format may be used for the white paper, and it may be of any length. However, submissions must include the following information, on envelopes or headers to email and web messages, and on the submission document, whatever its form: 1. The name of individual making the submission; 2. The name of firm on whose behalf the submission is made; 3. The return address by which submission may be verified, if necessary. XIWT will convene a one or two day invitational workshop in the Washington DC area in December, 1995, to review submissions and organize the preparation of findings. Papers received by November 15, 1995, will be used in the workshop. The report of this effort is intended to be made available in February, 1996. Submissions must be made to one of the following addresses: Conventional Mail: Security Policy Process XIWT 1895 Preston White Drive Suite 100 Reston VA 22091-0913 Electronic Mail: secpros(a)cnri.reston.va.us Please place: "Security Policy Process" in the "Subject:" field. Please use ASCII text in any attachments. World Wide Web: suggestions may be contributed via the internet at: http://www.xiwt.org/response The content of submissions will be used by XIWT only for the purposes described in this call. No specific attribution to individual companies or individuals will be made in the findings or report. We look forward to your help in this important national effort. For additional information, please contact Charles Brownstein or Pam Memmott Tel: (703) 620-8990 Internet: cbrownst(a)cnri.reston.va.us Internet: pmemmott(a)cnri.reston.va.us 9/22/95; PJM

1 0

SKIp
by Doug Hughes 17 Dec '03

17 Dec '03

anybody have any opinions on SKIP (Sun's IP level encryption). How does it compare for encrypting between machines to something like ssh? (Obviously ssh is more portable, other than that) Doug

5 4