December 2003 - cypherpunks-legacy

National Secuirty Science and Technology Strategy
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

This excerpt is from the summary of a long policy statement on the National Security Science and Technology Strategy published by the White House on September 19. The full report is well worth reading -- it addresses military, economic, intelligence, scientific and technological issues and lays out projected initiatives. Has anyone seen news reports on this? ----- >From URL: http://www.whitehouse.gov/White_House/EOP/OSTP/ nssts/html/execsum-plain.html Executive Summary _______________________________________________________ In March 1995, President Clinton ordered a sweeping reexamination of the United States Government's approach to putting science and technology to the service of national security and global stability in light of the changed security environment, increasing global economic competition, and growing budgetary pressures. This National Security Science and Technology Strategy, the product of that reexamination, is the country's first comprehensive Presidential statement of national security science and technology priorities. It augments the President's National Security Strategy of Engagement and Enlargement by articulating science and technology policies and initiatives that support the President's three primary national security objectives: enhancing our military readiness and capabilities, preventing conflict from occurring through engagement with other nations, and promoting prosperity at home. It advances that document's central approach of preventing conflict and maintaining the capability to respond should conflict occur. It is built on the recognition that our security depends on economic strength as well as military power. And it is grounded in the conviction that investment in science and technology is central to our ability to meet the challenges ahead. This National Security Science and Technology Strategy defines our new approaches to applying science and technology to the challenges that most directly affect our nation's security. [snip balance of summary]

1 0

Re: Graphic encryption
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Fri, 6 Oct 1995, Lucky Green wrote: >And by the way, "proprietary" algorithms are generally junk and should not >be relied upon by security concious individuals and businesses. Only >algorithms that have undergone extensive peer review should be considered >for use. It's OK, when these guys were spamming Usenet a few weeks ago with their product announcement (admittedly, they did at least keep it to comp groups) they said it was export-approved. Therefore, it can be pretty much written off from a security standpoint - it's at best as good as 40-bit RC4, and I sure wouldn't use that for secure communications. I'd still like to know how it works so we can see just how insecure it is, though. Mark

1 0

Open Market, Inc. Announcing security products
by Harry S. Hawk 17 Dec '03

17 Dec '03

Open Market, Inc. Is announcing "free software and services that will help hundreds of Internet-based businesses and millions of users protect themselves from potential security breaches." I don't know any more info.. I'll send more when available. -- Harry Hawk Manager of Computer Services Warwick Baker & Fiore 212 941 4438 habs(a)warwick.com

1 0

Open Market (more info)
by Harry S. Hawk 17 Dec '03

17 Dec '03

Basically they are going to set up a web site to act as a clearing house for security related breaches. On particular thing they will do is: 1) Hosting a web site where a user with any broswer can find out if their browser is secure. List security problems associated with that browser. "basically a self diagnostic center" That will be done by tues. -- Harry Hawk

1 0

Re: subjective names and MITM
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > A public key *is* "very probably unique". A "randomly selected" 1024 bit > prime number has a specific amount of entropy in it. The likelihood of > two users world wide "randomly" choosing the same such prime may be > precisely determined (assuming you can figure the entropy). > Given the difficulty of finding primes, how likely do you think it is that given one of the well known methods and finding the first 1024 bit prime that pops out would give you an effective attack? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

2 1

Re: Graphic encryption
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> Is there anything particular in graphic encryption? I usually > encrypt graphics and document images as regular files with regular > encryption... I believe graphic encryption outputs a valid image file that is apparently white noise until you perform the decryption transformation on it. An obvious way to do this with a non-lossy file format is to encrypt pixel vales with a stream cipher. Another way to make the image unviewable would be to shuffle the pixels or rasters with a PRNG. andrew

3 2

Open Market, Inc. Announcing security products
by Harry S. Hawk 17 Dec '03

17 Dec '03

Here is what they are going to do.. by tues 1) Hosting a web site where a user with any browser can find out if their browser is secure. List security problems associated with that browser. "a self diagnostic center" Using their knowledge base about browsers to create this feature. shortly thereafter: 2) Creating ref. implementations for the Open Market server; methods of verifying what browser you are connecting with and lookup security bugs and or proceed with transaction. Make CGI scripts available for operators of other servers. Basically letting other sites do what they are doing it step 1. 3) Offer a free upgrade problem for people who have a server that has had a security breach. They can download a known secure server. This upgrade is for any commercial server browser that has a known breach. E.g., update a netsite server but not a CERN 3.0 server even if the CERN operator has hacked it to make it secure. WWW.openmarket.com

1 0

Transgenders begin lobbying against ITAR
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

Transgender Lobby Days has come and gone. I taught transgender persons about PGP and ITAR. It got a good reception, and they are beginning to use it. We went to all 535 congressional offices in two days, and began to get the "transgender lobby block" noticed. We did get all of the legislative staffers email addresses, and will spill the results of this soon, so you can mount an anti-ITAR campaign of you own. I concentrated on the media galleries, and began to get the transgender positions related to the media. We did get lots of press, and a 20-20 piece coming soon. They were all virtually uninformed about ITAR or the Netscape situation. I did my best on ITAR while I was there. This report is being filed at alt.coffee, a cybercoffeehouse on Avenue A and 10th Street, in New York City. Gotta go this is costing 16.00 an hour to file. Love Always, Carol Anne Member Internet Society - Certified BETSI Programmer - WWW Page Creation ------------------------------------------------------------------------- Carol Anne Braddock <--now running linux 1.0.9 for your pleasure carolann(a)censored.org __ __ ____ ___ ___ ____ carolab(a)primenet.com /__)/__) / / / / /_ /\ / /_ / carolb(a)spring.com / / \ / / / / /__ / \/ /___ / ------------------------------------------------------------------------- A great place to start My Cyber Doc...

1 0

Re: Certificate proposal
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > I may not have been clear: the certificate I was referring to was the one > from Egghead, the one which I will use to make sure that I have a valid > key for Egghead. Such a certificate would of course not have my credit > card number; it would probably have some information related to Egghead. > My rhetorical point was that information would most plausibly be a NAME > by which I would refer to Egghead. I am still trying to understand how > these proposals to take names out of the picture will apply to a > commonplace situation like this one. The certificate would identify the entity you're having commerce with. It doesn't have to have a name, the certificate would replace the need for a name. If you wanted a name, you could use the certificate to access it. The certificate would give you a public key that would be the central identifier. Associated with it might be many attributes of the key-entity. You might use the key to find out a name, and bank account number, or an ip-address to use to communicate with. Don't think of it as being a name, "Egghead Software", and this is the key associated with it. Think of the key as the central thing. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Council of Europe on Crypto: Finland
by Tatu Ylonen 17 Dec '03

17 Dec '03

People have been digging the background of the Council of Europe recommendations here in Finland. It has turned out that Finland was represented an assistant director of the Criminal Police who is known as a supporter of extremely broad powers for the police. At the meeting, he has apparently presented his personal opinion as the official opinion of Finland; later the Council unanimously decided to recommend banning strong crypto. I hear a representative from Norway had apparently tried to speak some sense at the meeting, but had quickly been quieted by the others. It has also turned out that there have been studies on legislating cryptography and related issues in Finland during the past two years, but without concrete plans. The officials in charge of these issues were not aware of what was happening in Strasburg, and what Finland apparently has presented there certainly does not represent a concensus within the government. Things appear to be developing in promising directions, but much more work is still needed until things are on the right track. I strongly urge people in other European countries to contact their government officials, the press, and use other possible channels to dig out what exactly was happening and why, and make the officials and politicians understand the other issues that are related (computer security, universal surveillance, ability of independent political groups to function, trade secrets, etc). Professors and other persons in expert positions are important sources of information to the government in the preparatory process, and you should provide the officials with experts to consult on the issues. At least here it has turned out that preparations were being carried out with very few independent experts, input coming almost exclusively from the law enforcement side. Tatu Ylonen <ylo(a)cs.hut.fi>

1 0