December 2003 - cypherpunks-legacy

HP Lobbies for Exportable Crypto
by bwern＠jax.jaxnet.com 17 Dec '03

17 Dec '03

>From the 28th of September's EDUPAGE: HP LOBBIES FOR EXPORTABLE ENCRYPTION PLAN Hewlett-Packard has developed an encryption strategy with the French company Gemplus SCA that they're hoping will pass the tough scrutiny of U.S. export controllers. The plan takes a two-pronged approach -- an "encryption engine" that works in conjunction with a code-making formula that can be adjusted to any level deemed acceptable by the U.S. government, and a policy card that would be reviewed on a case-by-case basis by the State Department. The flexible system is designed to adapt to changing government policies, and could even accommodate a key escrow system like the Clipper chip. "There was a lot of skepticism when HP first proposed it. But it looks to me that they are well on the way to the next step," says a former encryption specialist at the National Institute of Standards and Technology. (Wall Street Journal 27 Sep 95 B7) Ben Wern bwern(a)jaxnet.com | bwern(a)pathtech.com | bwern(a)unf.edu SAY NO TO TALKING COWS! ------------------------------------------------------------------------- "We are more than the sum of our knowledge, we are the products of our imagination."

1 0

Re: Netscpae & Fortezza (Or, say it Ain't so, Jeff?)
by Bill Stewart 17 Dec '03

17 Dec '03

>I for one am against any kind of GAK on moral grounds. I also think >that trying to implement mandatory GAK in a software only system >would be a nightmare. Unfortunately, it's quite simple, if your only intent is to get the keys, and not to use it as a way to increase NSA leverage... Carl Ellison's web page points out the simple version of this, and it's easy to extend to make it more reliable. 1) Have the NSA/NIST/DEA/etc. generate public keys for their GAK agents. 2) Have each session-key-transfer encrypt a copy of the session key with the public key of the GAK agent, and send it at the beginning of the connection. 3) To make it more robust, have the recipient of the session key also encrypt the session key with the GAK key and send it back, so that a conformist receiver can rat the key even if the sender didn't. (takes a little protocol support to make sure the sender doesn't mind getting it echoed back to her.) Unlike Steven Walker's fancy complex method (which Dorothy liked a lot), this is simple and straightforward, and requires no validation by the recipient. (Both parties could send fakes, but they could do that anyway.) What it doesn't do is allow third parties to detect whether the GAK field has the real session key in it or a fake, but c'est la guerre. You can even get fancier and support M-of-N splitting, requiring M of N GAK agents to give out their keyparts; just do the split and encrypt each piece with the corresponding GAK agent's public key. This also works in a wide variety of environments (e.g. Diffie-Hellman). You could also scrounge a few bits by using the GAK field as an IV if you need one. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

RE: Cryptanalysis of RC4 - Preliminary Results (Repeat)
by Andrew Roos 17 Dec '03

17 Dec '03

Hi Bill You could check for the full three-byte prefix, which further reduces the number of keys you have to discard. Although all keys beginning "00 00" are weak in the sense of my original post, they do not appear to be as exploitable as the prefixes which generate two-byte probable sequences. I also recommend generating and discarding some initial sequence bytes, since the generation process mixes up the state table further. An extra "round" through the state table (i.e. generating 256 bytes) _appears_ to confuse things significantly, since by the time you've generated the initial state table from the key, Index Y is a function of all bytes of the key, so the second time around it's hard to figure out the impact of the byte swaps. But I wouldn't trust this without a significant amount of analysis: as always in this field, appearances can be dangerously deceptive. Of course, this defense is not possible with protocols like SSL where you have to follow the spec - or better still, PCT which conveniently moves the MAC to the *end* of the record, exposing the initial stream... Andrew ---------- From: stewarts[SMTP:stewarts@ix.netcom.com] Sent: 29 September 1995 10:16 To: Andrew Roos Cc: cypherpunks Subject: Re: Cryptanalysis of RC4 - Preliminary Results (Repeat) It sounds like any application using RC4 with random session keys should start by testing session keys and rejecting any that start with 00 00 or 03 FD; it means doing 2**-15 more random key generations, and reducing the brute-force space by 2**-15, but it's a pretty small reduction. ________________________________________________________________ Andrew Roos <andrewr(a)vironix.co.za> // C++ programmers have class (but not much inheritance) PGP Fingerprint: F6 D4 04 6E 4E 16 80 59 3A F2 27 94 8B 9F 40 26 Full key at ftp://ftp.vironix.co.za/PGP-keys/AndrewRoos

1 0

This fax list is 95% accurate!
by carolann＠censored.org 17 Dec '03

17 Dec '03

Sorry the whole HTML is here, however, if you now want to make "A CYPHERPUNK SPEAKS....." Press Release, this fax list will do it for you, only two or three numbers are unverified! (and that's as of today!) <html> <head> <title> Fearless Fax Numbers Revised 9-29-95 </title> </head> <center> <h1>Transgender Lobby Days Website</center> </center> <pre> I promised last week that I would send this out when the idea of a blanket-fax-campaign for a c-punks press release was being discussed. Sorry it took me so long to get around to it, but here it is. I was mistaken in my original posting: it includes neither the Fox Network _nor_ the Eye on America show, but I'm sure we'll find those numbers somewhere. I got it from the Iron Feather Journal, volume 14. I have no reason to believe that any of these numbers are incorrect, but some of them may have changed. Also: personal apologies to anyone who considers this to be noise. Please restrict all flames to private e-mail. Anybody wanna fax Ted Turner? :) ABC 20/20 NY 1-212-456-2969 Ann Arbor News Ann Arbor, MI 1-313-994-6879 AP Los Angeles 1-213-748-1200 AP San Diego 1-619-291-2098 AP (Broadcast) Washington, D.C. 1-202-955-7367 Associated Press Los Angeles 1-213-748-9836 Steve Loeper Associated Press Phoenix, AZ 1-602-254-9573 Assignment Editor Associated Press San Francisco 1-415-552-9430 Bill Schiffmann Associated Press MN Minneapolis, MN 1-612-332-4245 Boston Phoenix Boston, MA 1-617-536-1463 Boulder Daily Camera Boulder, CO 1-303-442-1508 C-SPAN Washington, D.C. 1-202-737-6226 Sarah Traheorn CBS Washington, D.C. 1-202-659-2586 CBS (Radio) Washington, D.C. 1-202-659-5578 CBS Eve News NY 1-212-975-2115 CBS Morning Washington, D.C. 1-202-331-1765 CBS News Los Angeles 1-213-651-0285 Jennifer Siebens CBS News San Francisco 1-415-362-7417 John Blackstone CBS TV Los Angeles 1-213-651-0321 CBS TV San Francisco 1-415-362-7417 Chicago Sun-Times Chicago, IL 1-312-321-3084 Chicago Tribune Chicago, IL 1-312-222-3143 CNN San Francisco 1-415-398-4049 CNN President Atlanta, GA 1-404-827-1575 Ted Turner Coloradoan Fort Collins, CO 1-303-224-7726 Denver Post Denver, CO 1-303-820-1369 Der Spiegel Hollywood, CA 1-213-851-9867 Frances Schoenberg Detroit News Detroit, MI 1-313-222-2335 ESPN Bristol CT 1-800-592-3776 Gannett Washington, D.C. 1-202-243-0190 Gannett News Service Sacramento, CA 1-916-446-7326 Becky Lavally KFAN AM Minneapolis 1-612-820-4265 Kostabi Media New York 1-212-925-3055 Mother Jones San Francisco, CA 1-415-863-5136 Douglas Foster NBC Washington, D.C. 1-202-362-2009 NBC News Burbank, CA 1-818-840-4275 Heather Allan NBC News President New York NY 1-212-315-4037 NBC TV Los Angeles 1-818-840-4275 Newsweek Washington, D.C. 1-202-783-6512 NPR Radio San Francisco, CA 1-415-553-2241 NY Times New York, NY 1-212-556-4603 PBS Alexandria, VA 1-703-739-0775 Pulse! West Sacramento, CA 1-916-373-2480 Laurie Macintosh Rainbow Coalition Washington, D.C. 1-202-728-1192 Reuters Los Angeles 1-213-622-0056 Rocky Mountain News Denver, CO 1-303-892-5499 Scripps Howard Washington, D.C. 1-202-408-8116 Shareware Magazine Sunnyvale, CA 1-602-839-2872 Tracy Stephenson Sports Fan Radio Net Las Vegas NV 1-702-737-1906 Time San Francisco, CA 1-415-434-5209 Paul Witteman Time Magazine NY 1-212-522-0451 UPI Boston, MA 1-617-338-9774 Barry Fly UPI Los Angeles 1-213-620-1237 UPI San Francisco 1-415-552-3585 Bill Bucy UPI Seattle, WA 1-206-283-0408 Penny Spar UPI Washington, D.C. 1-202-789-2362 UPI (Radio) Washington, D.C. 1-202-842-3625 US News & Wrld Rprt Washington, D.C. 1-202-955-2713 USA Today Washington, D.C. 1-202-955-2049 Utne Reader Minneapolis, MN 1-612-338-6043 Whole Earth Review Sausalito, CA 1-415-332-2416 Kevin Kelly kelli(a)zeus.towson.edu Geek Code v3.0 http://zeus.towson.edu/~kelli/ GAT dx s++:- a-- C++ uu+++ P+ L++ E- W++ N K W--- O- M- V-- PS+++ PE- Y++(-)> PGP+>++ t+ 5 x+ R tv b+++ DI- D--- G e h* r+ z** Diverse Sexual Orientation Coll.Towson State University DSOC(a)zeus.towson.edu "All the world will be your enemy, Prince With The Thousand Enemies. . . And whenever they catch you, they will kill you. But first, they must catch you. . ." -Richard Adams </pre> carolann(a)censored.org </html> -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

STT is 40-bit for RC4, 56-bit for DES
by Stephan Somogyi 17 Dec '03

17 Dec '03

>From the STT spec, page 73: 6.8 CRYPTOGRAPHY A. Encryption Two bulk encryption algorithms are used in STT - RC4 and DES. 1. STT uses RC4 encryption with 8-byte keys, of which 3 bytes are salt, in the clear. See the RC4Key entry under the Low Level Composites sub-section of this document. RC4 is a stream cipher; there are no pad bytes and the encrypted data is the same size as the plaintext data. 2. STT uses the Cipher Block Chaining (CBC) mode of DES, as defined in Federal Information Processing Standard FIPS 81. The key is 8 bytes long, with each byte having a parity bit in position 0. Thus there are 56 bits of random key. STT uses an all-zero byte Initialization Vector (IV). A maximum of 8 bytes of padding is applied to every plaintext message encrypted with DES to pad the message to a length that is a multiple of 8 bytes. Pad bytes have a value of x = 8 - ((length of the plaintext) mod 8) and the number of pad bytes is also x. For example, if the plaintext message was 17 bytes long, then each of the 7 bytes of padding contains the value 0x07. If x is 0, then there are 8 bytes, each containing 0x08. Padding is appended to the end of the plaintext before encryption and is stripped off after decryption. B. Signatures STT uses PKCS #1 Encryption block formatting for RSA signatures. Total length is 128 bytes for the signature (1024-bit modulus). The following is the plaintext: (TLV_SIGNATURE (BYTE[20] HashOfData) ;Hash of the data being signed (BYTE 0) ;parser initializer (BYTE[105] 0xff) ;padding (BYTE 0x01) ;recom. for private key encryptions (BYTE 0)) ;overflow protection for RSA C. Hashing All hashes in STT are 20-byte SHA hashes. See Federal Information Processing Standards FIPS 181 for the specification of SHA hashes. ________________________________________________________________________ Stephan Somogyi Mr Gyroscope Digital Media

1 0

Info War Comes Home
by Duncan Frissell 17 Dec '03

17 Dec '03

[Note: Whenever I do one of my longer pieces, it seems to drop into the void. Perhaps they are so well written and complete that no one can think of any comment to make on them. Perhaps not. Read this one and comment. You won't regret it.] In honor of the Second Annual Conference on Information Warfare a few weekends ago, here is my proposal towards a paper to be presented at next year's conference. ************************************************************************* The Mesh in the 'Hood If any of you have not read every word of The Economist's Survey of Defence Technology - "Softwar" in the June 10, 1995 issue --- shame on you. Do so immediately. In that report, there is the following description of the future battlefield without platforms (ships, aircraft, armor). AKA the Mesh. The Mesh is a network imposed over a landscape (what used to be called a battlefield). The network of sensors, smart munitions, small attack modules, and perhaps human troops, shares information and kills enemies moving through it. Friendly forces travel through it as if it weren't there. It is "flat." Hills and valleys disappear and expensive platforms [tanks, helicopters, etc.] have nowhere to hide since it is co-extensive with the whole territory it covers. It is also tough because it is hard to destroy enough parts of it to make a difference. Nuclear munitions might destroy a Mesh or imposing a stronger Mesh over an existing one might work if you didn't mind wholesale destruction but defeating it without massive destruction is hard. To quote from the Survey: "The mesh has a number of advantages. It is hard to attack, because its strength is spread widely. It is hard to damage, because there are so many communication paths. Many small sensors can provide a better picture than a few large ones. More sensors allow the information domain to conform more closely to the physical terrain. At the moment line-of-sight detection by sensors in a widespread network leaves topographical blind spots--wadis, narrow valleys--in which platforms such as attack helicopters can lurk." "While nets may see through the fog of war, meshes also tackle another of the problems von Clausewitz identified; war's friction. The mesh is a war machine with almost no moving parts, save the actual warheads of the weapons. It is a solid-state device; its mechanisms have migrated far into the spectral dimension of information, leaving only a thin skeleton framework in the world of height, breadth and depth." It certainly makes for a challenging war environment. The Mesh is created by warriors to effectively serve warriors' ends, I would like to suggest the possibility that civilians might create their own Mesh to serve their ends. A Mesh is Just a Net with Attitude The Internet is (as we all know) a network of interconnected computers that cooperate to exchange information in a standardized fashion. Its purpose is communication. If its purpose is extended, it can become a Mesh. Assume that the Net has grown in size and importance so that a significant portion of the population in a given geographic area is fully wired --- hardly a dramatic assumption. All of those machines are cooperating to enable the various sorts of communications that people want to use the Net for. Some of those machines are already connected to external cameras to do "silly" things like put pictures of Stockholm on the WWW. What if people connected other things to the Net? While it is unlikely that most people will put a chain gun in the window and interface it with the Net anytime soon, other useful connections are possible. [And even in the case of weaponry, specific neighborhoods might be interested in doing creative things now. Thus Bo Grtiz' heavily armed, Patriot, Recreational Subdivision in Idaho might find a use for the Mesh. And won't those Black Helicopters be surprised.] More peaceful civilians might deploy a Mesh to protect themselves against bad people whether official or unofficial. Like the existing Speedtrap website (http://www.nashville.net/speedtrap/) but in real time, cameras and passive sensors could track the minions of the State as they cruise through neighborhoods. They could also multicast live, full color, and audio images of arrests and less formal interactions with the authorities. Fans of Robert Heinlein will recall that Jubal Harshaw used a version of this strategy in "Stranger in a Strange Land." Cops behave better when they are on camera (and know it.) The Net allows everyone to play. END OF PART I (More next week).

2 1

"Who shall speak for us?"
by tcmay＠got.net 17 Dec '03

17 Dec '03

The questions "Who are the Cypherpunks?" and "Who shall speak for us?" have come up several times, in different contexts: -- Reporters want "human interest" stories for their other stories on Netscape cracks, SSL challenges, arrests, executions, etc. They want to know who we are, what our agenda is, what motivates us, and who our spokesmen are. -- "Who shall be our Spokesman?" keeps coming up. "Who shall speak for us?" -- There is once again talk about "getting organized" so as to better compete with EPIC, EFF, CPSR, VTW, ACLU, etc. While no one is seriously advocating a formal, dues-collecting organization, their is an undercurrent of thought that we had better get more organized or we'll just be roadkill on the information superduperhighway. -- And there seems to be a sense of uneasiness amongst some of us that there can't be a "Cypherpunks group" without organization, without hierarchy. In contrast, there have been points made that we are "nothing," not even a group, and that we are only a set of mailing list subscribers. I think this is too extreme a view, as we clearly have: * some sense of membership in a group, some sense of cohesion, some sense of "Us" vs. "Them." * regional activities in several parts of the U.S. and in some non-U.S. countries. * a growing archive of postings, of knowledge gained through hard work. So, we are _more_ than just the subscribers to a mailing list, but _less_ than a formal organization with shareholders, voters, elected officials, and a Great Leader at the top. What are we, then? One parallel is to a bunch of folks who meet at a gathering spot, perhaps a bar or pub. Perhaps a reading group, a book club. People who talk, speculate, exchange theories, and even decide on things that some of them will do. Maybe these folks, an ever-changing set of folks, will come to some commonly-held viewpoints, though not held by all folks, and not "voted on" to be the Official Position of this informal gathering of folks at the local bar. Cyberspace allows for all sorts of new kinds of "watering holes" where such emergent, loosely-organized, anarchic groups may develop. These "virtual communities" are an incredibly important development. (My paper given at Imagina '95, in Monte Carlo, "Crypto Anarchy and Virtual Communities," goes into this in detail.) Another parallel is to what is sometimes called an "invisible college." Academic researchers in a country or around the world form a loose kind of invisible college, a network of people at various institutions that share a common interest and that have certain emergent standards. Think of the cryptology researchers, or the fusion researchers, of the world. In this invisible college, reputations matter. Some researchers are more esteemed than others, some play different roles than others. Some of them are mostly teachers, others are buried deeply in their laboratories. And, as with the informal pub gathering, this invisible college does not have to "vote" on an official position, or "elect" leaders. Ah, I hear some of you pointing out, "But in fact some of these invisible colleges _do_ elect officials and _do_ have official positions!" Indeed, many invisible colleges develop subsets that have formal structures and become the de facto _professional guilds_ for their organizations. The American Association of Chiropractic Examiners, the French League of Graph Paper Experts, the Russian Federation of Agriculturists, and on and on. (More seriously, the American Bar Association, the American Medical Associatio, etc.) Often these "professional organizations" are designed to extend the reach of these organizations, to give official titles to the early organizers, and to lobby governments for laws favorable to their members. Often these formal organizations adopt licensing rules and regulations to "police themselves" and also, in well-known cases of "public choice" theory and "rent-seeking behavior," to limit the number of competitors. Often the other hierarchies, such as the State itself, endorse the rules adopted by the professional guilds. (I'm not saying anyone is directly arguing that the Cypherpunks, not even by innuendo, become a professional guild, but some of the clamoring about how we need to adopt a less threatening or strange name, organize ourselves more hierchically, and present a more unified front is often a step toward a rigid bureaucracy.) It's been gratifying to me, at least, that the Cypherpunks group has not fallen prey to this temptation, that in an important sense "we practice what we preach." We claim to be an "anarchy," not a "hierarchy." While it may be the case that each of us has his or her own personal heirarchical ratings of others, it is important that we never have tried to formalize or "vote on" these ratings. Or voted to elect a Great Leader. Our strength is in our numbers and in our ideas, not in the guy we have ensconced in an office in Washington so he can give press conferences and sound bites for journalists. Our strength is in our multi-headed (dare I mention "Medusa"?), multinational, informal lack of structure. "But how will _We_ compete with the organizations that have Washington offices? How will we get "air time" if we have no Spokespunk in Washington, or no list of Official Spokespunks that journalists can call to get The Cypherpunks Slant on things? Who shall speak for us?" The answer is simple: Let no one claim to speak for "us." Let no one claim to be a speaker for others. Let journalists adjust to a new way of speaking, a nonhierarchical way of saying "I think" and "My view is." Let journalists contact the people actually doing something they are writing about. Let journalists call the people directly involved, not the Official Spokespunks. It may be _easier_ for some journalists to simply call the guy they always call, just to get a "reaction quote," but our job is not to make it easier for some lazy journalists. And let those who dislike the name "Cypherpunks" call themselves something else. Nothing's stopping them. Of course, it may be that the people wanting a more conservative, more staid name also wish to "inherit" the mantle the Cypherpunks now have, wish to convey to the "International Association of Cybernetic Privacy Advocates," or whatever, the membership and reputation of the current and past Cypherpunks. This, I think, is the "old way" of doing things, the herd way. If the views many of us have about anarchy and cyberspace are correct, this way of operating represents the future. If not, who cares what we think? --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

(Fwd) Internet Euro-Clipper
by Peter Trei 17 Dec '03

17 Dec '03

------- Forwarded Message Follows ------- >From Risks Digest, via www-buyinfo ============================================ F Y I from the RISKS DIGEST----------- Date: 20 Sep 1995 12:24:10 GMT From: rja14(a)cl.cam.ac.uk (Ross Anderson) Subject: European Governments Agree to Ban Strong Crypto According to an article in `Communications Week International', the 34-nation Council of Europe has agreed to outlaw strong encryption products which do not make keys available to governments. The article, `Euro-Clipper chip scheme proposed', is on the front page of the magazine's issue 151, dated 18th September, which arrived in my mail this morning. It relates that the policy was approved on the 8th September at Strasbourg by the Council, and coincides with an attempt by the European Commission to propose a pan-European encryption standard. The Council - unlike the Commission - has no statutory powers to enforce its recommendations. However, Peter Csonka, the chairman of the committee that drafted the document (and an administrative officer at the Council's division of crime problems) says that `it is rare for countries to reject Council of Europe recommendations'. The proposal would make telecomms operators responsible for decrypting traffic and supplying it to governments when asked. It would also `change national laws to enable judicial authorities to chase hackers across borders'. Opposition to this measure was expressed by Mike Strezbek, VP responsible for European telecomms at JP Morgan, who said that his organisation `will challenge any attempt to limit the power of our network encryption technologies very strongly'. Czonka said that the Council had given consideration to business interests but had tried to strike a balance between privacy and justice. However, `it remains possible that cryptography is available to the public which cannot be deciphered,' his document says. `This might lead to the conclusion to put restrictions on the possession, distribution, or use of cryptography.' Apparently another international organisation, the OECD, has called a conference of its members in December to devise a strategy on encryption. I for one will be making clear to my MP that his stand on this issue will determine how I cast my ballot at the next election. I note that John Major stated in a 1994 parliamentary written reply to David Shaw MP that the government did not intend to legislate on data encryption. I am disappointed that government policy has changed to the point of supporting the Council of Europe, and that this change has sneaked through during the parliamentary recess. Ross Anderson Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

SOFTWARE: Filtering ads out of popular web sites
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

On the subject of HTTP proxies, [SEVERAL FWD'S DELETED, ENTERTAINING SUBJECTS RETAINED] - - - Begin forwarded message - - - Subject: The agents/advertising arms race heats up Subject: OH YEAH BABY, FILTER ME HARDER >From: Axel Boldt <boldt(a)math.ucsb.edu> >Newsgroups: comp.infosystems.www.announce >Subject: SOFTWARE: Filtering ads out of popular web sites >Organization: Univ of California at Santa Barbara, Dept of Mathematics >Approved: www-announce(a)boutell.com >Message-ID: <44ercn$nhl(a)holly.aa.net> Several popular web sites have recently turned to putting advertising gifs on their pages. NoShit is a tool that filters these out so that you don't see them - in fact, you don't even download them in the first place, thus saving time, money and brain capacity. NoShit is implemented as a set of patches against Cern httpd to turn it into a "filtering proxy server". This means that the proxy maintains a list of URL templates together with corresponding filter scripts. When a document is requested form the proxy that matches one of the templates, then the page is piped through the corresponding script before being presented to the client. This works together with caching, if desired. The idea is to run your own personalized NoShit proxy server and point your browser to it. The proxy does the filtering; the browser doesn't even know about it. This scheme works with every browser. I have written a ready-to-use library of filter scripts for a couple of well known, ad-infected sites, including Yahoo, Lycos, Netscape, HotWired, CNN, Infoseek and NandO Times. You can change these or add your own very easily. Locations: <URL:http://math-www.uni-paderborn.de/~axel/NoShit/> (Germany) <URL:http://emile.math.ucsb.edu:8000/~boldt/NoShit/> (California) Enjoy, Axel - - - End forwarded message - - -

1 0

Call for IT Sec XX
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

From: <http://www.xiwt.org/secpros1.htm> Call for White Papers Information Technology Security Policy Setting Process issued by the Cross-Industry Working Team Thursday, September 28, 1995 Introduction The Cross-Industry Working Team (XIWT) is seeking inputs from U.S. industry on ways to improve the process by which public policy on information technology systems security is developed. At the invitation of the Information Infrastructure Task Force (IITF) of the U.S. government, XIWT is soliciting ideas broadly from US industry, in the form of White Papers that address this issue. XIWT will, later this year, convene a workshop of industry experts to organize the ideas and suggestions expressed in these White Papers into a report for use by the IITF, and will prepare a report to be made available to the public. XIWT is a multi-industry coalition of organizations committed to defining the architecture and key technical requirements for a powerful and sustainable national information infrastructure (NII). XIWT aims to foster the understanding, development and application of technologies that cross industry boundaries; facilitate the conversion of the NII vision into real-world implementations, and facilitate a dialogue among representatives of stakeholders in the private and public sector. Additional information about XIWT can be found on the Internet at: http://www.xiwt.org/homepage. Information Technology Systems Security In the developing National Information Infrastructure (NII), information technology will be deployed in a wide range of contexts and systems including communications, computing, software systems, and many different types of applications. The ability of this technology, and the systems which employ it, to provide the requisite levels of security and protection, are of concern to almost everyone. Issues of central concern include: physical protection of systems and their contents, potential vulnerabilities at various points within the networked environments of these systems, and the ability to provide or even guarantee reliable and/or uninterruptable service. The infrastructure for such capabilities will need to include mechanisms for the protection of networks, computers and other types of equipment as well as systems that employ these elements, as well as methods for analysis, certification and validation of technology and systems, and for facilitating the setting of standards. It is likely that cryptographic capabilities will need to be available throughout for possible use in protection and authentication of information. Issues involving the management of these capabilities will need to be uncovered, discussed and resolved where possible. At present, the federal government has no formal process in place, in the Congress or in Executive Branch agencies, which adequately involves the private sector in the determination of public policy in this area. Responsibilities for this broad area within the federal government are widely diffused and do not necessarily insure that all the relevant concerns of the private sector are taken into account. Further, no single process is used by the various parts of the federal government and a variety of policies, reflected in laws, regulation and practice, usually result. A methodology is required by which private sector interests can be adequately expressed and factored into resulting policies. The purpose of this call for white papers is to request written inputs from interested and knowledgable parties on how the formal process to developing information technology systems security policies may be improved, and particularly on how private sector inputs can be most effectively incorporated. Specifically, industry is requested to identify those areas, domains, and issues that are especially relevant for consideration, and to recommend specific suggestions or approaches by which the policy determination process in these areas may be improved. This may entail, for example, the establishment of one or more bodies dedicated to this purpose, within or across domains; the creation of a broad set of principles for the government or other bodies to employ; the setting of national goals or other specific recommendations for federal action. Submissions White papers are specifically solicited from U.S. industry; other individuals who wish to contribute are welcome to do so. Submissions may be made on paper or electronically by sending electronic mail, document files, or via a form located on the XIWT World Wide Web server (addresses below). Submissions made on behalf of companies will be taken to represent the views of the firm; these will be verified if it is not made clear in the submission that the document represents a company position. Individual submissions will not be verified if they do not claim to represent company positions. Submissions should be: 1) responsive to the primary goal of this call, (focused specifically on process improvement and not the presentation of view on policy deficiencies or on desired policies); 2) clear in terms of specific topics, areas or domains of policy; 3) reasonably direct, brief and timely. Any format may be used for the white paper, and it may be of any length. However, submissions must include the following information, on envelopes or headers to email and web messages, and on the submission document, whatever its form: 1. The name of individual making the submission; 2. The name of firm on whose behalf the submission is made; 3. The return address by which submission may be verified, if necessary. XIWT will convene a one or two day invitational workshop in the Washington DC area in December, 1995, to review submissions and organize the preparation of findings. Papers received by November 15, 1995, will be used in the workshop. The report of this effort is intended to be made available in February, 1996. Submissions must be made to one of the following addresses: Conventional Mail: Security Policy Process XIWT 1895 Preston White Drive Suite 100 Reston VA 22091-0913 Electronic Mail: secpros(a)cnri.reston.va.us Please place: "Security Policy Process" in the "Subject:" field. Please use ASCII text in any attachments. World Wide Web: suggestions may be contributed via the internet at: http://www.xiwt.org/response The content of submissions will be used by XIWT only for the purposes described in this call. No specific attribution to individual companies or individuals will be made in the findings or report. We look forward to your help in this important national effort. For additional information, please contact Charles Brownstein or Pam Memmott Tel: (703) 620-8990 Internet: cbrownst(a)cnri.reston.va.us Internet: pmemmott(a)cnri.reston.va.us 9/22/95; PJM

1 0