December 2003 - cypherpunks-legacy

Inherent Insecurity of Internet Commerce! (was RE: Secret Clearance)
by Pete Loshin 17 Dec '03

17 Dec '03

OK, I'll try again. First, as I recall, SECRET clearance is actually not very high: when I got it, I had to answer a bunch of questions (do you abuse illegal drugs? are you now or have you ever been a member of any organizations? have you ever been _arrested_ for anything?) and fill out some forms and get fingerprinted. They probably did a credit check, and that was about it. Nobody I knew got any calls asking about my habits (that is reserved for higher clearances). So now I'll rename the thread again: "Inherent Insecurity of Internet Commerce" -- <sarcasm>maybe now the NYT will feature me on the front page for "discovering" this inherent flaw in the Internet.</sarcasm> My purpose in renaming the thread in the first place was to start another thread relating to the types of security in places like, say, Netscape or Spyglass or CyberCash or First Virtual or Interramp or any other ISP or software company. Because I want to know how susceptible these companies are to hiring the wrong people. So, here's the "bug": if some agency of crime/espionage wants to subvert any of these systems, all they need do is employ the same blackmail/bribe techniques used to recruit actual spies on some employees of these companies. They then slip in some hacked versions of the software with the good ones, or modify distribution servers, or slip code into servers that forwards every tenth credit card number somewhere. Or how about getting a janitor to plug a wireless tap into one of the major Internet backbones to sniff for cc#s as well as interesting e-mail? Also, since there's enough noise here already (and even I don't see that much crypto-relevance) I won't post again on this topic, but I am very interested in hearing concrete examples of how Internet companies are protecting themselves, and also in hearing about specific instances of security failing (e.g., has anyone ever found a tap on a backbone?) -Pete Loshin pete(a)loshin.com

1 0

Re: News on Congressional Debate on Exon
by Kevin S. Van Horn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- tcmay(a)got.net (Timothy C. May) wrote: > >I just heard (12:15 EST) that the House has adopted language similar to the >original Exon-Coates language in the Senate I consider it unlikely in the extreme that this passed without Gingrich's sanction. So I guess the Newt's much-publicized opposition to the Exon amendment was just a show. - --------------------------------------------------------------------------- Kevin S. Van Horn | Uncle Sam needs YOU! vanhorn(a)atext.com | But not vice versa. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMYBmCoZzwIn1bdtAQE9lwGA1w4SUuzkxqcrIWu2EJq65rspqg7PVL6Y FcMbibELAnFrZOUKNVtQNXxtpfaItIGR =QI3W -----END PGP SIGNATURE-----

1 0

Re: Solution for US/Foreign Software?
by Rich Salz 17 Dec '03

17 Dec '03

You would not be allowed to export a browser where the crypto library is a dynamically-loaded library. If you wrote a "browser toolkit", you would have to take special care to hide even the names of the crypto functions in the library symbol table. If you want to do offshore crypto development, your best bet is to document the required interfaces and protocols in a publication which is available to anyone, as this is supposedly protected by the First Amendment. On the other hand, I encourage you to try to do otherwise. /r$

1 0

Kim Philby in Washington
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

Burgess, Philby, and Maclean in Washington A Comment on Clipper and G.A.K. It is historically indisputable that Guy Burgess, Harold "Kim" Philby, and Donald Maclean were agents for Soviet intelligence. What is far less known is the role that these three individuals played in the U.S.A. and how this related to their access to U.S. secret material. Maclean, at one time, was the Head of Chancery of the British Embassy in Washington D.C. As such, he was the head of the code room at the Embassy and thus had access to *all* encrypted traffic passing through the Embassy. This included everything available through the considerable Anglo-U.S. co-operative ventures during the immediately-post W.W. II period. Guy Burgess was also assigned to the British Embassy where one job was as a liaison agent with the U.S.A. It has been reported during this period that he had a pass from the Atomic Energy Commission that gave him 24-hour-a-day access unaccompanied by any U.S. "overseer." This was a higher level of A.E.C. security than held by J. Edgar Hoover at the time. Kim Philby was the U.K.'s liaison to the Central Intelligence Agency. He was personally close ("a drinking buddy") to then head of C.I.A. Counter-Intelligence James Jesus Angleton. Angleton was, to all accounts, a psychopathologically paranoid individual, seeing Soviet spies and disinformation attempts in almost all areas of life with the exception of his one-time bar companion. He might be likened to one of those hysterical Victorian "feminists" who thought "all men are pigs" with the exception of one real gentleman she knew. (The gentleman would, of course, be Jack the Ripper.) I write this not out of any sense that Key Escrow or Clipper are "communist plots." Far from it, especially during this period. But the presence of Burgess, Philby, and Maclean in Washington shows how unable the governments have been to protect their own secrets. It is unreasonable to suggest -- as do supporters of Clipper and G.A.K. -- that governments will be any better protecting ours. --tallpaul

1 0

Roger Schlafly's court hearing today
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

Roger Schlafly had a brief hearing this morning in Judge Williams federal court on summary judgements with respect to the validity of the various public key patents, and alleged anti-trust and unfair trade practices. Bob Wells and I were the only pro-tossing-the-patents out people there, although sometimes-cypherpunk-meeting-attender Whit Diffie was there as well. The judge said right at the outset that he would not be making a decision today, that he wanted guidance from Roger and the other sides lawyers about the relevant issues, to help him wade through the tremendous amounts of documentation provided. I suppose that this could be expected, but the issues here seemed to me, at least, to be relatively clear-cut. There were basically four issues to be discussed, the Diffie-Hellman, Hellman-Merkle, and RSA patents, and these unfair trade practices. The judge had only allocated an hour for this discussion, and then showed up 20 minutes late, which proved inadequate. Still, I thought that everyone was remarkably clear and concise with their answers, and the judge asked reasonable questions. First discussed were the unfair trade practices, where the lawyer for what used to be PKP dragged in a lot of dirty laundry from the past, describing why Roger got interested in this in the first place. I don't understand what the complaint here was, the PKP lawyer said that since Roger didn't have a product, what was he complaining about, anyway? It seemed like an odd defense to me, but again, I don't know exactly what Roger's complaint was. Roger agreed with the judge that yes, everything he wanted to say was in his submission. Next discussed was the Diffie-Hellman patent. Roger stated that he had four clear instances where the an "enabling disclosure" was made about Diffie-Hellman; three were presentations to large audiences, and one was a pre-print of the famous "New Directions in Cryptography" paper. Roger actually had the viewgraphs that Diffie used in his presentations. These disclosures were all made more than 1 year before the patent was filed, which is the limit in the US. The lawyer from CalCan (something like that) handled this one. He said that the law specifically mentioned publication, and that none of these was a publication. I'm not sure what the law says, and Roger disputed the claim that that is what the law says. Disappointingly to me, it appears that neither Diffie or Hellman have any recollection of when, to whom, or how many preprints of the article were sent out. It's terrible how the law seems to cloud people's minds, isn't it? What little I do know about patent law tends to support Roger on this one, I think that it should be an open and shut case, but we'll see. Then we came to the Hellman-Merkle patent, which basically claims all of public-key cryptography. Roger's claim here was that the mechanism described doesn't work, because knapsacks don't work, that is, the invention is supposed to make generation of the decryption key infeasable, by a very specific description of infeasability in the claims of the patent. (10^30 arithmetic operation necessary) Well, that's not true. The same lawyer for the other side took this on two different ways: 1) that nobody knew that knapsacks were insecure at the time that the patent was filed, how could the patent be found invalid based on something that happened later 2) and some variations (dense, iterated knapsacks) might still be secure. Roger presented an analogy. Say someone was able to persuade the patent office that a drug cured cancer, and so he was able to obtain a patent on it. Later, it was found that the drug killed everybody who took it. Should the patent be valid, if it really didn't do what it said that it would? Roger could have gotten melodramatic, and said that bad cryptography could really kill people, and has many times, but he didn't; as I said, everybody was remarkably concise and to the point. Even so, we were out of time here, not having discussed the RSA patent or the Schnorr patent at all. The judge said that he will call another hearing if he feels that it is required. I thought, in my incredible naivete, that it went really well for Roger, although I didn't have time to hang around and ask him how he thought it went. I think that his arguements are good, and if the law is sensible he will prevail. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-2244

1 0

Re: Solution for US/Foreign Software?
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

> >> I'm not saying they are a "bypass" of the laws. Rather, I'm saying that >> if the goal is to: >> >> 1. Let companies like Netscape make foreign sales. >> >> 2. Still comply with the letter of the law. > >It takes more than one or two people to coordinate an international effort. >Once more than a few people know about it, it becomes "company policy" or >"corporate objective", in which case, the NSA/DoS will eventually figure it >out and start levying heavy fines and jailing the individuals. You miss the point! There will be no "international effort"! Here are the steps: 1. Write a program limited to keysize, carefully constructed to isolate those portions of the program which define key size, GAKedness, etc. 2. Get it export approved. Export it. THEN 3. Announce that a "US-only" version of the same program is being released, and include the minimal component which replaces the limited software. Release it, only in the US of course! >The main point is that there is no such thing as the "letter of the law". >What they enforce is much broader than that, and how they enforce it is much >more subtle than clear-cut criminal prosecution. Therefore, you cannot just >use literal loop holes just because it's not clear, because the law they are >enforcing is not clear either. The system I describe doesn't even violate the spirit of the rules. If anything, it bends over backward to implement a foreign version of the software which ALREADY is export-approved at the time it was, um, upgraded. True, it's possible to sneak the extra component out of the country, but hey, it's also possible to sneak an entirely new program out of the country. I'm not suggesting that the company who writes the component takes it out, it'll happen regardless. If the order of the versions was reversed, the USG might complain that the export version was "too similar" to the domestic version. That's why you wait for the export approval before you write the domestic version.

4 3

SKIP
by rogaski＠phobos.lib.iup.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Can anyone remember the URL for SKIP for Solaris, that little piece of paper has become a victim of the clutter ... - ----- Mark Rogaski 100,000 lemmings rogaski(a)phobos.lib.iup.edu aka Doc, wendigo can't be wrong! http://www.lib.iup.edu/~rogaski/ VMS is as secure as a poodle encased in a block of lucite ... about as useful, too. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMYNYx0c4/pqJauBAQHPFwQAoG6wtJJsq9QJB2MU02G08Vo436jK0sZs XscSvlpKUtYbyJORj4ETVdfDAAoyQdjZFQQTeH4vt413DPbmqgwKs+QnBrI49evv UjhmcGvxFMj8DpkxiL+5ANu6nrzLWM9smUDWlpKTa3HN59Kq5shlHIlp+yo6AH08 AIInsCZh+YU= =jUrp -----END PGP SIGNATURE-----

1 0

Cyberia-L Archive [was Re: ERA_sur]
by Rich Graves 17 Dec '03

17 Dec '03

As somebody pointed out to me, Cyberia-L, like cypherpunks, is archived on http://www.hks.net/ and the public news server nntp.hks.net. Now send them some of the money you're going to make from the stock market. -rich

1 0

Re: News on Congressional Debate on Exon
by tcmay＠got.net 17 Dec '03

17 Dec '03

This is a VERY positive idea! At 3:54 PM 12/6/95, Peter Trei wrote: >Actually, I've been thinking about this quite a bit recently. I'm building >an SSL enabled server, and clent-side authentication may provide >some help. I could see a user getting his or her public key certificate >signed with different CA keys which assert any number of conditions, >such as: > >Key holder was born before (some particular date). >Key holder has access to sales data for XYZ corp. >Key holder is an adult who takes the first amendment seriously. > >... and the server would recognize different CA signatures as permitting >different levels of access. This is something that could get two things done: 1. Protect ISPs and Web sites from claims they aren't taking any steps to block children. (I won't get into the "children should be allowed to appreciate the beauty of the human body" issue, just noting that an ISP or Web site could deny access to account holders under 18, or over 30, or whatever he wants to do.) 2. Get wider currency for the concept of digitally signed credentials, especially if these are _blinded credentials_, where the credential is for an age, say, and not an identity. (Standard Chaumian stuff, though likely to be nontrivial to implement.) >If your browser permitted you to select the key certificate used in >setting up the encrypted link (and different certs or sets of certs >could be protected with different passphrases), then Mom or Dad >could use their I-am-an-adult credential to read www.xxx.com, >while Junior could not. There *is* a loss of anonymity in this scheme, >however. There may be ways around the loss of anonymity. Ideally, with blinded credentials, But in the short term, through Web proxies and/or servers. For example, Sameer's c2.org could issue accounts to people who can prove they are over 18 (notarized copies of birth certif., passport, etc.). Sameer's system would then have a credential saying "this account name is over 18." (There is of course little that can be done about people who lend their accounts to minors, absent any effective biometric security measures. No current system, certainly not Exon-Coates, can deal with this.) >I realize that digital credentials are old hat on this list. The point I am >making is that the pieces for doing this are here - we just need to >assemble them. > >(This is not to suggest that I am in favor of Exon/Coates in any way - >I am not. ) I think this could be quite a good project, provided it is not trying to be all things to all people. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Civilizing Cyberspace (book note)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Forward: Steven E. Miller, a member of the national board of directors of Computer Professionals for Social Responsibility, has published a new book, *Civilizing Cyberspace: Policy, Power and the Information Superhighway* (Addison Wesley, 1995, 413 pages). This is the best book I have seen on the public policy debates surrounding the information superhighway. It covers all aspects of this debate, including democracy, citizenship, community networks, privacy, intellectual property, competing models of the NII, universal service, equity, freedom of expression, protecting the public interest, encryption, and so on. Highly recommended for anyone interested in this subject, or for use as a text in classes. Gary Chapman, Coordinator, The 21st Century Project LBJ School of Public Affairs, University of Texas, Austin

1 0