December 2003 - cypherpunks-legacy

Security Policy Documents
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

From: URL: http://csrc.ncsl.nist.gov/secplcy/ Computer Security Resource Clearinghouse WWW Server _________________________________________________________________ SECURITY POLICY DOCUMENTS These are computer security policy documents, primarily from the Department of Commerce, and the Office of Management and Budget. [?] Search Security Policy Documents a130app3.txt [62983 bytes] 1995-03-29 Proposed Revision of OMB Circular No. A-130 Appendix III doj-fg.zip [172668 bytes] 1994-07-04 "Searching and Seizing Computers," U.S. Dept. of Justice, Federal Guidelines, July 1994 (zipped WordPerfect file) omba130.txt [80748 bytes] 1994-06-06 Office Management and Budget cryptpol.wp [68689 bytes] 1994-03-01 Cryptography: Policy and Technology Trends doc-copy.txt [4600 bytes] 1993-11-23 Department of Commerce's Software Copyright Policy doc-poli.txt [86434 bytes] 1993-11-23 Department of Commerce's Chapter 10 of the DOC IT Management Handbook, which contains the IT Security policies for the Dept. doc-man.txt [253689 bytes] 1993-11-19 Department of Commerce beginning sections of the DOC "Information Technology Security Manual" a130.zip [26986 bytes] 1992-06-08 Proposed Revision to OMB Circular A-130 sec_2315.txt [2150 bytes] 1992-02-27 Sect. 2315 of U.S. Code Title 10 omb_a130.txt [97630 bytes] 1992-02-27 OMB Circular A-130, "Management of Federal Information Resources" opm_plcy.txt [12951 bytes] 1992-02-27 Computer Security Training Policy csa_87.txt [153493 bytes] 1992-02-27 Computer Security Act of 1987 rfc1244.txt [253471 bytes] 1991-11-08 Very good summary of site security policies

1 0

SSZ is moving on 9-16-97...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, SSZ will be moving on the 16th. We are expecting no more than a couple of hours of downtime. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

GAK/weak crypto rationale?
by P.J. Ponder 17 Dec '03

17 Dec '03

After reviewing the reports filed by our intrepid reporters in the field about the NIST meetings, I am left with a puzzling thought: Why are the NSA and the FBI so very keen on GAK and weak crypto? There was posted on this list some time back a statistic about the number of wiretaps and intercepts requested and authorized in the past year. As I recall, the number was quite small - around 12K [?]. Someone had found this out through an FOIA request, perhaps, (my recollection of it is poor). It was not a large number, anyway. I must conclude that the actual number of intercepts is much, much larger than they are saying, and that they must be getting what they perceive to be good intel from all this snooping. Otherwise, why would the NSA and the FBI be so gung-ho on this, when everyone is telling them it is bad for US software business, abhorrent to privacy rights, unenforceable, and just plain bone-headed in these new international geodesic network times? -- PJ p.s. -thanks for the reports, well done. I think most of the list readers are very appreciative of the coverage provided on Crypto95 and NIST sham.

1 0

t0902mt01.html
by Damaged Justice 17 Dec '03

17 Dec '03

[1][LINK] Calgary Herald BUSINESS _________________________________________________________________ Managing Your Money [2]Stock and Mutual Fund Quotes [3]Your Investments [4]Family Finance [5]Columns [6]Technology [7]Stock News [8]Search --> [9][LINK] [10]Calgary Herald Online Home Page [Main Menu............] __ Press group refuses to join Internet rating scheme Amy Harmon The Ottawa Citizen A group of major news organizations took the digital high road last week. The group members -- which include Time, CNN, the New York Times, the Wall Street Journal and the Associated Press -- said they would allow their online editions to be rendered invisible to some Internet users rather than conform to a rating system that screens material dealing with sex or violence. "We support open access to information on the Internet," the group said in a statement. "And we will not rate our sites." That such a proclamation would be necessary, that it would be hashed out in a tense meeting that was closed -- oddly, given its agenda -- to reporters and that it would be considered an important step forward by many of the executives participating is itself a commentary on the uncertain state of the free press on the Internet. But the electronic news publishers left unresolved the more baffling question of how to wedge such a seemingly routine commitment to the U.S. constitution's free-speech guarantees into the architecture of cyberspace and the cultural politics of the United States in the late 1990s. The bind that Internet news providers find themselves in began with the U.S. Supreme Court's ruling earlier this summer that the Communications Decency Act was unconstitutional. The court found that the law, which banned the transmission of indecent material to minors over computer networks, was an overly broad restriction on speech -- in part because existing technology would allow parents to control their children's access to such material. Eager to head off regulation, the online industry expressed enthusiasm for various rating systems at a meeting convened by the Clinton administration after the decision. Microsoft and Netscape, which together control the market for the browsers used to navigate the World Wide Web, agreed to incorporate a standard for ratings in the next release of their software. Theoretically, the standard (known awkwardly as the Platform for Internet Content Selection, or PICS) would allow any entity from Good Housekeeping to the Spice Girls to create a rating system. The browser would recognize all of them, and parents could choose the one that best fit their world view, or at least the lens they wanted their children to see through. But so far, the only major group to use PICS has essentially adapted to the Web a rating system designed for video games. Under the Recreational Software Advisory Council system, sites rate themselves on a scale of one to four for nudity, sex, violence and offensive language. The council, a non-profit association of entertainment and computer companies, performs random checks to make sure sites are representing themselves correctly. Parents can set the level of each category that they wish to screen for, and, significantly, unrated sites are blocked out. So far, about 40,000 of the Web's nearly one million sites have used the system. News sites, however, have for the most part found the ratings either inapplicable or abhorrent. "The rating of content, particularly in the area of violence -- to tell people whether they should or shouldn't read about war in Bosnia -- takes news and turns it into a form of entertainment," said Daniel Okrent, editor of new media at Time. It is perhaps not surprising that an entertainment-based rating system would be incapable of describing the vast quantities and qualities of information on the Internet. Religious organizations and government agencies are also reportedly unhappy with the Recreational Software Advisory Council's limitations. But the problem is more than just a given rating system. It is inherent in the technology -- or at least the purpose it is being used to achieve. Because to screen out certain material, like sexual images, every site has to be labelled in some fashion. "In the real world, you don't know what you're going to get before you get it," said Paul Resnick, one of the creators of PICS. "We're trying to create an online world where you do know what you're going to get, and once you set that as your priority, you have to start classifying things." To accommodate the concerns of news sites, the Recreational Software Advisory Council has proposed a "news" label that would rate by category, not by content. But that raises the question of how and who would define which sites would bear the designation. The ratings group had appealed to the Internet Content Coalition, a loose alliance of online news organizations that organized last week's meeting, to serve as a monitoring body. The idea was denounced by several attendees, but they did not offer a better one. _________________________________________________________________ We welcome your suggestions; send e-mail to [11]online(a)theherald.southam.ca This web site is a supplement to the Calgary Herald, a daily newspaper published in [12]Calgary, Alberta, Canada. Contents copyright 1996. [ [13]Calgary Herald Home Page ] References 1. http://ads.galaxy.southam.com/OAS/rm/try-it.cgi/www.ch.com/b-mm-m-1.htm 2. http://www.southam.com/calgaryherald/cgi/finance/stocks&funds/overview.pl?p… 3. http://www.southam.com/calgaryherald/cgi/newsnow.pl?nkey=ch&file=/business/… 4. http://www.southam.com/calgaryherald/cgi/newsnow.pl?nkey=ch&file=/business/… 5. http://www.southam.com/calgaryherald/cgi/newsnow.pl?nkey=ch&file=/business/… 6. http://www.southam.com/calgaryherald/cgi/newsnow.pl?nkey=ch&file=/business/… 7. http://www.southam.com/calgaryherald/cgi/newsnow.pl?nkey=ch&file=/business/… 8. http://www.southam.com/calgaryherald/cgi/newsnow.pl?nkey=ch&file=/business/… 9. http://ads.galaxy.southam.com/OAS/rm/try-it.cgi/www.ch.com/b-mm-b-1.htm 10. http://www.southam.com/calgaryherald 11. mailto:online@theherald.southam.ca 12. http://www.southam.com/calgaryherald/almanac/almanac.html 13. http://www.southam.com/calgaryherald

1 0

Re: Document Fingerprinting
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Will French: > Sounds like a disaster to me, unless it can be done >automatically, by a proven-correct program. I used to use >commercial compilers that (at least claimed to) put their >"stamp" on the assembly code they generated, so they could sue >if you released a product without having a license for the >compiler. Bugs are bad enough as it is; we don't need extra >ones that only show up in some copies! I seem to recall a lawsuit where somebody like Tandy was suing somebody else, claiming they copied the computer's rom code. As proof they pulled out the competitors computer, pressed a certain key combination, and the Tandy copyright flashed up on the screen. As I also recall, they LOST the suit believe it or not... Anybody heard of this? Cerca 1988-1991 I believe. Sure shows what a slick lawyer can get you out of... Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMFO+acLa+QKZS485AQFNCQL+L/HtUtC//QAi8II8Ktf7bZjSt3YRdmBf /zNieoiM5buZDAlC/GHR4bw4RJl5qWbY33r8QB4akR4b108Fvf0BxkUCgPmdI95f f+MHqxcRLfwgcoj0XiwxMrR9pQyJEv4B =8myc -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://bert.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Death threats ALWAYS pgp signed * This user insured by the Smith, Wesson, & Zimmermann insurance company *

2 1

Clinton, Commerce, and Crypto scandal
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Ira Sockowitz moved from commerce to SBA taking a few things with him: An excerpt: The classified information Sockowitz took was so sensitive it threatened to put the National Security Agency, or NSA, out of business, because the files included information about encryption chips (which safeguard computers) that the spy agency itself can't break. These are files for which high-tech companies lust and countries would kill. http://members.aol.com/beachbt/socko.htm

4 3

GAK Advisory Board
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

>From URL: http://csrc.ncsl.nist.gov/csspab/minutes.395 Minutes of the March 22-23, 1995 Meeting of the Computer System Security and Privacy Advisory Board Wednesday, March 22, 1995 Introduction A quorum being present, the Chairman, Dr. Willis Ware, called the meeting to order at 9:00 a.m. at the Holiday Inn, Gaithersburg, Maryland. Besides Dr. Ware, the following Board members were present: Charlie Baggett Jr., Genevieve Burns, Cris Castro, Don Gangemi, Sandra Lambert, Henry Philcox, Randy Sanovic, Stephen Trodden, Steve Walker [TIS], and Bill Whitehurst [IBM]. [Snip long section on security assurance standards and methods in US, Canada and UK.] Update on X/Open Branding Project Mr. Bill Whitehurst, IBM, gave a brief update of the activities of the X/Open Branding Project. Two major components exist within their branding concept: (1) the ability to implement functionality based on a minimum set of assurance functionality requirements (MSFR), and (2) the confidence in the development process for achieving the functionality. He said that the workgroup meeting, hosted by Hewlett Packard, was held early in March. The group plans to re-write their document to include some type of evaluation process prior to the vendor product getting branded. X/Open plans to have a public review of the changes this summer. Vendor Perspective Ms. Linda Vetter, Oracle Corporation, presented oracle's views of security assurance. She discussed three types of assurance issues: (1) governent evaluation and certification; (2) third party evaluation and certification (government and business sponsored); and (3) vendor claims. Ms. Vetter explained Oracle s evaluation experience for two DBMS server product s, Oracle7 and Trusted Oracle7, in both the US and the UK. Oracle used the US TCSEC TPEP evaluation for B1 and C2 systems. They also used the UK ITSEC evaluation for E3 systems (which is the equivalent for US B1 and C2 systems). The UK process took significantly less time and cost less money for an identical product. Ms. Vetter suggested that NIST/NSA look into developing equivalent/comparable trust levels between the two different evaluation criteria methods as well as those for other countries. This would minimize the need to have different evaluations performed (one for each country) for the same product. Oracle has on-going work in other areas (e.g., RAMP, CMM, ISO, and Audits) as well as multiple CLEFS with the UK, Sweden, France and Germany. Ms. Vetter explained the differences in criteria between the TCSEC and the ITSEC. She said that the ITSEC requirements for the content of evaluation deliverables formed a superset of the corresponding TCSEC requirements for the evaluations. However, the TCSEC creates a framework for the presentation of these requirements and there can be little deviation from this. Oracle would like to see more concentration on low-end assurance requirements and processes. This would enable various sectors like health care, banking, and financial industries to have protection for unclasified to sensitive data. Ms. Vetter encouraged NSA to continue its efforts in modeling (Common Assurance Framework, TCMM, and SE CMM) and would discourage any more efforts in product profiling. The modeling efforts encourage vendor quality improvement, promotes flexibility in meeting assurance objectives, and are transferable to other private sector domains besides DoD. (See Reference #8). Wrap-up and Restatement of Issues Dr. Katzke summarized the discussion of assurance by saying that opportunities exist to look at alternatives. He is not sure what the government's role is or which areas to concentrate on with respect to cost. He said that he could continue with the same level of effort that is going on now with community involvement. He is open to suggestions with regard to the assurance process. Discussion After a lengthy discussion on the state of the Common Criteria (CC) and assurance approaches and issues, some of the major points from individual Board members included: - Concern as to when the CC will be widely accepted and used; - Whether to adopt the ITSEC now and migrate to CC; - The need to simplify the CC; - Building assurance and quality into the new assurance framework; - Clearly define assurance needs to be universally understood; - Conduct more C2 and below evaluations in the US; - Concentrate on low-end assurance; and - Bring key industry players into the process. [Snip] Board members continued their discussion of criteria and assurance from the previous day. Some of the major points of the discussion from Board members included the need: - for OMB to state the need for C2 level evaluation compliance for various government product purchases; - for NSA to make a statement about equivalency among all existing non-US trust levels; - to begin using components of the Common Criteria and gradually migrate to it; - to continue a wide range of assurance framework options and procedures; and - to focus on low-end assurance methods and encourage C2 level evaluation along the following Canadian AL-1 evaluation. [Snip] Status of Key Escrow Initiative Mr. Steve Walker, Trusted Information Systems (TIS), briefed the Board on the status of Commercial Key Escrow (CKE). He said, with regard to application vendors, TIS is actively seeking the participation of commercial software vendors in widespread implementation of CKE enabled software products. TIS has installed a Data Recovery Center (DRC) on the Internet and is prepared to distribute sample DRC application software packages to any interested software application developer. TIS is seeking approval of the US government for export of application programs using encryption algorithms such as the Data Encryption Standard (DES) when properly bound with CKE. Mr. Walker said the advantages of CKE for government interests is that if the TIS CKE system were to become widely used throughout the private sector and government communities, law enforcement, national security and private sector interests would be preserved. Mr. Walker said that TIS has filed for patent protection for its Software Key Escrow (Clipper equivalent) and CKE systems including the DRC and application software approaches. TIS is prepared to license its CKE system and software applications technology to any software or hardware vendor under very favorable licensing terms. TIS is also prepared to license its DRC system and technology to qualified DRC operators and vendors under similarly favorable licensing terms. (See Reference #13). [Snip] ---------- >From URL: http://csrc.ncsl.nist.gov/csspab/csspab.txt National Computer System Security and Privacy Advisory Board Identifying Emerging Computer Security Issues What is the Computer System Security and Privacy Advisory Board (CSSPAB)? Congress established the CSSPAB as a public advisory board in the Computer Security Act of 1987. The Board is composed of twelve members, in addition to the Chairperson, who are recognized experts in the fields of computer and telecommunications systems security and technology. What is the Board's purpose? The Computer Security Act specifies that the Board's mission is to identify emerging managerial, technical, administrative, and physical safeguard issues relative to computer systems security and privacy. What is the scope of the Board's authority? The Board examines those issues affecting the security and privacy of sensitive unclassified information in federal computer and telecommunications systems. The Board's authority does not extend to private-sector systems or federal systems which process classified information. What are the board's advisory and reporting functions? The Board advises the Secretary of Commerce and the Director of the National Institute of Standards and Technology (NIST) on computer security and privacy issues pertaining to sensitive unclassified information stored or processed by federal computer systems. The Board reports its findings to the Secretary of Commerce, the Director of the Office of Management and Budget, the Director of the National Security Agency, and appropriate committees of Congress. How often and where does the Board meet? The Board holds its two-day meetings twice per year; however, additional meetings may be called at the Chairperson's discretion. Board meetings are held in the Washington, DC metropolitan area as well as other areas in which there is significant federal computer security interest and activity. Are Board meetings open to the public? In accordance with the Federal Advisory Committee and Government in Sunshine acts, Board meetings are announced in the Federal Register and are normally open to the public. The Board accepts written statements from the public (see address on reverse). How is CSSPAB membership determined? The Director of NIST of the Department of Commerce appoints Board members for four-year terms. By law, the membership of the Board is distributed as follows: - Four experts from outside of federal government, one whom is representative of small- or medium-size firm; - Four non-government employees who are not employed by or a representative of a producer of computer or telecommunications equipment; and - Four members from the federal government, including one from the National Security Agency of the Department of Defense. Nominations to fill vacancies on the Board may be submitted to the Director of NIST. NIST personnel serve as the Board's Secretariat. Other federal agency personnel may also assist the Board's activities as specified in the Computer Security Act of 1987. Are Board members paid for their service? Board members do not receive a salary or stipend; however, authorized travel expenses are reimbursed as specified by Congress. ******************************************************* For further information, please contact: Computer System Security and Privacy Advisory Board Executive Secretariat National Computer Systems Laboratory Technology Building, Room B-154 National Institute of Standards and Technology Gaithersburg, MD 20899

1 0

Re: question about reputation
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Wei Dai writes: > For example, Alice starts a anonymous consulting service, and announces > that she will answer the first ten queries for free. Upon hearing this, > Mallet immediately starts another consulting service, and announces the > same offer. At this point Mallet can simply forward his customers' > queries to Alice and Alice's answers back to his customers. Thus, he gains > reputation at no cost. Well, long term he won't be able to keep it - what will he do when Alice starts charging for her services? He can charge more than she does, and they'll have equivalent "accuracy ratings" but Alice will provide her services more cheaply - or he can stop asking Alice and make up his own answers (or not answer) and his repuation will drop quickly. While I admit that I'd be pissed off if I were Alice, Mallet isn't really harming her - she gets business at the rate she's established. If Mallet's customers and Alice's don't overlap (maybe Mallet speaks/ writes in a different language, or has different friends) then it's arguable that Mallet is doing Alice a favor. If Mallet continues to purchase answers from Alice (even if he charges his customers more) his reputation isn't really false, if you think of it as meaning "can provide good answers to questions" versus "can figure out good answers to questions by himself". More proactively, Alice might choose to publish the questions and answers publically (the customers are, after all, anonymous, and only revealing as much about themselves as they'd reveal to an unknown party - Alice could sanitize the questions of identifying facts even further, if appropriate) - this would prove her aptitude (or lack thereof) to a wider audience, and Mallet's customers could notice that she was providing answers to their questions (how did she know of their questions?) before Mallet does. Alice could also choose to answer questions for free, but only to named and well-known parties with good reputations. This is a standard trick for new consultants/businesses - work cheap or free for a person or business that comes in contact with many people or gets lots of publicity. Cochran, Shapiro, et al could make a fortune from the Simpson trial even if they didn't charge OJ a dime - people charged with serious crimes will be calling them for years to come because of their media exposure. If Alice is paranoid, the well-known party could post a bond with an escrow agent, to be returned when they posted a public evaluation of Alice's services. > On the other hand, this "man-in-the-middle" attack can also work against > conventional True Name based services, but perhaps with less effect. Has > anyone ever heard of this being done? This "man-in-the-middle attack" is called, variously, arbitrage or capitalism. :) You've rediscovered Marx' surplus value theory of labor. (shh, don't say any more, or someone will say we're using language wrong.) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFPCmH3YhjZY3fMNAQEzTAP/dJFeg828BVuqS06deN15ILrX/13q2iSa seMCWXJMxOmRPS+oS7vbJtJ8jIhEJVlg+p9Un/rstD4QM7q6PRgKw9daq5LMav3y S+i0sYKEBnMmF+q5Ocm6EshHCAYs9sQOkM7hxr0rq0vhX3onFlpAIVBmUhz4BjtX YtoSpLWQ62U= =i8Zt -----END PGP SIGNATURE-----

1 0

Re: GAK Advisory Board
by tcmay＠got.net 17 Dec '03

17 Dec '03

Thanks to "Anonymous" for sending this to us. I visited the site, http://csrc.ncsl.nist.gov/csspab, and there seem to be some interesting things there. At 4:50 AM 9/11/95, Anonymous wrote: >Status of Key Escrow Initiative > >Mr. Steve Walker, Trusted Information Systems (TIS), >briefed the Board on the status of Commercial Key Escrow >(CKE). He said, with regard to application vendors, TIS ... >Mr. Walker said the advantages of CKE for government >interests is that if the TIS CKE system were to become >widely used throughout the private sector and government >communities, law enforcement, national security and >private sector interests would be preserved. If Data Recovery Centers are indeed completely choosable by the users, as certain statements by TIS folks have asserted, then how would "law enforcement" and "national security" interests be "preserved"? (I can tell you that BlackNet won't be using any government-approved DRCs. Nor will Kizer Sose be using any registered and licensed DRCs. If people are free to pick DRCs--the only option a free society can support--the results are obvious.) Note also the emphasis on "throughout the private sector and government communities" as leading to this protection of law enforcement and national security interests...no mention of this being mainly for export issues...the focus seems to be on domestic use of CKE, with the "law enforcement" and "national security" needs "preserved." Sounds ominous to me. I've used "Tim's Really Flaky Commercial Key Escrow Service" as a placeholder for the kind of truly voluntary DRCs many of us would insist on. (Other examples: a computer on my LAN, the bit bucket, my neighbor, my lawyer, my bank in Lichtenstein, etc. Some of these are actually what I would want to use. I can imagine interesting situations wherein attorney-client privilege blocks access to the keys.) So, what's the story? Is Steve Walker of TIS supporting the kind of completely voluntary CKE system that Carl Ellison has advocated? Or a mandatory system? (A third imaginable possibility is "a system which is so universally popular that it becomes universally used"...unlikely in the extreme, as I know of at least a few people who won't use it, and expect others to bypass it when they learn what the Feds can do. But I expect that the advocates of the mandatory option will cite this possibility, as a way of sugar-coating the proposal. Then, if this option fails (to preserve the Government's interests!), watch for registration of DRCs.) I met Steve Walker once, at the CFP Conference, and he seemed genuinely interested in selling to citizens a voluntary system. But his comments to the Privacy Advisory Board seem to imply a CKE system that would not be completely voluntary in the operation (licensing, registering. auditing) of Data Recovery Centers. If this is the case, then alternatives to the TIS system will likely gain more adherents from folks like us. >Mr. Walker said that TIS has filed for patent protection >for its Software Key Escrow (Clipper equivalent) and CKE >systems including the DRC and application software >approaches. TIS is prepared to license its CKE system >and software applications technology to any software or >hardware vendor under very favorable licensing terms. >TIS is also prepared to license its DRC system and >technology to qualified DRC operators and vendors under >similarly favorable licensing terms. (See Reference >#13). The TIS system may be patented, but it seems to me that the older ideas of Shamir secret sharing are not. And even simpler schemes of sealing parts of keys in several envelopes... (My point is that older ideas of using crypto in conjunction with emergency recovery systems are still usable, and have been talked about for many years, long before the TIS disclosures.) I hope it doesn't come to this. I hope TIS releases or licenses on very general terms, with no government control of the DRCs. If not, I predict their system will be subject to derision, and worse. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

GAK Advisory Board 94
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

>From URL: http://csrc.ncsl.nist.gov/csspab/94-rpt.txt Executive Summary This Annual Report documents activities of the National Computer System Security and Privacy Advisory Board during 1994, its sixth year. During the year, the Board continued to review cryptography related issues. During 1994, the Escrowed Encryption Standard (EES) and the Digital Signature Standard (DSS) were approved as Federal Information Processing Standards (FIPS 185) and (FIPS 186) respectively. The Board heard briefings on escrowing release procedures, escrow program procedures, U.S. export procedures, international cryptography proposals, international corporate key escrow, alternative key escrow approaches, and software-based key escrow encryption. The Board also continued to follow activities related to the Common Criteria (CC), which remains in draft form. [Comments on the CC will be reviewed and processed in March 1995.] The Board continued to examine the question as to whether there is a business case for setting up a Trusted Technology Assessment Program (TTAP). Membership Currently, Dr. Willis H. Ware, a senior researcher of the Corporate Research Staff of RAND, serves as Chairman of the Board. He was appointed in July 1989. As of December 1994, the membership of the Board is as follows: - Chairman Willis H. Ware, RAND - Federal Members Charlie C. Baggett, Jr. National Security Agency Henry H. Philcox, Department of the Treasury, Internal Revenue Service Cynthia C. Rand, Department of Transportation Stephen A. Trodden, Department of Veterans Affairs - Non-Federal, Non-Vendor Genevieve M. Burns, Monsanto Corporation (Member Designate) Cris R. Castro, KPMG Peat Marwick Sandra Lambert, Citibank Randolph Sanovic, Mobil Corporation (Member Designate) - Non-Federal, Vendor Gaetano Gangemi, Wang Laboratories, Inc. Linda Vetter, Oracle Corporation (Member Designate) Stephen T. Walker, Trusted Information Systems, Inc. Bill Whitehurst, International Business Machines Corp. In December of 1994, Ms. Cynthia Rand resigned from the Board, leaving a vacancy in the federal member category. II. Major Issues Discussed The work of the Board during 1994 was devoted to various topics related to security of federal unclassified automated information systems. Among the most important were: - Cryptographic Key Escrowing Procedures - Alternative Key Escrow - Security in the National Information Infrastructure (NII) Escrowing Release/Program Procedures The Department of Justice briefed the Board on procedures for release of cryptographic key components, by the two escrow agents, to government agencies. The two escrow agents at the National Institute of Standards and Technology (NIST), of the Department of Commerce and the Automated Systems Division of the Department of Treasury. The agents act under strict procedures to ensure the security of the key components and which govern their release for use in conjunction with lawful wiretaps. NIST discussed the procedures for the key escrow program. Five federal agencies share a role in the key escrow program: (1) the Department of Justice is a sponsor and a family key agent that holds one of the components of the family key, (2) the Federal Bureau of Investigation is the initial law enforcement user and a family key agent that holds the other component of the family key, (3) NIST has a dual role as the program manager and a key escrow agent, (4) the Department of Treasury is a key escrow agent; and (5) the National Security Agency is the system developer that provides technical assistance. Alternative Key Escrow Bankers Trust presented some rationales for key escrow encryption for corporations, which fulfills management supervision and compliance duties, and reduces business risks. They maintain that the Bankers Trust system can meet both U.S. and European needs. Their system has been discussed with Canada, Britain, France, Singapore, and the U.S.; however, none of these countries have endorsed the system. Trusted Information Systems, Inc. gave a demonstration and overview of their approach to software-based key escrow encryption. They said that software key escrow systems could be built that meet the objectives of law enforcement. Also, that variations of their software key escrow system can provide a commercial key escrow capability that will be very appealing to corporate and individual computer users. They believe that widespread use of corporate key escrow, in which corporations operate their own key escrow centers, and individual key escrow, in which bonded commercial key escrow centers provide a key retrieval capability for registered users, will better achieve the key escrow objectives of law enforcement than a government-operated key escrow system. [Snip 180kb of very informative docs on the main US cryptography issues of 1994, still alive in '95.]

1 0