December 2003 - cypherpunks-legacy

Privsoft
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

I hope Mr. Orrin has his asbestos codpiece well positioned.

1 0

Oct 14 meeting, focus on Java, Mountain View, California
by mrm＠netcom.com 17 Dec '03

17 Dec '03

Hello again - First, my sincere apologies for not making it clear in the first announcement that the Oct 14 meeting focussing on Java is being held in the bay area of California. Next, feel free to speak up for speaker slots if you're so inclined. I was surprised no one wrote in to ask for speaker slots although a lot of people wrote in to ask for more details on where the meeting was and others wrote in to chastise me (correctly) for being so bayAreaCentric. Saturday Oct 14 Time: 12 noon - 6 p.m. Place: Sparcy's cafeteria, building 21, Sun Microsystems Mountain View, California AgendaSoFar: 12 - 12:15 - Settle in, have a bagel 12:15 - 12:45 - Overview of Java/HotJava 12:45 - 2:00 - Java Security Model, Sami Shaio, Java group, Sun 2:00 - 3:00 - discussion, Q&A, open mike 3:00 - 3:30 - break 3:30 - 4:30 - Jcrypt, Doug Barnes, Amanda Chou 4:30 - 6:00 - TBD Directions: Take 101 to Amphitheater Parkway. Turn left onto Garcia, and drive about 1/2 mile and turn onto the first genuine side street which is named Marina Way. Drive about 1/4 mile and look for a right hand turn onto Coast. Building 21 will be on your left. It's on the corner of Coast and Marina Way. There's plenty of parking there. Internet: I'm trying to arrange to get a computer connected to the net in that room so that we can set up MBONE, but I don't know if that will be possible or not. Enough people wrote in to say that they'd like to hear a bit about Java and HotJava (and how Netscape is using Java) to convince me it would be a good idea to start off with setting some context. See you on Saturday! Should be fun. Marianne mrm(a)netcom.com mrm(a)eng.sun.com

2 1

IDEA algorithm
by Jonathan Zamick 17 Dec '03

17 Dec '03

This may be an odd question, but who is it that owns the IDEA algorithm? We've had a number of requests regarding licensing RSAREF tying into legitmizing PGP products. Part of that includes IDEA obviously. Anyway, take care. Jonathan

2 1

Cylink license fees
by cman＠communities.com 17 Dec '03

17 Dec '03

I just received a very informative package of information from Bob Fougner at Cylink, which, in addition to a copy of the relevant patents and hardcopy of the materials available on their web page, contains a "limited time offer" to license their patents in one of three ways: 1) Practice of DH Key exchange & DSS: $50,000 2) Right to use & distribute RSA: $62,500 3) Ulimited field of use to practice public key: $75,000 Those interested in obtaining this information should probably fax him at 408-735-6642 with a request for the info. Much of the information is available online at: http://www.cylink.com. Obviously, anyone wishing to practice RSA would also need to get a license from RSADSI. Also, it is my impression that are claiming Hellman-Merkle as the precursor patent to RSA, which means that this situation will prevail at least through late 1997, not early 1997 (when Hellman-Diffie expires.)

1 0

(no subject)
by Rob Lesan 17 Dec '03

17 Dec '03

I am a contractor currently working for Tandem Computers, and I found this press release interesting. Thought this group might need a target of a different flavor to kick around: SUBJECT: PRESS RELEASE: ATALLA WEBSAFE ATALLA BEGINS SHIPPING HARDWARE-BASED SECURITY FOR THE INTERNET SAN JOSE, CALIFORNIA - October 2, 1995 - Atalla, a Tandem Company, announces that the WebSafe Internet Security Processor is ready for shipment. Now you can use the same technology that made the "bank ATM" network safe enough for bank transactions to secure the Internet for commerce. "The Internet is a 'party-line' where everyone can jump in. Our vision is to make it a 'private-line' for those situations where privacy is essential for doing business on the Net," says Bob Gargus, President of Atalla. "When we set out to build WebSafe, we wanted a system safe enough to do bank transactions on the Internet. We're taking our 23 years of experience in financial network security systems and applying it to the Internet. WebSafe is the first Internet processor that gives banks and our other customers the security that they have come to trust Atalla to deliver," Mr. Gargus also noted. WebSafe is a hardware-based security processor specifically designed to help transform today's emerging point-to-point Internet security into a full end-to-end security system. Typical WebSafe applications include payments (such as credit cards), web commerce, certification authorities (electronic notarization), PEM (Privacy Enhanced Mail) and EDI. WebSafe's security architecture is the perfect solution for banks, brokerage houses, telecommunications companies, legal and medical institutions or anyone who needs to send sensitive data across the Internet. This revolutionary product protects transaction data against unauthorized access, disclosure, alteration, duplications and substitution. WebSafe supports both public (e.g. RSA) and secret key (e.g. DES) technology and employs sophisticated key management similar to global EFT/POS payment networks. HOW THE WEBSAFE WORKS Attached as a peripheral device to your Web servers, the WebSafe processes your secret information in a "hardware-secured envelope." But unlike software security solutions which are vulnerable to attack from cyber-pirates, the WebSafe is both physically and logically secure. Physically secure means that if anyone tries to penetrate the WebSafe, it will "zeroize," erasing the secret data so it's impossible to retrieve. Logically secure means that, because all of the security processing is done within the WebSafe security processor, it's impossible for anyone to ever see your cryptographic material. WEBSAFE IS THE BRIDGE FROM THE INTERNET TO THE PAYMENT NETWORK The best example of a major deployment of an end-to-end security network is the bank ATM system. Today, 100% of all bank ATM transactions in North America have hardware-based security, 70% of which is provided by Atalla. The Internet is currently going through the same evolution that the bank ATM network went through 20-plus years ago. What's holding back electronic commerce on the Internet today is payments. The truth is, banks are the payment network. You simply can't have payments without them. However, the bank payment network and the Internet operate very differently. For example, the bank payment network primarily relies on secret keys (like DES) for security, while the Internet typically relies on both secret and public keys (like RSA). But because the two networks operate differently, a bridge needs to be built between them. "WebSafe is the bridge from the bank payment network to the Internet. It combines the best of both worlds (DES and RSA) into a single unit. And, it's the only secure DES to RSA translation device available today... The point is, we're not reinventing here. We're taking proven technology that has been time tested, under the most demanding conditions, and applying it to the Internet," states Gary Sabo, Vice President of Product Management and Marketing for Atalla. WEBSAFE'S CERTIFICATION AUTHORITY SUPPORT: HOW TO VOUCH FOR SOMEONE ON THE INTERNET. One new service that is arising is the need for electronic notarization by Certification Authorities. They'll provide proof that you are who you say you are. Major credit card companies, banks, telecommunications companies and post offices are the most likely institutions to pick up this role. The WebSafe is designed to be the cornerstone for supplying cryptographic services for Certification Authorities. WEBSAFE'S SECURE KEY MANAGEMENT. When most people talk about cryptographic security, they're talking about a single key type. It's impossible to have security with this method. There must be different keys for different functions. Atalla employs a key architecture that includes hierarchal support for a wide variety of key types, such as: Key exchange key, data encryption (DES and RSA), PIN data, Message Authentication Code (MAC), digital signatures, and certificates. Applying different key types for different functions restricts how a key is used and can prevent a security system from being spoofed into giving up secret data. This way, even through the most complicated series of transactions, your data is kept secure. Founded in 1972 and acquired in 1987 by Tandem Computers Corporation, Atalla designs, manufacturers and supports secure on-line transaction automation systems for financial, retail and business applications. Atalla's products include POS/POE credit/debit payment terminals, check readers, security processors for the Internet and other networks, customer authorization and PIN selection terminals and secure enrollment products for banks, retailers and state EBTs. The company is headquartered at 2304 Zanker Road, San Jose, CA 95131. Phone: (408) 435-8850, (800) 523-9981. Fax: (408) 435-1116.

1 0

(fwd) checkfree/cybercash diff
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 12 Oct 95 14:34:46 +0100 From: Holger.Reif(a)PrakInf.TU-Ilmenau.DE (Holger Reif ) To: www-buyinfo(a)allegra.att.com Subject: checkfree/cybercash diff Hi all, I studied both websites regarding their wallet system. I noticed a press release that checkfree will license cybercash technology and develope products. I saw _no_ release that checkfree has already released a cybercash wallet compatible SW. But I cannot find any difference between cybercash wallet and checkfree wallet. Is it behind the open part of the tech information? Who can make things clear??? read you later - Holger Reif http://remus.prakinf.tu-ilmenau.de/Reif/ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

smartcard encryption: revised paper available
by Matt Blaze 17 Dec '03

17 Dec '03

I've put a (slightly expanded) revised version of my paper, "High- Bandwidth Encryption with Low-Bandwidth Smartcards" in my ftp directory. This paper describes a little protocol for exploiting the secure key storage facilities of slow smartcards but with the host processor doing most of the actual work. ftp://ftp.research.att.com/dist/mab/card_cipher.ps -matt

1 0

FWD: International Encryption Protocols
by Weld Pond 17 Dec '03

17 Dec '03

To: "Frank O'Dwyer" <fod(a)fws.ilo.dec.com> cc: firewalls(a)GreatCircle.COM (Firewalls Mailing List) From: Justin Mason <jmason(a)iona.ie> Subject: BoS: Re: International Encryption Protocols Frank O'Dwyer sez: >After all, if the CoCom countries _weren't_ willing to sell each other >crypto equipment, how could they spy on one another? :-) > >(Actually the :-) may not be necessary - I believe there was a story > in the news recently about the UK 'authorities' snooping on Irish > official traffic carried on UK-supplied equipment.) Almost right -- it was the UK surveillance service (GCHQ) snooping on Irish official traffic carried on US-supplied crypto equipment. Apparently, the equipment in question had a "back door", courtesy of the NSA; when GCHQ found out that the Irish govt were using this equipment, they had only to ask their NSA pals for the details. I only heard the details myself via a popular-science program on crypto ;), so the so-called back door may not have been a deliberately weakened algorithm, it may have been a set of keys from an key-escrow repository or some such. --j. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

1 0

Identity database, another attempt...
by Brad Dolan 17 Dec '03

17 Dec '03

Well, you ungrateful wretches objected to our great employment database and national ID card plans when they were presented as a means of immigration control. How about this, then: We need an employment-tracking database and licenses for everything so we can crack down on "deadbeat dads." Now that sounds more plausible, doesn't it! Please? We really want to track you closely. It's for your own good, you know. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - AP reported on 10/12/95: Deadbeat parents beware: Pay up or lose your license. And not just your driver's license. Your hunting, fishing, trapping, boating, occupational and professional licenses may be taken away too. That's the promise that Congress, intensifying the fight against parents who refuse to support their children, intends to send to millions of deadbeats as it writes final legislation to transform the nation's anti-poverty programs. ... Central to [House and Senate proposals ...] is a requirement that every state have a program to revoke or restrict the licenses of parents who fail to pay, along with a central registry to track new hiring and match employment records with child support obligations. ... [Can you say "10th Amendment," Robert Dole? I knew you could! You are against this, aren't you Bob? Bob? Bob??!!] The Department of Health and Human Services ... estimates that if every state had a license revocation program in place, child support collections would grow by $2.5 billion over 10 years. [During which time the federal government will spend $20,000 billion. Relative peanuts, in other words.] According to HHS, 32 states and Puerto Rico now have laws on the books to restrict or revoke driving privileges and professional, occupational or sporting licenses. ... ^^^^^^^^^^ [Note that driving, necessary for living in most places, is now a *privilege* granted by the government. In other words, *living* is a government-granted privilege.] Paula Roberts, a child support expert with the Center for Law and Social Policy, a liberal research and advocacy group in Washington, said license revocation programs can be effective -- but only if states have the necessary computers in place. ... Essay questions for extra credit: (1.) Explain how an advocate of the proposed system of monitoring and control could be considered "liberal." Or "conservative." (2.) How many (ab)uses of this system are possible and how long will it take for them to be implemented? (3.) Compare and contrast this plan with the Soviet internal passport / labor book system.

5 4

Anguilla Cypherpunks Meeting
by Vincent Cate 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ANGUILLA CYPHERPUNKS MEETING The meeting will be held at my house, Sunday Oct 29. My address is "Old Ta". Really, we have only a couple named streets in this country and no street signs or addresses. My area is called "Old Ta" because the Old Water Tower was near me. :-) If you don't know where I live you are probably off-island, and I can just pick you up at the airport. You are welcome to stay the week around the meeting (like Oct 25 to Nov 1 or some such). Anguilla is a fantastic little country in the Caribbean with wonderful beaches and no taxes. I have been living here for almost a year now and just love it. Right now American Airlines has some specials on that make flying to Anguilla a bit cheaper than normal. For example: New York to Anguilla $365.95 rt San Jose to Anguilla $574.95 rt For these prices the tickets must be purchase by Oct 16th. Please let me know if you are coming so I will be sure to have enough space. If we get too many people we may need some airmattresses or something. It is warm here, so sleeping bags are not needed. If while you are outside the USA you want to write some software that uses encryption and sell it worldwide, let me know. I could put you up while you wrote it and my company could sell it for share of the selling price. Let me know what you are thinking of and how long you think it would take. -- Vince -----BEGIN PGP SIGNATURE----- Version: 2.6.i iQCVAgUBMH0ZDsh6X5WuK8MNAQFqZAP+IF9OvHRsCFuRVGxH3q9jSC8Hh5rxvv9C Z6xD52PdxADM5RLxOwiuhWITStbpNL9R4T+v+mu6VnjPgifnORrS7mEM4tsmWTLT 9LJ9R4p8Q51hjXy889AOcB6Tl0rmkXouRklzYKeq/m0PnL2smt6WDF3owgq65c73 4/odioz0Oic= =6pbC -----END PGP SIGNATURE-----

7 9