December 2003 - cypherpunks-legacy

CryptoAPI and export question
by m5＠dev.tivoli.com 17 Dec '03

17 Dec '03

Tom Johnston writes: > We would ship a CSP development kit to a foreign vendor, and sign a CSP > developed by the foreign vendor, but only with the appropriate export licenses. So you'll only perform the signing operations in the United States? In other words, what if I'm in Egypt, and I develop a CAPI-compliant DLL (or whatever). Could I go down to the Cairo Microsoft office and get my stuff signed there? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Nobody's going to listen to you if you just | Mike McNally (m5(a)tivoli.com) | | stand there and flap your arms like a fish. | Tivoli Systems, Austin TX | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

[Local] Update Information for Portland Cpunks Meeting
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Portland Cypherpunks meeting is still on. We will be having a key signing. Reminder about time and location: Location: The Habit Internet Cafe 21st and Clinton in Portland OR http://www.teleport.com/~habit/ for more info. Date: January 20th, 1996 (THIS SATURDAY) Time: 5:23pm So far I have received only four keys for the key signing. I am kind of disappointed about the results of the proposed key signing for the meeting... If you are planning on attending, even if you are not planning on participating in the key signing, I need to know so the Habit can plan for the added influx of people. So far I have a large pile of "maybes" and few confirmations. If you have topics you would like to do a presentation on, please give me information on it so that I can distribute it to the other participants. (Or bring it up before the meeting.) *** NOTE *** Teleport (my ISP) has been having mail problems. If you have sent me mail and not received an confirmation, please resend. I may not have received it. Currently, there is only one other speaker confirmed (besides myself). I would like to see more input from the rest, so this does not just become a one way spouting of information. The one confirmed speaker will be presenting some of his findings on remailers involving reliability and getting nyms to function for those not versed in the field. It should be useful information for anyone using remailers. (He had a few findings that surprised me...) I have had a few interesting "maybes", but I will wait until (or if) they show up... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMP1nl+QCP3v30CeZAQFtGAf8DEofknvToxZWO5upwZoFiSUCaENrPtM/ 6t6Mdl3eTZHan28qJV9vXkKAG6Q9gANQ342NQeH1CbmOalNLxnVrETbKTKv8llNG ASH1iZML//JEQJT3XeHYHAPBBCg18zIfskjU0h0of60MzmcsykHN/ZJTIpps8UIq sgB8fk2Uh9LVg/VFyIvnVnpIMQPZ1W+Z5YQco3rEnqKycKjOi0E0XoKsaJFoWelj 1aHtmWrXxC1Lr2H7fVa0DsF5Vh3w5h2RaelpZBR8QB7Uz8JwYb4jaBtdkrSMlqeg IGZaKirdZDX7i0geB905aVVdiRrahbAz4nV82DxkVEbn/h56XHAtvg== =3PKR -----END PGP SIGNATURE----- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Hack Microsoft Promotion Gets some Press
by Rich Graves 17 Dec '03

17 Dec '03

Just FYI, and patting everybody on the back. I've tried to deflect the credit, and at least in PC Week I was successful. January 8th PC Week, Netwired section, only distributed in print I think (which is odd). It mentions c2.org as a "controversial link" on the win95netbugs FAQ, which is odd because nobody has ever complained to me or on the newsgroups about it. But controversy sells, so that's probably a plus anyway. http://www.zdnet.com/~pcweek/ (their Web server sucks, though, you might not get through) InfoWorld, next issue, probably on the cover. http://www.infoworld.com/pageone/nickextra.htm San Jose Mercury News, probably tomorrow or the next day, not sure whether it's the main section or the computing/business section. http://www.sjmercury.com/ MERCURY on America "Online" Simson is rapidly approaching deadline and has frozen his sources, so please disregard my last about sending anything further to him. I will accept it and pass it on to anyone who inquires in the future. I think I was probably too timid by half in not violating anyone's anonymity by even forwarding notes to Simson and by not spamming Simson's mailbox, but that's OK, it'll all come out eventually. Watch these spaces for Microsoft's response. http://www.microsoft.com/windows/pr/clarifications.htm http://www.wagged.com/ Three cheers especially for Peter, Frank, and Sameer. -rich(a)c2.org http://www.c2.org/hackmsoft/ llurch(a)networking.stanford.edu http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html

1 0

Returned mail: User unknown (fwd)
by Alan Horowitz 17 Dec '03

17 Dec '03

Alan Horowitz alanh(a)norfolk.infi.net ---------- Forwarded message ---------- Date: Thu, 18 Jan 1996 08:27:15 -0500 From: Mail Delivery Subsystem <MAILER-DAEMON(a)infi.net> To: alanh(a)larry.infi.net Subject: Returned mail: User unknown The original message was received at Thu, 18 Jan 1996 08:26:56 -0500 from alanh@localhost ----- The following addresses had delivery problems ----- Name Withheld by Request <anon-remailer(a)utopia.hacktic.nl> (unrecoverable error) ----- Transcript of session follows ----- ... while talking to utopia.hacktic.nl.: >>> RCPT To:<anon-remailer(a)utopia.hacktic.nl> <<< 550 <anon-remailer(a)utopia.hacktic.nl>... User unknown 550 Name Withheld by Request <anon-remailer(a)utopia.hacktic.nl>... User unknown ----- Original message follows ----- Received: by larry.infi.net (Infinet-S-3.3) id IAA19226; Thu, 18 Jan 1996 08:26:56 -0500 Return-Path: alanh Date: Thu, 18 Jan 1996 08:26:56 -0500 (EST) From: Alan Horowitz <alanh(a)infi.net> To: Name Withheld by Request <anon-remailer(a)utopia.hacktic.nl> cc: "Alan Horowitz <alanh(a)infi.net> \"Timothy C. May\"" <tcmay(a)got.net> Subject: Re: PPF #25 and the UN test In-Reply-To: <199601180540.GAA14063(a)utopia.hacktic.nl> Message-ID: <Pine.SV4.3.91.960118080009.15630B-100000(a)larry.infi.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Very interesting. You make bona-fide sounding noises. Now let me ask you this. Do you think that USA has, or will ever have, security organs as kick ass as the East Germans had? Yet within a short time after the Soviets decided, to cede that whole part of Europe, to the Bonn sphere of influence, those East German operatives were running to cover their ass. Love of Liberty runs deep within the American psyche, analogously to the way that devotion to Islam runs deep in the Arab countries. The Islamists have plenty of sympathizers in various Arab security organs. Let's recall that President Sadat was shot by bona fide memmbers of the Egyptian military, in a highly organized operation. If you were a CFR guy, would you bet your life that you could order 500 more Wacos, without having to fear that thre would be no loyalty problems inside your chosen operating units? Let's accept that 20% of the SEALS said they'd confiscate legally-owned firearms from Americans....is 20% enough? Of the other 80%, could you rely on _none_ of them to casue major, major problems? The secret government has had total control of the economy, since the day the Federal Reserve was delegated the authority to create national debt. America is already well-controlled for the benefit of Insiders. They really don't need to attain higher visibility or more power. They are anglo-saxons, not banana-republic cult-of-personality types. Does Walter Wriston have to worry about Tim May deciding to stockpile blackpowder rifles? The SEALs are cannon fodder. They know it. Alan Horowitz alanh(a)norfolk.infi.net

1 0

RE: Alta Vista, Great Stuff!
by Steve Gibbons 17 Dec '03

17 Dec '03

In Article: <199601170427.XAA27753(a)UNiX.asb.com>, Beethoven <wlkngowl(a)unix.asb.com> wrote: # Hey, I saw a message on the list about personal mail # showing up in an A.V. search, and figured why not try # it out and see what comes up under one of my nyms... # Lo and behold, my nym corresponds with the title of a # popular comic strip and an episode in a bad TV show... # Crypto related? # Imagine your nym is related to something common-place at # the time of posting. Even though you may be well known # under that nym, simple searches for that name will turn up # loads of crapola, or at least some light entertainment # for someone searching for oyur past posts. # (It can also turn some unsuspecting people looking for the # crapola onto your interests...) # Yes, I know that sophisticated search engines and simple # expressions can filter out most of the unwanted junk, but # not all of it. Likewise filtering will let some of your # posts fall through the web-crawler-cracks. I've ran into three similar situations lateley. 1) Quite a few people assume that aztech.com is Aztech Labs, the makers of various sound cards, video cards, and CD-ROM drives. (I _wish_ these fols would use the various search engines to find who/what they're looking for.) 2) I'm hosting a web-page for a band called One Foot In The Grave. There's a (fairly popular, I guess) British sit-com by the same name, with quite a few followers that have set up pages for the TV show. 3) There happens to be a steve(a)tezcat.com, and we occasionally receive email from long-lost aquaintances that was intended for the other. Generally this is in response to something that either one of us posted to Usenet. Crypto relevance? Only on item 3, if PK encryption was in wide-spread use, and easy to use, this wouldn't happen. The MUA would realize that it didn't have a local PK key for steve(a)tezcat.com, and inform the user (who could then perform a soundex lookup on their existing keys, and realize that they meant to contact steve(a)aztech.com.) Soundex (or equivilant technology) search spiders are going to make the whole mess even worse... ObPunk: I decided that the easiest way to hide from item 1 was to change domain names. By chance, someone else was interested in aztech.com, so I even made a profit. :) I keep meaning to write something up, and submit it to comp.risks, but who has the time?... -- Steve(a)AZTech.Net

1 0

underground digital economy
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Question: The existing underground economy uses the same money as the aboveground economy (i.e. paper money, for the most part). Could a significant underground digital economy develop if the aboveground digital economy used only identified e-money? Jim_Miller(a)suite.com ____________________________________________________________________ The Internet is a land bridge for memes ____________________________________________________________________

1 0

Scientic American
by Dan Harmon 17 Dec '03

17 Dec '03

The latest issue of SA has a small piece in zero knowledge transactions in the Math Rec section. Dan

1 0

Re: A WfW security curiosity (possibly another security hole)
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>>[WFWSYS.CFG file] > >This is the file used by admincfg.exe (on WFW3.11 disk 8). This file >contains "security" settings, such as whether or not to cache passwords >on disk (*.PWL files). Ahh, so you can silently reenable password cacheing by manipulating this file, thereby defeating Microsoft's "turn off password cacheing" kludge. Wonderful. I'll have a poke around on Monday to figure out what bits to flip and post the results here. Thanks for the info... Peter.

1 0

noise levels
by Perry E. Metzger 17 Dec '03

17 Dec '03

The noise levels around here are getting astounding. Posts on windows registration wizards, gun control, unemployment, Kevin Mitnick's underwear, and all the rest are most certainly NOT doing us any good. Here we are in the midst of IBM putting espionage enabled versions of Lotus Notes out (someone should be putting out a hack to change the embedded public key), Microsoft putting out a crypto API that could potentially be of enormous interest, activity moving in the Karn lawsuit, and all sorts of other important events, and YOU DUNDERHEADS ARE MAKING IT IMPOSSIBLE TO CARRY OUT IMPORTANT DISCUSSIONS. If you want to help the NSA in its mission to stop the dissemination of strong crypto, by all means, continue posting garbage. Perry

6 5

EPIC: Commerce Report on Crypto Availability
by tc＠phantom.com 17 Dec '03

17 Dec '03

Commerce Releases Crypto Availability Report The US Department of Commerce today released a report on the international market for encryption software. The report, which was jointly produced by the Commerce Department's Bureau of Export Administration and the National Security Agency reviews the foreign availability of encryption products and other nations' import, export and domestic use policies. The report finds that there are foreign products available which "can have an impact on US competativeness" and that US export controls "may have discouraged US software producers from enhancing the softare features of general purpose software to meet the anticipated growth demand by foreign markets. It anticipated that there is a steadily increasing demand for crypto to be included in general use software products becuase of well publicized break-ins. A large portion of the report has been redacted by the NSA. EPIC filed suit under the Freedom of Information Act in December 1995 to obtain a full copy of the report and will continue to demand its release. EPIC believes that the US goverment should remove export controls on public domain and commerical software that contains encryption and end the policy of demanding that key escrow be implimented in all encryption software. Enclosed in the Commerce Department Press Release and Executive Summary of the report. The full report is over 100 pages. EPIC will make every effort to make the full report available in electronic form as soon as possible. More information on crypto policy is available at the EPIC Web Site at http://www.epic.org/crypto/ UNITED STATES DEPARTMENT OF COMMERCE NEWS WASHINGTON DC.20230 OFFICE OF THE SECRETARY FOR IMMEDIATE RELEASE CONTACT: Carol Hamilton Thursday, January 11,1996 (202) 482-4883 Eugene Cottilli (202) 482-2721 DEPARTMENT OF COMMERCE RELEASES STUDY ON THE INTERNATIONAL MARKET FOR ENCRYPTION SOFTWARE Washington, D.C. -- The growth of an international market for encryption software is being slowed by strong export controls, both in the United States and other major countries. Moreover,the quality of products offered abroad varies greatly, with some not providing the level of protection advertised. The study, jointly prepared by the Commerce Department's Bureau of Export Administration (BXA) and the National Security Agency (NSA), evaluates the current and future market for computer software with encryption, which allows users to protect their data using codes. The study also reviews the availability of foreign encryption software and assesses the impact that U. S. export controls on encryption have on the competitiveness of the software industry. "Our study provides a clear snapshot of the international competition in this segment that the software industry faces," said Cornmerce Secretary Ron Brown. "Better understanding of the products and the marketplace gives us the tools to ensure that our export control policies are appropriate," he added. The study noted encryption software presently accounts for only a small percentage of the total computer software but should grow substantially as the U.S. and other countries deveiop and expand public networks and electronic commerce. The study found that the U.S. software industry still dominates world markets. In those markets not offering strong encryption locally, U.S. software encryption remains the dominant choice. However, the existence of foreign products with labels indicating DES (Data Encryption Standard) or other strong algorithms, even if they are less secure than claimed, can nonetheless have a negative effect on U. S competitiveness. The study also notes that the existence of strong U.S. export controls on encryption may have discouraged U.S software producers from enhancing the security features of general purpose software products to meet the anticipated growth in demand by foreign markets. page 2 All countries that are major producers of commercial encryption products were found to control exports of the products to some extent. A few countries (e.g., France, Russia, and Israel) control imports and domestic use of encryption, as well. As part of the study, NSA evaluated twenty-eight different foreign encryption software products, finding that some were less secure than advertised. Because customers lack a way to determine actual encryption strength, they sometimes choose foreign products over apparently weaker U.S. ones, giving those foreign products a competitive advantage. -30- A STUDY OF THE INTERNATIONAL MARKET FOR COMPUTER SOFTWARE WITH ENCRYPTION [Note: This is a redacted copy of the ogigional secret decoment. Brackets [] accompanied by the origional classifications have been used to indicate location and size of excised classified text] Prepared by the U.S. Department of Commerce and the National Security Agency for the Interagency Working Group on Encryption and Telecommunications Policy EXECUTIVE SUMMARY BACKGROVND In late 1994, the President's National Security Advisor directed that an interagency report be prepared assessing the current and future international market for software products containing encryption and the impact of export controls on the U.S. software industry. The report was to include an assessment ofthe impact of U.S. encryption export controls on the international competitiveness of the U.S. computer software industry and a review of the types, quality, and market penetration of foreign-produced encryption software products. This paper presents the joint efforts of the Department of Commerce/Bureau of Export Administration and the National Security Agency to complete this tasking. (U) EXPORT CONTROLS All countries that are major producers of commercial encryption products control exports of those products to some extent. Control methodologies and licensing practices vary, however, and a few countries, most notably France, Russia and Israel also control imports and/or domestic use of encryption. There is a significant amount of international cooperation in controlling encryption exports. (U) Some European and other countries apparently treat exports to the United States of DES- based software more liberally than the United States treats DES exports to those countries. Some countries have stated that they generally restrict DES exports to financial end-uses. In general, no independent verification of these licensing practices was obtained. However, in some cases the U.S. was able to obtain DES products from them for non-financial end-uses. It is possible that some countries may allow these exports based on their political/economic/military relationship with the destination country (e.g., within the European Comrnunity, or former COCOM), for end uses that are considered legitimate commercial applications of the technology, or, in the case of exports to the United States, because DES is a national standard. (U) As the technology and the marketplace have evolved, the USG export control authorities have relaxed licensing constraints on cryptographic products several times over the past 10 years. These changes have usually been made after industry pressures and internal debate to balance national security and economic concerns. (U) DOMESTIC AND INTERNATIONAL MARXETS While presently encryption software accounts for only a small percentage of the total software market (1-3%), according to numerous information security experts contacted in the course of the study, the future growth trend for this sector is expected to be great. The market for encryption in distributed computation, databases, and electronic mail is beginning to expand exponentially as the U.S. and other countries develop and popularize electronic commerce, public networks, and distributed processing. (U) Encryption in these environments will often be implemented in software, as opposed to hardware, because it is generally less expensive and simpler to install and upgrade. Absent changes in government standards, for the next ten years, encryption software will primarily use DES and RSA-licensed encryption algorithms. Other non-standard and company proprietary algorithrns will be used primarily for security-specific products for small niche markets. (U) Certain developments are promoting greater use by the general public of software-based network security features, including encryption, throughout the industrialized world. They include ever increasing use, fueled by well publicized "break-ins," of distributed databases, popular acceptance and usage of global networks, and the development and use of electronic commerce. (U) These developments are ongoing at one stage or another in practically all of the countries surveyed for this assessment. Less technologically advanced countries, where demand for encryption software is reportedly negligible, will soon undergo widespread development and computerization leading to increased demand for encryption so~ware within the next 10 years. (U) The overwhelming majority (75%) of general-purpose software products (e.g., word processors, spread sheet programs, and database programs) available on foreign markets today are of U.S. origin. Cornmerce Department analyses indicate that the U.S. has few viable foreign competitors for such products, and of those general-purpose products with encryption features, all were found to be of U.S. origin. (U) In the security specific software market, however, U. S. manufacturers face competition in several foreign markets from such encryption exporting countries as the United Kingdom, Germany, and Israel. To a large extent, markets for these products tend to be "national. " Not only do export controls affect sales, but local vendors of security-specific products are at a competitive advantage in that they are better situated to work closely with end- users and develop encryption solutions tailored to meet the conditions of the local environment. (U) NSA confirmed the existence of a significant number of foreign security-specific software products with encryption features, predominantly from Western European suppliers. Security-specific products are usually not available on the shelf at retail stores either in the U.S. or abroad, but can be purchased through direct contact with the manufacturer. (U) ES-2 BXA attempted to quantify U.S. competitiveness and market share in 31 foreign countries where encryption is thought to have significant demand. While sources in the countries surveyed had limited access to import statistics or market literature on encryption software and encountered nwnerous difficulties in evaluating this complex market, definite conclusions may be drawn from the responses. (U) Sources in 14 countries indicated that U.S. export controls limit U.S. market share in their countries. Sources in seven countries indicated that export controls have either no impact or no major impact. (U) Sources in most countries indicated that the U.S. market share is keeping pace with overall demand despite the impact of U.S. export controls, which may promote indigenous production or reduce U. S. market penetration. In all known cases, the U.S. holds the majority of the general-purpose encryption software market. (U) Three exceptions are Switzerland (where the U.S. market share reportedly declined in 1994, while the market shares of other European countries rose), Denmark and the United Kingdom, which reported unspecified declines from previous years. Sources in all three countries attribute the decline to U.S. export controls, which they claim promote the development and sale of indigenous encryption products. (U) In many countries surveyed, exportable U. S. encryption products are perceived to be of unsatisfactory quality. (U) ANALYSIS OF FOREIGN PRODUCTS NSA used various methods to procure encryption software products from a variety of countries and companies, as reflected in the TIS database and other sources. Altogether, 28 products from 22 foreign producers in 10 countries were acquired for the purposes of this study. Of these, 21 purportedly use the DES algorithm, while the remaining 7 use proprietary algorithms. (U) [ ] (S) ES-3 ECONOMIC IMPACT In the absence of significant foreign competition, the impact of U.S. export controls on the international market shares of general-purpose products is probably negligible. Customers are often unaware of the encryption features in these products and primarily base purchases on the features implementing the primary function of the product (e.g., word processing or database). (U) [ ] (S) BXA attempted to quantify the economic impact of export controls on the U.S. software industry by forwarding a detailed voluntary questionnaire to 206 software vendors and other interested parties. Thirty six encryption software manufacturers provided completed surveys out of the 71 returned. By and large, the companies were unable or unwilling to quantify the costs of export controls, but did provide substantive explanations of how and why they believe they are adversely affected. (U) Some general-purpose software companies claim that export controls have affected their plans to expand security features to meet anticipated growing demand. These companies believe that they could expand their domestic and international customer base with such features. (U) The export licensing process itself is not a major obstacle to U. S. competitiveness. Only seven survey respondents use the Department of State licensing system. While they continue to have some complaints about the administrative burdens and time delays associated with State's process, several noted that there had been improvements in recent years. Only two of the survey respondents had been denied licenses by the Department of State. (U) Numerous survey respondents indicated that they avoided applying for export licenses from the Department of State altogether. Some larger companies whose products tended to be general-purpose in nature either developed two ~fersions of so~ware, or incorporated an encryption algorithm they knew would qualify for Commerce general licenses. (U) Many smaller, security-specific software firms, on the other hand, elected to limit their sales to the domestic market only. These companies indicated a high level of foreign interest in purchasing their products, and therefore lost potential sales. While it is difficult for them to quantify their potential market, they believe it to be sizeable. They claim their small size limited their ability to develop two versions of their products, and the fact that their products were for secunty purposes ES-4 specifically requires them to incorporate strong encryption. Only one company was able to provide specific examples where a foreign competitor o~ta ned a sale due to an export license denied by U.S. authorities. (U) There is little evidence that U.S. export controls have had a negative effect on the availability of products in the U.S. marketplace. A broad range of products with secure algorithms exist in the U. S. market and availability of products is based principally on the level of customer demand. Export controls may have hindered incorporation of strong encryption algorithms in some domestic mass-market, general-purpose products, since some companies find developing and maintaining two versions of a product infeasible. (U) The existence of foreign products with labels indicating DES or other strong encryption algorithms, even if they are less secure than claimed, can nonetheless have a negative effect on U.S. competitiveness. Most encryption users base their purchasing decisions on the advertised product features, along with price, company reputation, etc. (U)

1 0