December 2003 - cypherpunks-legacy

Re: Article on E-money
by James M. Cobb 17 Dec '03

17 Dec '03

Jim, Thank you for an exceptionally well thought out message. I notice your point that ....governments will do their best to insure that anonymous e-money systems fail in the marketplace. Perhaps by...subsi- dizing identified e-money systems.... 12 26 95 / 01 02 96 Computerworld 38 reports: CyberCash...is a more comfortable partner to banks and offers an easier system for regulators to audit than those of some rivals, says John Pescatore, research director for information security at International Data Group in Falls Church, Va. A Netherlands-based firm called DigiCash BV...offers a system that ensures a buyer's anonymity.... "An approach like CyberCash would still keep financial insti- tutions in the loop. That's much more palatable to governments and banks and their lobbyists," he says. Publicizing the palatable is one form of subsidizing. Another is suggested: CyberCash...earns transaction fees from banks. Regulating those fees can be an exercise in ingenuity. But there may be more... In Implementing Internet Security, a 1995 book recommended by Pournelle, Lisa Morgan writes at page 199: Currently, DigiCash technology is being used in electronic wallets and smart cards; but in the long-term, the technology will be used for many more applications. In the long-term? Lisa writes at page 195: Internet commerce, when it becomes big business several years from now.... By then "NSA's pet Fortezza card project" may be all the rage. Stephen Pizzo, Web Review's senior reporter, says: The agency is also heavily subsidizing through private com- panies the development of a commercial version to be sold worldwide. Cordially, Jim NOTES: The Computerworld newsstory is headlined "Virtual credit-card swiper makes banks feel secure." The book is by Frederic Cooper et al. Its publisher: New Riders Publishing. Pizzo's report can be accessed beginning at: http://gnn.com/gnn/wr/96/01/12/features/nsa/index.html

1 0

(fwd) Crypto SmartDisk(tm)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: Postmaster(a)thumper.vmeng.com Reply-To: e$(a)thumper.vmeng.com Mime-Version: 1.0 From: rah(a)shipwright.com (Robert Hettinga) Date: Thu, 18 Jan 1996 08:02:46 -0500 Precedence: Bulk To: Multiple recipients of e$pam - Sent by <rah(a)shipwright.com> Subject: Crypto SmartDisk(tm) --- begin forwarded text `Computer Within a Floppy Disk` puts secure electronic commerce in the palm of your hand SAN FRANCISCO--(BUSINESS WIRE)--Jan. 17, 1996--Fischer International Systems Corp. (FISC) announced Wednesday the availability of Crypto SmartDisk(tm), the world's first intelligent security token housed in a floppy disk-sized device. The announcement was made at the annual conference of RSA Data Security Inc., a leading encryption algorithm vendor. Addison M. Fischer, founder and chairman of FISC and a world-recognized leader in systems and data security, attended the meeting with fellow experts in cryptography. Crypto SmartDisk is a self-contained computer, complete with crypto coprocessor, memory, real time clock, and resident operating system. It fits in any of the 150 million installed standard 3.5 inch floppy disk drives; no additional hardware is required. Crypto SmartDisk supports RSA, DSA and DES algorithms for encryption and digital signatures. The RSA public key cryptographic system is the de facto standard and is commonly used to create digital envelopes for secure electronic commerce. DSA is a standard for digital signatures that is endorsed by the U.S. government, and DES is the most widely used and tested encryption algorithm available. `Crypto SmartDisk breaks barriers in the world of secure electronic commerce,` said Michael S. Battaglia, FISC president and CEO. `It literally puts in any user's hands the power to use any PC with a 3.5 inch floppy drive as a secure electronic transaction station. Businesses, government agencies, even private citizens can use Crypto SmartDisk to engage in secure electronic commerce with complete confidence that their transactions will be read only by those people the users intend.` Crypto SmartDisk is positioned to gain rapid acceptance among agencies of the U.S. federal government, particularly those that manage civilian applications. It offers the benefits of hardware-based encryption without the expense of retrofitting PCs that don't have card readers. By using a Crypto SmartDisk, for example, private citizens could conduct secure electronic transactions with agencies like the U.S. Postal Service (USPS), Social Security Administration (SSA), and IRS from their home computers. The General Services Administration Security Infrastructure Program Management Office is planning just such a pilot project, with hundreds to thousands of participants including private citizens. Using Crypto SmartDisk, participants may conduct electronic transactions such as requesting SSA benefit information, inquiring about the availability of federal loans, and potentially even filing on-line tax returns with the IRS. Crypto SmartDisk also offers a developer's toolkit so users can create their own applications featuring encryption capabilities. The toolkit provides both software tools and libraries and is fully compliant with the PKCS No. 11 standard and the ISO 7816 standard. Fischer International Systems Corp. is a leading worldwide supplier of software solutions for secure Electronic Commerce. Founded in 1982, it is one of the largest privately held software companies in the United States. Its products include Watchdog(r) and SmartDisk(tm) for PC data security, TAO(tm) (Totally Automated Office) for cross-platform, multilingual messaging and office automation; EDI/comm(tm) for Electronic Data Interchange; and WorkFlow.2000(tm) for cross-platform automated forms and process management. Crypto SmartDisk and the Crypto SmartDisk toolkit are available for immediate shipment. -0- NOTE TO EDITORS: In the Internet/email address noted in the contact information in this news release, there is an `at` symbol between Chamberlain and fisc.com. This symbol may not appear properly in some systems. --30--jd/mi.. CONTACT: Fischer International Systems Corp., Naples, Fla. Katharen Chamberlain Phone: 941/436-2678; Fax: 941/436-2586 Internet: Kathy.Chamberlain(a)fisc.com ============================================================================ --- end forwarded text -------------------------------------------------- The e$ lists are brought to you by: Making Commerce Convenient (tm) - Oki Advanced Products - Marlboro, MA Value-Checker(tm) smart card reader= http://www.oki.com/products/vc.html Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk See your name here. Be a charter sponsor for e$pam, e$, and Ne$ws! See http://thumper.vmeng.com/pub/rah/ or e-mail rah(a)shipwright.com for details... ------------------------------------------------- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

2 1

Re: Espionage-enabled Lotus notes.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:51 PM 1/18/96, Trei Family wrote: >I've come up with a new term to describe the type of 'improved' security >in the new International edition of Lotus Notes: > >'espionage-enabled' > >It's specifically built for export, and has a backdoor to enable USG agents >to read the messages more easily. From the viewpoint of a foreign purchaser, >'espionage-enabled' seems an appropriate term. > >If we spread this term sufficiently, we may be able to discourage the >widespread adoption of this half-measure, and increase the pressure for >good, unencumbered crypto. I like this idea, and have already begun to use it. Even adding it to my already long .sig. Here's a post I sent to talk.politics.crypto and soc.culture.german. (I included the German group because of the CompuServe situation and the fact that they are already incensed by American criticisms of them...I figure this could get them even more riled up, and even get a groundswell of sentiment to boycott espionage-enabled software.) Here it is: You Germans need to be monitored. The French, too. This has become painfully clear. Fortunately, IBM and its Lotus Development division have come up with an answer: software such as Lotus Notes which is shipped to Germany (and elsewhere outside the U.S.) will have an espionage-enabled encryption system that allows the National Security Agency, CIA, and other intelligence agencies to have easy access to your data. The 64-bit key versions of software will actually be crippled, to allow the NSA and CIA access to your communications. And the NSA has been exploring options for "economic espionage," as a means of helping U.S. industry to compete. Thus, your BMW and Daimler-Benz secrets can be detected and passed on to Ford, General Motors, and Chrysler. Brief excerpts from today's "Wall Street Journal": ------- IBM Compromises on Encryption Keys, U.S. Allows Export of More-Secure Notes By Thomas E. Weber New York -- International Business Machines Corp., caving in to intense government pressure, agreed to include a special key that helps investigators tap into data messages in return for permission to export a more-secure version of its Lotus Notes software. ... "We were desperate enough to try to negotiate a short-term, pragmatic solution," Mr. Ozzie said. "But we do not believe this is the right long-term solution." .... The new overseas version of Notes, tagged Release 4, will give foreign users 64-bit security. But to get permission to export the software, Lotus agreed to give the government access to 24 of those bits by using a special 24-bit key supplied by the National Security Agency. ... ------- Welcome to the New American World Order. (Of course, another possibility is the Europeans, Asians, and others will reject this espionage-enabled software and will instead rely on robust software using the Web, software with full cryptographic security and without the special NSA "back doors." Some may even boycott Lotus Development products on general principal.) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

[noise] Re: Attack Simulator
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:04 PM 1/18/96 -0600, Patrick Lamb wrote: >Is it just me, or does this sound like a commercial version of SATAN? I >wonder what makes SATAN unacceptable (besides the name) while something like >this is apparently acceptable? It is very similar, both in tests and in basic principle, to Satan. The differences between the two are hype and Satan is free to anyone who can figure how to make it work. (Not always an easy task... Especially on Linux.) Such tools are very useful for system admin types to fix holes and for hackers to find them. It is not the "all powerful hacker tool" the media makes it out to be. What this has to do with crypto, I have no idea... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

POINTER: 01 17 96 CDT Policy Post
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, Cypherpunks-related item in 01 17 96 CDT Policy Post: FBI Surveillance Capacity Request Fails to Meet Public Accountability Requirements of Digital Telephony Bill. CDT = The Center for Democracy and Technology. To subscribe to CDT's Policy Post list, send mail to: policy-posts-request(a)cdt.org with the subject: subscribe policy-posts Cordially, Jim

1 0

Re: Espionage-enabled Lotus notes.
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Peter Trei writes: > >It's specifically built for export, and has a backdoor to enable USG agents > >to read the messages more easily. From the viewpoint of a foreign purchaser, > >'espionage-enabled' seems an appropriate term. TC May responds: > I like this idea, and have already begun to use it. Even adding it to my > already long .sig. I think it's also time to break out the old "Big Brother Inside" stickers and start applying them to copies of Notes... andrew

2 1

Blacknet & Lotus Notes
by Adam Shostack 17 Dec '03

17 Dec '03

Espionage Enabling in Action, or "How much is that escrow key in the window?" We all know how cheaply spies sell out. The Falcon and the Snowman got a few tens of thousands for years of crypto keys and satelite data. Pollard got 50,000 for cubic yards of documents on all sorts of subject. The Walkers gave the Soviets a volume purchase discount, and Ames got 2 million for running the CIA's counter-espionage program on behalf of the KGB. This little key to handle 24 bits of data is nothing. It can easily be smuggled out on a floppy, in an encrypted email message, or even printed out and sent through the mail. Assuming many federal employees will all have access to the same key, its not much of a secret. So, lets buy the espionage enabling secret key. Its an obvious target, not just for cypherpunks, but for the KGB, Mossad, Toshiba, IBM, and anyone else who wants to read their competitors correspondance. Lets face it, this key will get out there, and be available to all the big players; lets make it available to everyone! This is a job for ... Blacknet! This is exactly the kind of information thats easy to resell. Its small; no smuggling DATs full of B2 bomber plans out, just a small file on a floppy disk. Its easily checked, if the Lotus message formats are public, slightly less so if they're not. Who would buy? Pick an intelligence agency. Pick any large company whose compitition uses Notes. Heck, I'd bet there are US government agencies (FBI, BATF, LAPD) who would buy it once we made it available. Its a near perfect demonstration of the foolishness of the government's position. Once this key, like the clipper keys, becomes easily available, the foolishness of the idea of GAK becomes magnified. Its ANOTHER government program that can't be run properly, thats opposed by 80% of Americans, and that doesn't even sell overseas. The persons responsible might even get to claim to be whistleblowers, demonstrating how easy it is to subvert this foolish plan that will continue to cost American business 60 billion a year in lost sales overseas. So...Is Notes V4 shipping yet? Do we know how many bits of key we're after? (NB: I'm assuming that (some part of) the US government has an RSA private key which is used to encrypt the 24 bits of GAK'd key.) Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Junk Notes
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

New York (AP) -- For the first time in years, there were no major trouble spots in IBM's vast product line. Both personal computers and large systems sold well and Lotus Development Corp., which IBM acquired last summer, shipped an astounding 1.2 million copies of its Notes program. "Our fundamental strategies are working," IBM chief executive Louis V. Gerstner Jr. said in a statement. ... Changes in the general export laws seemed unlikely so Lotus negotiated an interim solution. "This protects corporate information from malicious crackers but permits the government to retain their current access," Ozzie said. Simson Garfinkel, author and computer security expert, said he's not sure international buyers of Notes will like the solution. "Foreign companies don't want the U.S. government to spy on their data any more than the U.S. government wants foreign companies to be able to spy on theirs," Garfinkel said. ... But IBM said nothing about the future, causing some nervousness among the investors who have seen other technology companies project a flat performance in the next few months. "It was a good quarter but the bad news is we've got to go and find out what's going to happen in 1996," said David Wu, analyst at Chicago Corp. Questions have been raised about the timing of IBM's June acquisition of Lotus -- a $3.5 billion deal that was the software industry's largest ever -- because World Wide Web-related programs seemed to be eclipsing the need for Lotus' Notes, a communications and database program.

1 0

Re: Microsoft's CAPI
by jim bell 17 Dec '03

17 Dec '03

At 10:14 AM 1/17/96 -0800, Alan Bostick wrote: >> The OS will not load just any old CSP. CSPs have to be signed by >> Microsoft. The kernel contains a (hardcoded?) 1024 RSA public key >> that it uses to check the signature when the user tries to load a CSP. >> If the signature check fails, the CSP won't load. Microsoft says it >> will sign any CSP from anyone AS LONG AS THEY CERTIFY THAT THEY WILL >> FOLLOW THE EXPORT RULES. So you can get your CSP signed if you use >> exportable cryptography or if you agree not to send it outside the US >> and Canada, etc. But an end user can't just compile crypto code and >> use it as a CSP, even for his or her own use, without getting it >> signed by Microsoft first (actually, the CSP development kit does >> allow this, but it uses a special version of the OS). > >The next obvious question is: Will Microsoft sign strong-crypto CSPs >developed by foreign developers for out-of-USA use? And, as well, for in-USA-use. Currently, it is only the export of cryptographic devices and programs which is restricted. Are they going to prohibit the export of digital signatures which enable the use of foreign-developed software?!?

1 0

Elitism on Cypherpunks
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have seen a number of posts on "Cypherpunk Elitism". I have seen more examples of it here on the list. I think that this attitude will be more destructive to the list than noise in the long run. It has been said that "Cypherpunks write code". They must do more than that. Cypherpunks need to teach. All the cryptotools in the world are of no use if no one knows how to use them. (Or know how to use them correctly.) All of the protocols are of no use if no one knows how to impliment them correctly or WHY they need them in the first place. There are alot of bogus security methods. Many of them exist because people do not know better. Without someone to instruct them in the ways of these things, they will continue to go on with bad crypto, not knowing any better. Not all of the non-cypherpunks are beyond hope. Many of them are teachable. If we leave them to flounder on their own, cryptography will be something used only by an elite. It will be of little or no threat to the powers that be because only a small amount of people will have the ability to use it. The TLAs will have less encrypted trafic to sort through. They will have won a big battle, not through force of arms but force of egos. What can be done? Alot. Teach people how to use PGP. Help them generate keys. Help them get them signed. Show them how to use remailers. Teach them the secret of nyms. Friends teach friends how to use crypto. Adopt a BBS. They may be young, but they may also become the cypherpunks of tommorow. Upload current versions of programs. Keep them current. Organize keysignings on the board. Host crypto discussions. Help stamp out the misinformation that breeds on such systems. Instilling the interest in the field and teaching will do more for the cause than all of the "this is noise" postings in the world. Helping those who have questions will help the newbies no longer be newbies. There are some on the list who have already taken this tact and must be commended. There are others who have taken the "fuck you" attitude to anyone they do not find worthy opon first contact. Bad attitudes are counter productive. To prevent the fall of a new dark ages, we must make sure that the information is spread far and wide. I think the statement that descibes it best is: "UN-altered REPRODUCTION and DISSEMINATION of this IMPORTANT information is ENCOURAGED." There is alot that cypherpunks can do to encourage the use of cryptography by "the common man". Elitism is not one of them. In the long run it will be counterproductive. And maybe in the short run as well... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMP8jQeQCP3v30CeZAQHtjAf9FfJWRAe0ZDLNOLsFDMBGQvi9kXKZR3sw WDmOb3K/y8syCdADqqC4UjqoZ0pQ/XHEt6qKd8A7qx6D1FVQauTocEp1vqwE645h zGirsApDjiCYFmV/+Lbpor5Uf9F2rFbjya64lOTbiKW+XEGukpI3ghgbGxGPqPGF fIIT2QxqMl1MDd1sSGIXzvpniOsHI6HoVbPwUx8S2tbMR0dqh5AQObOKdna0D4x4 beAxEVyNd6atqdkZPEZy2XaSO6Y4hmRZx3I4CuqCM2wqbsboETQLpELBSn/dnxet 0Fe82xHHZQSuh0gMXEP+znaKYOq/38mijwjF3zpX+5RRHIVrjMu2+w== =ojHr -----END PGP SIGNATURE----- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0