December 2003 - cypherpunks-legacy

IBM enters WWW security market
by Jeff Simmons 17 Dec '03

17 Dec '03

> > -------- Forwarded message -------- > Newsgroups: comp.os.os2.announce > Date: Fri, 29 Sep 1995 14:49:59 GMT > From: tsipple(a)vnet.IBM.COM > Subject: OS/2 NEWS: New, secure version of WebExplorer > > Submitted by: Timothy F. Sipples (tsipple(a)vnet.ibm.com) > Source: Timothy F. Sipples (tsipple(a)vnet.ibm.com) > Date received: 1995 September 26 > Date posted: 1995 September 29 > ------------------------------------------------------------------------------ > New, secure version of WebExplorer for OS/2 Warp > > ATLANTA, Sept. 27, 1995--The latest additions to IBM's Internet > Connection software family will enable companies to encrypt > Internet transactions and better protect internal networks with > firewall software as they explore new business opportunities on > the Information Superhighway. > > Today's announcements include: > > * A new secure version of the Web Explorer for OS/2 Warp > > * The IBM Internet Connection Secure Server for OS/2 Warp > > * The Internet Connection Secure Server for AIX > > * An enhanced version of the Internet Connection Secured > Network Gateway > > * an enhanced version of the Internet Connection for OS/2 > Warp > > * an enhanced version of the Internet Connection for Windows > > "Businesses of all kinds are considering the immense opportunity > the Internet offers but are reluctant to take the plunge until > they feel they can do so in a planned, secure manner. The > Internet Connection family provides our customers with that > reassurance, freeing them to explore a whole new world of > possibilities," said Lois Dimpfel, vice president, Networking > Software Products, IBM Networking Software Division. > > The Internet is evolving as a means for conducting electronic > commerce, and the new IBM secure servers and OS/2 Warp client are > superbly positioned to meet customer security needs. The IBM > Internet Connection servers and client support both of the > emerging security technologies -- Secure Hypertext Transfer > Protocol (S-HTTP) and Secure Sockets Layer (SSL) -- to provide > customers with maximum flexibility. > > New OS/2 Warp client and secure servers > > The new version of the Internet Connection for OS/2 Warp, the > first Internet client to be included at no charge in an operating > system, adds security support to an Internet application suite > that has won generous praise in its first year of availability. > OS/2 Magazine recently chose the Internet Connection for OS/2 > Warp as a winner in its editors' choice awards. > > The Internet Connection family of client software was also > enhanced last week. The Internet Connection for OS/2 Warp, > provided at no charge as part of the Warp bonus pack, now > includes table support, streaming graphics, an integrated news > function and other enhancements through HyperText Markup Language > (HTML) 3.0 extensions. These enhancements will also be available > in the secure version being announced today. > > The InternetConnection for Windows was enhanced with improved > performance, additional graphic viewers, audio players and other > features. > > IBM's new web server software provides unmatched scalability for > customers. The OS/2 Warp version can run on cost-effective > desktop systems sold in retail outlets, while the AIX version > runs on highly-scalable RISC System/6000 platforms. > > Both the IBM Internet Connection Secure Server for OS/2 Warp and > the Internet Connection Secure Server for AIX were designed to be > quickly and easily configured using any industry-standard > browser. The installation and configuration is menu-based and > includes online help designed to assist an administrator with > making the correct choice. > > The new Internet Connection secure servers and clients allow > businesses and their customers to conduct transactions over the > 'Net knowing that the data is protected. For example, an auto > parts supplier might create a secure web server containing its > catalog, including high-quality images of the items, on the web > along with the ability to place an order. A customer would use > the Internet Connection secure client -- or an S-HTTP- or > SSL-compliant client from another vendor -- to browse the > online catalog, order a part and pay for it with an encrypted > credit card number. > > Enhanced secured network gateway > > A new version of IBM's Secured Network Gateway, a software > product generally known as an Internet "firewall," today joins > the Internet Connection product family. Formerly part of the > NetSP product family, the Secured Network Gateway operates on an > AIX platform to protect a corporation's internal enterprise > network resources from Internet intruders, while allowing > legitimate traffic to flow through the firewall. > > The Internet Connection Secured Network Gateway offers a number of > advanced features, including: proxy server, SOCKS servers, filters and > domain name service. > > Among several features added to the new version is support for > AIX version 4.13, in addition to AIX version 3.25. The new > operating system support offers customers the option to run the > Secured Network Gateway on PowerPC hardware. > > Another key feature of the new version is data encryption. Data > can safely flow between two firewalls across a public network. > The firewall encrypts IP data packets, creating a private "IP > tunnel" from one secure internal network to another. > > The new secure IP tunnels could be used for a company with the > Secured Network Gateway installed at its various sites to safely > and confidently transmit sensitive financial data from a branch > office over the Internet to corporate headquarters. Customers > could also use the new feature to securely administer a firewall > from a remote location. > > Internet Connection directions > > Just as the Internet itself continues to expand phenomenally, the > Internet Connection family, now consisting of seven generally > available products, will also grow. Current product plans call > for additional web clients on a number of platforms, and web > server software for OS/400, MVS and selected non-IBM systems. > > "We don't intend to just keep pace with the market; we intend to > be the pacesetter," said IBM's Dimpfel. "IBM has worldwide reach > and strengths like no other company. The IBM Global Network, > robust software products, IBM services and gateway software to > link with existing business systems using DB2 and CICS--all this > means customers don't have to deal with patching together > solutions from a collection of vendors." > > The Internet Connection product family is a component of IBM's > imperative to provide people and organizations with > network-centric computing, a new model that combines networking > software, network services and computing devices to facilitate > computing anywhere, anytime. > > IBM, the world's largest software provider, creates, develops and > manufactures the industry's most advanced information technologies, > including networking systems, software, computing systems, storage > devices and microelectronics. > > Pricing and availability > > The secure server software for OS/2 Warp is $2,999 for the first > license with additional licenses available for $2,699 each. The > AIX secure server software is $4,999 for the first license and > $4,499 for an additional license. The Internet Connection Secured > Network Gateway is priced at $9,999 for the first license, with > additional licenses available for $8,999. > > The new secure WebExplorer for OS/2 Warp is $35 per copy and > pricing on the enhanced IBM Internet Connection for Windows has > been reduced to $59. > > Both secure servers and the secure Web Explorer for OS/2 Warp > will be generally available in December of this year. The new > version of the Secured Network Gateway will be available in > October. > > > IBM, OS/2, AIX, CICS, DB2 and RISC System/6000 are trademarks of IBM. > > Windows is a trademark of Microsoft Corp. > -- Jeff Simmons jsimmons(a)goblin.punk.net

1 0

I am the anti-Ch<fnord>
by Rich Salz 17 Dec '03

17 Dec '03

I got some email responses to my SAIC info. Here's a little more fun on a Sunday evening. All the statements below are true. Among the first two (possibly the very first two) MX records for not-connected sites desiring Internet-style names were: att.com and mirror.tmc.com. That is, the phone company, and a small subsidiary of the Times-Mirror corporation. It was from mirror that mod.sources/comp.sources.unix was moderated -- for many years, the only source of free software available to Usenet. Seismo was the forwarder for both ATT and TMC (via special-case lines in Rick's sendmail.cf file). ATT, through ihnp4 in Chicago (site of the Democratic convention), vied with seismo for the we'll-call-anyone philosophy that a few sugar daddies (er, backbone) sites had that kept uucp Email and Usenet running back then. Under the auspices of the curiously-named "Network Action Central" many ATT sites did dialup UUCP to mirror on a daily basis, ostensibly to pick up mod.sources. I was the administrator of mirror.tmc.com; the tmc.com domain "conflicted" with tmc.edu, the Texas Medical Center. The NIC back then asked me to ask tmc.edu to "reconsider." Do you know where their book depository is/was? Rick started Alternet, now "Shared" with Microsoft. Unlike Sprint and MCI, ATT "curiously" decided to *not* become a network service provider, but instead allied with BBN and sells their technology, equipment and services. I worked at BBN for five years, in the same department that became BBNPlanet, the global ISP and ATT's partner. I also wrote INN, which now handles essentially all the Usenet traffic in the world. So who cares about the latest media mega-deal of Eisner or Time-Warner-Turner? We already control the Internet media; the Web is merely~~~~#@ NO CARRIER

1 0

Re: Kerberos
by Rich Salz 17 Dec '03

17 Dec '03

>From: "David J. Bianco" <bianco(a)itribe.net> Date: Sun, 24 Sep 1995 16:32:30 -0400 >The Open Software Foundation's Distributed Computing Environment has the >concept of a central security registry (which is currently based on >Kerberos). I haven't delved too deeply into them, but the OSF website has >some DCE RFCs about adding public key capabilities to the registry. They >should be off the OSF home page somewhere at <http://www.osf.org>. Sort of. The DCE registry isn't really based on Kerberos. Rather, DCE uses Kerberos code to do its private-key stuff. We're planning on adding the ability to use public key to get initial tickets to the security server. Outside of integration with other security domains, this means that the security server no longer needs to store everyone's private key, reducing exposure if it's been cracked. If anyone wants more details on how current or planned DCE security, drop me a line. Perhaps some of the other folks on this list who also know about it will speak up, too. /r$, DCE whipping boy

1 0

Re: Europe
by banisar＠epic.org 17 Dec '03

17 Dec '03

At 6:45 PM 10/1/95, Mats Bergstrom wrote: >Perry M. wrote: > >> I was wondering if the Europeans had an equivalent of EPIC or EFF >> lobbying against crypto restrictions there, given the disturbing news >> a week or so ago. > There are a few groups in Europe (Privacy International is based in UK, Argedaten in Austria, CLI in Spain, misc EF-X) but none of them are as organized as their US counterparts. However, there are also Privacy Commissions in every country who are also friends to the battle. There was quite a bit of discussion at their last meeting in Copenhagen last month on crypto and the Denmark and Ontario, CA Privacy Commissions just came out with a joint report on crpyto that we are working on scanning in and making available on our web page. Dave David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * HTTP://www.epic.org Washington, DC 20003 * ftp/gopher/wais cpsr.org

1 0

SAIC in VA
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

URL: http://www.saic.com/business/locations/va.html **** Business Directory **** _________________________________________________________________ SAIC IN VIRGINIA * Alexandria + Alexandria/Eisenhower Ave. (Loc. 238) + Alexandria/DMSO (Loc. 692) + Alexandria/DTG (Loc. 691) + Alexandria/JHK (Loc. 801) + Alexandria/MARITIME SERV DIV (Loc. 365) + Alexandria/TSC (Loc. 694) + Washington D.C./AMSEC (Loc.347) * Arlington + Arlington/Jefferson Davis HWY (Loc. 294) + Arlington/AMSEC (Loc. 678) + Arlington/BALLSTON (Loc. 765) + Arlington/CAPS (Loc. 785) + Arlington/CM (Loc. 573) + Arlington/CON. SUP. Facility (Loc. 964) + Arlington/CSI ADV. APP. DIV. (Loc. 963) + Arlington/CSM & AT (Loc. 402) + Arlington/CSS (Loc. 309) + Arlington/FSD (Loc. 784) + Arlington/ICITAP (Loc. 769) + Arlington/LEO (Loc. 587) + Arlington/MOSES (Loc. 612) + Arlington/RDO (Loc. 783) + Arlington/SAI T (Loc. 329) + Arlington/SCT (Loc. 830) + Arlington/SEM (Loc. 711) + Arlington/SIM. TECH (Loc. 717) + Arlington/SIM. TECH (Loc. 990) + Arlington/TRG (Loc. 539) + Arlington/TRG (Loc. 668) + Arlington/TTG (Loc. 708) + Crystal City (Loc. 508) + Virginia Square/ATG (Loc. 215) * Dahlgren + Dahlgren/Danube Drive (Loc. 226) + Dahlgren/AMSEC (Loc. 716) * Chantilly + Chantilly/NSI (Loc. 944) * Falls Church + Falls Church/EHSG (Loc. 052) + Falls Church/HCTG (Loc. 456) + Falls Church/SKYLINE/TAG (Loc. 284) * Ft. Belvoir + Ft. Belvoir (Loc. 709) * Hampton + Hampton/Enterprise Parkway (Loc. 761) + Hampton/Enterprise Parkway (Loc. 833) + Hampton/Enterprise Parkway (Loc. 256) + Hampton/Command & Control (Loc. 550) + Hampton/NASA LANGLEY (Loc. 618) * Herndon + Herndon/TAG (Loc. 946) * King George + King George/NAVSWC (Loc. 924) * Lynchburg + Lynchburg/Timberlake Road (Loc. 212) * McLean + McLean (Loc. 049) + McLean/COMSYSTEMS (Loc. 092) + McLean/ENTERPRISE CENTER (Loc. 747) + McLean/TE&A (Loc. 741) + McLean/TOWER (Loc. 015) * Newington + Newington/CVR (Loc. 474) * Norfolk + Norfolk/Plume Street (Loc. 441) + Norfolk/RE WRIGHT (Loc. 931) * Petersburg + Petersburg/NSSSG (Loc. 638) * Portsmouth + Tidewater/CHCS (Loc. 649) * Reston + Reston/EITS (Loc. 641) * Richmond + Richmond/NSI (Loc. 951) * Virginia Beach + Virginia Beach/SEG (Loc. 282) + Corp Office/AMSEC (Loc. 346) _________________________________________________________________ Copyright SAIC Home _________________________________________________________________ Last updated on 09-07-95

2 1

Re: CJR for perl-RSA t-shirt
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Subject: Mass Market Software with Encryption - 15 Day Expedited Review > Requested > >Subject: Commodity Jurisdiction Request for > perl-RSA t-shirt, an encryption program ROTFL! I haven't had this much fun since the hogs ate my little brother. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re:WHERE did this come from?
by grigor42＠aurora.eexi.gr 17 Dec '03

17 Dec '03

1 0

Crypto hardware summary
by cman＠communities.com 17 Dec '03

17 Dec '03

[A summary of my points on crypto hardware follows my response to Norm.] Norm Hardy writes: >What key length are you using that takes 3.2 sec? >The DSP can operate concurrently with other processing, giving an >improvement greater than 3.2/1.9. I'm aware of this -- I was using Tim's pessimistic estimate of improvement... to make it clearer for those who didn't read his post, I should have said, "Even if the reduction is only from 3.2 seconds to 1.9 seconds, it would be significant for someone running a server." I'm aware that with DSPs you can get rather better results; an ASIC will get you another order of magnitude over DSPs (assuming equivalent price -- the Moto 96K DSP is a real gem for bignum math but is many times more expensive than an equally effective ASIC. They were also having serious availability problems last year...) Here is a summary of my points on this subject to date, for those who haven't been following this discussion: o Using coprocessors of any sort to achieve speed in cryptography operations is probably not justified for end users; it is almost always justified for servers with a high volume of transactions requiring public key authentication or encryption. o DSPs are not really as attractive as general purpose CPUs for accelerating cryptography for high-volume servers. Although DSP architecture is somewhat more conducive to bignum math, the benefits seem to be offset by the wide availability of standard CPUs and tools for programming them. If a large increase in speed is desired without resorting to single-purpose hardware, I recommend using a large number of standard CPUs as coprocessors, rather than an equivalent approach with DSPs. (The fact that uint multiplies on a 486 take multiple clock cycles is offset by the higher internal clock speeds and lower cost of the 486. You can point out super-fast DPSs, and I can point out their super-large price tags, more expensive tools, and substantially more expensive programmers.) o The real way to go for speed is ASICs, which give you much better bang for the buck, although they have disadvantages, including problems of export, inflexibility, etc. My favorite RSA chip board so far is from Uti-Maco in Belgium, which is a tamper-resistant add-in card with a 8086-compatible controller and a custom BIOS for doing RSA and DES operations in h/w, which allows s/w to be developed using standard tools. (I have ranted at length about the complications involved with _Beligan_ crypto export controls, which seem to stem from NATO pressure and US desire to balkanize the market for cryptography products.) o People doing valuable transactions on servers are going to want tamper resistance and hardware-key security. This is more important in some cases than speed, although speed is also very important. o People running cryptography-based transaction clients on their PCs are going to learn, one way or another, that having valuable secret keys on their hard disks is not a great idea. This, not speed, is the primary motivation for consumer-oriented cryptography hardware. People want their keys and financial transactions on secure, removable, non-mechanical media. Products that provide this are just starting to come on the market, notably from National Semiconductor and Telequip. o End-user software will need to be written to allow, but not require, external cryptography devices. Consequently, consumer software that performs valuable transactions still needs to be written in an extremely paranoid fashion with respect to the reliability and security of the underlying hardware.

1 0

Spoofing HTTP server certificates
by Greg Miller 17 Dec '03

17 Dec '03

Since there has been a lot of talk about the "man in the middle" attack on the secure web servers, has anyone actually considered the processing time required to fake a certificate from scratch? I haven't really familiarized myself with how the certificates are generated, etc, but it's my understanding that they are signed with RSA. The few recent factorings of RSA keys have shown that brute force attacks are feasable with distributed processing. Since these projects were done "just for the fun of it", wouldn't it seem likley that someone (or some people) would take the time and effort to factor the certificate signing key? After all, it would actually be worth something. gmiller(a)grendel.ius.indiana.edu http://www.ius.indiana.edu/~gmiller/

1 0

Re: Cryptanalysis of RC4 - Preliminary Results (Repeat)
by James A. Donald 17 Dec '03

17 Dec '03

At 06:39 AM 9/30/95 -0400, Dr. Frederick B. Cohen wrote: >The problem is that if these keys are weak, there may be many others >that are also weak. In fact, by the time we explore all of the >weaknesses, we may find the system is no longer very strong at all. These so called weak keys are far from weak. You have a 1 in 64000 chance of reducing the search space by 64000. Big deal. Use 128 bit session keys. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0