December 2003 - cypherpunks-legacy

underground digital economy
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Question: The existing underground economy uses the same money as the aboveground economy (i.e. paper money, for the most part). Could a significant underground digital economy develop if the aboveground digital economy used only identified e-money? Jim_Miller(a)suite.com ____________________________________________________________________ The Internet is a land bridge for memes ____________________________________________________________________

1 0

Scientic American
by Dan Harmon 17 Dec '03

17 Dec '03

The latest issue of SA has a small piece in zero knowledge transactions in the Math Rec section. Dan

1 0

Re: A WfW security curiosity (possibly another security hole)
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>>[WFWSYS.CFG file] > >This is the file used by admincfg.exe (on WFW3.11 disk 8). This file >contains "security" settings, such as whether or not to cache passwords >on disk (*.PWL files). Ahh, so you can silently reenable password cacheing by manipulating this file, thereby defeating Microsoft's "turn off password cacheing" kludge. Wonderful. I'll have a poke around on Monday to figure out what bits to flip and post the results here. Thanks for the info... Peter.

1 0

noise levels
by Perry E. Metzger 17 Dec '03

17 Dec '03

The noise levels around here are getting astounding. Posts on windows registration wizards, gun control, unemployment, Kevin Mitnick's underwear, and all the rest are most certainly NOT doing us any good. Here we are in the midst of IBM putting espionage enabled versions of Lotus Notes out (someone should be putting out a hack to change the embedded public key), Microsoft putting out a crypto API that could potentially be of enormous interest, activity moving in the Karn lawsuit, and all sorts of other important events, and YOU DUNDERHEADS ARE MAKING IT IMPOSSIBLE TO CARRY OUT IMPORTANT DISCUSSIONS. If you want to help the NSA in its mission to stop the dissemination of strong crypto, by all means, continue posting garbage. Perry

6 5

EPIC: Commerce Report on Crypto Availability
by tc＠phantom.com 17 Dec '03

17 Dec '03

Commerce Releases Crypto Availability Report The US Department of Commerce today released a report on the international market for encryption software. The report, which was jointly produced by the Commerce Department's Bureau of Export Administration and the National Security Agency reviews the foreign availability of encryption products and other nations' import, export and domestic use policies. The report finds that there are foreign products available which "can have an impact on US competativeness" and that US export controls "may have discouraged US software producers from enhancing the softare features of general purpose software to meet the anticipated growth demand by foreign markets. It anticipated that there is a steadily increasing demand for crypto to be included in general use software products becuase of well publicized break-ins. A large portion of the report has been redacted by the NSA. EPIC filed suit under the Freedom of Information Act in December 1995 to obtain a full copy of the report and will continue to demand its release. EPIC believes that the US goverment should remove export controls on public domain and commerical software that contains encryption and end the policy of demanding that key escrow be implimented in all encryption software. Enclosed in the Commerce Department Press Release and Executive Summary of the report. The full report is over 100 pages. EPIC will make every effort to make the full report available in electronic form as soon as possible. More information on crypto policy is available at the EPIC Web Site at http://www.epic.org/crypto/ UNITED STATES DEPARTMENT OF COMMERCE NEWS WASHINGTON DC.20230 OFFICE OF THE SECRETARY FOR IMMEDIATE RELEASE CONTACT: Carol Hamilton Thursday, January 11,1996 (202) 482-4883 Eugene Cottilli (202) 482-2721 DEPARTMENT OF COMMERCE RELEASES STUDY ON THE INTERNATIONAL MARKET FOR ENCRYPTION SOFTWARE Washington, D.C. -- The growth of an international market for encryption software is being slowed by strong export controls, both in the United States and other major countries. Moreover,the quality of products offered abroad varies greatly, with some not providing the level of protection advertised. The study, jointly prepared by the Commerce Department's Bureau of Export Administration (BXA) and the National Security Agency (NSA), evaluates the current and future market for computer software with encryption, which allows users to protect their data using codes. The study also reviews the availability of foreign encryption software and assesses the impact that U. S. export controls on encryption have on the competitiveness of the software industry. "Our study provides a clear snapshot of the international competition in this segment that the software industry faces," said Cornmerce Secretary Ron Brown. "Better understanding of the products and the marketplace gives us the tools to ensure that our export control policies are appropriate," he added. The study noted encryption software presently accounts for only a small percentage of the total computer software but should grow substantially as the U.S. and other countries deveiop and expand public networks and electronic commerce. The study found that the U.S. software industry still dominates world markets. In those markets not offering strong encryption locally, U.S. software encryption remains the dominant choice. However, the existence of foreign products with labels indicating DES (Data Encryption Standard) or other strong algorithms, even if they are less secure than claimed, can nonetheless have a negative effect on U. S competitiveness. The study also notes that the existence of strong U.S. export controls on encryption may have discouraged U.S software producers from enhancing the security features of general purpose software products to meet the anticipated growth in demand by foreign markets. page 2 All countries that are major producers of commercial encryption products were found to control exports of the products to some extent. A few countries (e.g., France, Russia, and Israel) control imports and domestic use of encryption, as well. As part of the study, NSA evaluated twenty-eight different foreign encryption software products, finding that some were less secure than advertised. Because customers lack a way to determine actual encryption strength, they sometimes choose foreign products over apparently weaker U.S. ones, giving those foreign products a competitive advantage. -30- A STUDY OF THE INTERNATIONAL MARKET FOR COMPUTER SOFTWARE WITH ENCRYPTION [Note: This is a redacted copy of the ogigional secret decoment. Brackets [] accompanied by the origional classifications have been used to indicate location and size of excised classified text] Prepared by the U.S. Department of Commerce and the National Security Agency for the Interagency Working Group on Encryption and Telecommunications Policy EXECUTIVE SUMMARY BACKGROVND In late 1994, the President's National Security Advisor directed that an interagency report be prepared assessing the current and future international market for software products containing encryption and the impact of export controls on the U.S. software industry. The report was to include an assessment ofthe impact of U.S. encryption export controls on the international competitiveness of the U.S. computer software industry and a review of the types, quality, and market penetration of foreign-produced encryption software products. This paper presents the joint efforts of the Department of Commerce/Bureau of Export Administration and the National Security Agency to complete this tasking. (U) EXPORT CONTROLS All countries that are major producers of commercial encryption products control exports of those products to some extent. Control methodologies and licensing practices vary, however, and a few countries, most notably France, Russia and Israel also control imports and/or domestic use of encryption. There is a significant amount of international cooperation in controlling encryption exports. (U) Some European and other countries apparently treat exports to the United States of DES- based software more liberally than the United States treats DES exports to those countries. Some countries have stated that they generally restrict DES exports to financial end-uses. In general, no independent verification of these licensing practices was obtained. However, in some cases the U.S. was able to obtain DES products from them for non-financial end-uses. It is possible that some countries may allow these exports based on their political/economic/military relationship with the destination country (e.g., within the European Comrnunity, or former COCOM), for end uses that are considered legitimate commercial applications of the technology, or, in the case of exports to the United States, because DES is a national standard. (U) As the technology and the marketplace have evolved, the USG export control authorities have relaxed licensing constraints on cryptographic products several times over the past 10 years. These changes have usually been made after industry pressures and internal debate to balance national security and economic concerns. (U) DOMESTIC AND INTERNATIONAL MARXETS While presently encryption software accounts for only a small percentage of the total software market (1-3%), according to numerous information security experts contacted in the course of the study, the future growth trend for this sector is expected to be great. The market for encryption in distributed computation, databases, and electronic mail is beginning to expand exponentially as the U.S. and other countries develop and popularize electronic commerce, public networks, and distributed processing. (U) Encryption in these environments will often be implemented in software, as opposed to hardware, because it is generally less expensive and simpler to install and upgrade. Absent changes in government standards, for the next ten years, encryption software will primarily use DES and RSA-licensed encryption algorithms. Other non-standard and company proprietary algorithrns will be used primarily for security-specific products for small niche markets. (U) Certain developments are promoting greater use by the general public of software-based network security features, including encryption, throughout the industrialized world. They include ever increasing use, fueled by well publicized "break-ins," of distributed databases, popular acceptance and usage of global networks, and the development and use of electronic commerce. (U) These developments are ongoing at one stage or another in practically all of the countries surveyed for this assessment. Less technologically advanced countries, where demand for encryption software is reportedly negligible, will soon undergo widespread development and computerization leading to increased demand for encryption so~ware within the next 10 years. (U) The overwhelming majority (75%) of general-purpose software products (e.g., word processors, spread sheet programs, and database programs) available on foreign markets today are of U.S. origin. Cornmerce Department analyses indicate that the U.S. has few viable foreign competitors for such products, and of those general-purpose products with encryption features, all were found to be of U.S. origin. (U) In the security specific software market, however, U. S. manufacturers face competition in several foreign markets from such encryption exporting countries as the United Kingdom, Germany, and Israel. To a large extent, markets for these products tend to be "national. " Not only do export controls affect sales, but local vendors of security-specific products are at a competitive advantage in that they are better situated to work closely with end- users and develop encryption solutions tailored to meet the conditions of the local environment. (U) NSA confirmed the existence of a significant number of foreign security-specific software products with encryption features, predominantly from Western European suppliers. Security-specific products are usually not available on the shelf at retail stores either in the U.S. or abroad, but can be purchased through direct contact with the manufacturer. (U) ES-2 BXA attempted to quantify U.S. competitiveness and market share in 31 foreign countries where encryption is thought to have significant demand. While sources in the countries surveyed had limited access to import statistics or market literature on encryption software and encountered nwnerous difficulties in evaluating this complex market, definite conclusions may be drawn from the responses. (U) Sources in 14 countries indicated that U.S. export controls limit U.S. market share in their countries. Sources in seven countries indicated that export controls have either no impact or no major impact. (U) Sources in most countries indicated that the U.S. market share is keeping pace with overall demand despite the impact of U.S. export controls, which may promote indigenous production or reduce U. S. market penetration. In all known cases, the U.S. holds the majority of the general-purpose encryption software market. (U) Three exceptions are Switzerland (where the U.S. market share reportedly declined in 1994, while the market shares of other European countries rose), Denmark and the United Kingdom, which reported unspecified declines from previous years. Sources in all three countries attribute the decline to U.S. export controls, which they claim promote the development and sale of indigenous encryption products. (U) In many countries surveyed, exportable U. S. encryption products are perceived to be of unsatisfactory quality. (U) ANALYSIS OF FOREIGN PRODUCTS NSA used various methods to procure encryption software products from a variety of countries and companies, as reflected in the TIS database and other sources. Altogether, 28 products from 22 foreign producers in 10 countries were acquired for the purposes of this study. Of these, 21 purportedly use the DES algorithm, while the remaining 7 use proprietary algorithms. (U) [ ] (S) ES-3 ECONOMIC IMPACT In the absence of significant foreign competition, the impact of U.S. export controls on the international market shares of general-purpose products is probably negligible. Customers are often unaware of the encryption features in these products and primarily base purchases on the features implementing the primary function of the product (e.g., word processing or database). (U) [ ] (S) BXA attempted to quantify the economic impact of export controls on the U.S. software industry by forwarding a detailed voluntary questionnaire to 206 software vendors and other interested parties. Thirty six encryption software manufacturers provided completed surveys out of the 71 returned. By and large, the companies were unable or unwilling to quantify the costs of export controls, but did provide substantive explanations of how and why they believe they are adversely affected. (U) Some general-purpose software companies claim that export controls have affected their plans to expand security features to meet anticipated growing demand. These companies believe that they could expand their domestic and international customer base with such features. (U) The export licensing process itself is not a major obstacle to U. S. competitiveness. Only seven survey respondents use the Department of State licensing system. While they continue to have some complaints about the administrative burdens and time delays associated with State's process, several noted that there had been improvements in recent years. Only two of the survey respondents had been denied licenses by the Department of State. (U) Numerous survey respondents indicated that they avoided applying for export licenses from the Department of State altogether. Some larger companies whose products tended to be general-purpose in nature either developed two ~fersions of so~ware, or incorporated an encryption algorithm they knew would qualify for Commerce general licenses. (U) Many smaller, security-specific software firms, on the other hand, elected to limit their sales to the domestic market only. These companies indicated a high level of foreign interest in purchasing their products, and therefore lost potential sales. While it is difficult for them to quantify their potential market, they believe it to be sizeable. They claim their small size limited their ability to develop two versions of their products, and the fact that their products were for secunty purposes ES-4 specifically requires them to incorporate strong encryption. Only one company was able to provide specific examples where a foreign competitor o~ta ned a sale due to an export license denied by U.S. authorities. (U) There is little evidence that U.S. export controls have had a negative effect on the availability of products in the U.S. marketplace. A broad range of products with secure algorithms exist in the U. S. market and availability of products is based principally on the level of customer demand. Export controls may have hindered incorporation of strong encryption algorithms in some domestic mass-market, general-purpose products, since some companies find developing and maintaining two versions of a product infeasible. (U) The existence of foreign products with labels indicating DES or other strong encryption algorithms, even if they are less secure than claimed, can nonetheless have a negative effect on U.S. competitiveness. Most encryption users base their purchasing decisions on the advertised product features, along with price, company reputation, etc. (U)

1 0

Re: Lotus to export 64 bit, partially-escrowed Notes
by jim bell 17 Dec '03

17 Dec '03

At 03:45 PM 1/17/96 -6, Peter Trei wrote: >A new 'international' version of Lotus notes is being released, with >64 bit session keys, as opposed to the old 40 bit version. > >24 bits of the session key are stored encrypted under a special, >government-access RSA public key. This is in addittion to the full >64 bit key being available under the recipient's public RSA key. > >The idea is that the USG would have to search only a 40-bit keyspace, >while others will need to search a 64-bit keyspace. >Reportedly, this 'workfactor reduction key' will NOT be available to >foreign governments. >My colleague reports that opinion at the conference was divided over >whether Lotus was doing something which made good business >sense, or whether this was 'caving-in'. My "vote"? They're "caving-in."

2 1

Crippled Notes export encryption
by Alan Pugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -- [ From: Alan Pugh * EMC.Ver #2.3 ] -- Since this is definitely on-list, and I haven't seen anything on it here yet, I'm posting the whole thing. Apologies for duplication. Date: Wednesday, 17-Jan-96 04:23 PM Subject: infoMCI FLASH - Lotus-Security - Lotus Announces C [infoMCI FLASH] i n f o M C I F L A S H infoMCI (sm) Lotus-Security - Lotus Announces Compromise for Export of Strong Encryption By ELIZABETH WEISE AP Cyberspace Writer SAN FRANCISCO (AP) _ Lotus Development Corp. announced a compromise with the federal government Wednesday that will allow it to put better security features into the international version of its Notes program. While the arrangement assures the government it can access data under extreme circumstances, it represents an advance in the strength of security allowed in software exported from the United States. Federal law prohibits the export of certain high-level encryption programs, which are defined as a munition under a Cold War-era arms control act. Encryption programs take ordinary data and put it in secret form that cannot be accessed without the proper data ``key.'' The government's arbitrary standard for cracking encryption programs when needed is at a technical level described as ``40-bit.'' Some software programs sold in the United States, including Lotus Notes, now use stronger 64-bit encryption. Lotus has been under pressure to bring such security to Notes users overseas. Although 40-bit encryption is quite strong, highly-sophisticated attacks using several computers have been able to break it recently. ``Our customers have basically lost confidence in 40-bit cryptography,'' said Ray Ozzie, president of Iris Associates, the unit of Lotus that developed Notes. ``That left us in a bind. We are the vendor that's supposedly selling a secure system to them and they are saying it's no good,'' Ozzie told a standing room audience at the RSA Data Security conference. Changes in the general export laws seemed unlikely so Lotus negotiated an interim solution. The export version of Lotus Notes 4.0, which went on sale last week, includes 64-bit encryption but the company has given the U.S. government a special code that unlocks the final 24 bits. For companies that use the international version of Notes, it's as if Lotus put two strong locks on a door and gave a key for one to the U.S. government. Thieves have to get break through two locks, the government only one. ``This protects corporate information from malicious crackers but permits the government to retain their current access,'' Ozzie said. He acknowledged the solution was only a compromise and said Lotus wants to see better data security methods developed worldwide. However, many participants at the conference saw the move as a cosmetic answer to the tension between corporate desires for the best security and government's interest to access data when necessary. ``It's a useful stopgap measure that has no value in the long run,'' said Donn Parker, a senior security consultant with SRI International, a computer research company in Menlo Park, Calif. Simson Garfinkel, author and computer security expert, said he's not sure international buyers of Notes will like the solution. ``Foreign companies don't want the U.S. government to spy on their data any more than the U.S. government wants foreign companies to be able to spy on theirs,'' Garfinkel said. International Business Machines Corp. bought Lotus in July, citing the success of Notes, a sophisticated communications and database program. AP-DS-01-17-96 1619EST (66413) *** End of story *** - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMP2KdioZzwIn1bdtAQGdegF9GVCEfL50vWd7e5XX/mKEnzGy5YGvW0iD rNPCmz3Xxf3h9wOVJMLrCeDGwe4/m84g =6jpa -----END PGP SIGNATURE-----

4 3

[NOISE] Re: A Modest Proposal: Fattening up the Proles
by Bruce Baugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 08:54 AM 1/17/96 -0500, John Young <jya(a)pipeline.com>wrote: > By any means, emulate elitist indolents and avoid anxiety. > Display iron-fisted civilized beliefs, practice tough-love > humiliation and master-over-slave manners and militant > mind-couture, but do nothing truly disruptive of the status > quo that so rewards niche market exploiters of genuine > dissent. The patient displays advanced signs of Stephen Donaldson's Disease. We recommend _immediate_ replacement of the TrendyLeft <tm> thesaurus and spelling checker package with more robust models. Strunk&White GoodWrite <tm>, say, or perhaps RichardScarrySoft <tm>. More seriously, I recommend a re-reading (or first reading, as it may be) of Orwell's "Politics and the English Language". I quote: "In our time it is broadly true that political writing is bad writing. ... Orthdoxy, of whatever color, seems to demand a lifeless, imitative style. The political dialects to be found in pamphlets, leading articles, manifestos, White Papers and the speeches of under-secretaries do, of course, vary from party to party, but they are all alike in that one almost never finds in them a fresh, vivid, home-made turn of speech. When one watches some tired hack on the platform mechanically repeating the familiar phrases - bestial atrocities, iron heel, bloodstained tyranny, free peoples of the world, stand shoulder to shoulder - one often has a curious feeling that one is not watching a live human being but some kind of dummy. ... And this is not altogether fanciful. A speaker who uses that kind of phraseology has gone some distance towards turning himself into a machine. ... "Consider for instance some comfortable English professor defending Russian totalitarianism. He cannot say outright, 'I believe in killing off your opponents when you can get good results by doing so.' Probably, therefore, he will say something like: 'While freely conceding that the Soviet regime exhibits certain features which the humanitarian may be inclined to deplore, we must, I think, agree that a certain curtailment of the right to political opposition is an unavoidable concomitant of transitional periods, adn that the rigors which the Russian people have been called upon to undergo have been amply justified in the sphere of concrete acheivement.' "The inflated sytle is itself a kind of euphemism. A mass of Latin words falls upon the facts like soft now, blurring the outlines and covering up all the details." Ironically, of course, Tim May's brutal honesty (right or wrong, he's almost always clear) is lots more "populist", the sense of being readily and widely understood, than John Young's stale academese. Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMP2PZX3AXR8sjiylAQG6gAfPVudIcO/WocUGwVYF7GVk5GvYT7ToYnR0 76SQXeEmwuvoG0reFoJdKJEGpJ5IQTboIgIyHYmEtirteH3y1vGeeiqQfmIhtx+S aUUtNHSOGKNUfSNvwY2Fw0Ij/3sAR16jZFmh4T1TPRW1xwgo0KYUkvB4tk5tx1sD Hzd+D2cPJNP/WhmwntkaXhynwnlgcYyLxqwjoD4QfiEHHS0Lbv+JVWuutJpKTih0 yFnhStoD9YL0ynZwIbfqZpl7HiX3FAAQ7aNLFPyqqRajJmTO7GuQLju8T1cWT+n+ oUTzgmXLtw5FY4OOLPR6mKkLvilyb1UzmX+GG/AlA671Ng== =qBu4 -----END PGP SIGNATURE----- Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0

Re: Ozzie Apes Jim Clark, Fix Is In to Cave and Cry
by Frank Stuart 17 Dec '03

17 Dec '03

>Wall Street Journal, Jan 18, 1996 > >IBM Compromises on Encryption Keys, U.S. Allows Export of >More-Secure Notes [...] >The new overseas version of Notes, tagged Release 4, will give >foreign users 64-bit security. But to get permission to export >the software, Lotus agreed to give the government access to 24 >of those bits by using a special 24-bit key supplied by the ^ >National Security Agency. [...] Does anyone know if there really is just one 24-bit key for every copy of Lotus Notes or is this a miscommunication? If there really is just one 24-bit key for everyone, can't you just look for the bits that don't change among different 64 bit keys? (e.g. AND a "sufficiently large" number of 64-bit keys together to find the 1's that don't change and then OR them to find the 0's until you've got the 24 bit key). Someone, please tell me that's not how it works (or post the 24-bit key :>). | (Douglas) Hofstadter's Law: Frank Stuart | It always takes longer than you expect, even fstuart(a)vetmed.auburn.edu | when you take into account Hofstadter's Law.

2 1

Re: CryptoAPI and export question
by hallam＠w3.org 17 Dec '03

17 Dec '03

>Two points: the CSP development kit is export-controlled; and signing a >CSP developed by a foreign vendor is treated as a export -- so the signature >is export-controlled. >We would ship a CSP development kit to a foreign vendor, and sign a CSP >developed by the foreign vendor, but only with the appropriate export licenses. This could lead to problems. I'm not sure what the European Community reaction to US attempts to export its legal system will be. The problem is that the Lotus Notes scheme changes the previous deal. Before the European governments benefited from the US export control laws because they had wiretap abilities. Now they are denied wiretap capabilities and have the US able to snoop on all their traffic. Could find yourselves in the middle of a nasty battle... Phill

1 0