December 2003 - cypherpunks-legacy

The I Bomb
by John Young 17 Dec '03

17 Dec '03

A&E presents this week the BBC Horizons show, "The I Bomb," featuring Tim May smart-bombing various brass and infowar chicken littlers. It also shows an SAIC wizard sniffing a system to plant evil polymorphous code a la Shimomura -- presaging the recent GNN report on NSA's net traps. ---------- From: http://www.aetv.com A&E _________________________________________________________________ Series: Voyages. The I-Bomb. A look at how information--not bombs--is becoming the most important weapon in war. Includes interviews with top U.S. military strategists and futurists Alvin and Heidi Toffler. Duration: 1 hour DateTime Thursday1/18 10pm [EST, presumably, since the show just finished] Friday1/19 2am Saturday1/20 11am _______________________________________________________________

1 0

re: CAPI signing
by m5＠dev.tivoli.com 17 Dec '03

17 Dec '03

A Microsoft person just responded via direct e-mail that they'll do CAPI signing in the United States (the word "only" wasn't in there, but that certainly was the implication). This means, to me, that there won't be much CAPI-compliant software produced outside the US, or at least that people who do it will have to bear that insult. It's reminiscent of the Lotus thing. I see no reason for Microsoft to be reluctant to have non-USA signings other than fear of USGov reprisals. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Nobody's going to listen to you if you just | Mike McNally (m5(a)tivoli.com) | | stand there and flap your arms like a fish. | Tivoli Systems, Austin TX | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: ITSEC?
by Jeremy Mineweaser 17 Dec '03

17 Dec '03

At 10:32 AM 1/18/96 -0000, Juan D. Sandoval wrote: >does anyone know where I can get info on Information Technology >Secure Evaluation Criteria (ITSEC)? Here's what I found: ------------------------> Excerpted from _Computer_Security_Handbook,_Third_Edition_ by Hutt, Bosworth, & Hoyt (C) 1995 by John Wiley and Sons: (d) European and Canadian Security Standards. Since its original publication in 1983, the TCSEC has greatly influenced It security. It is widely recognized as a yardstick for evaluating products in relation to security features and assurances needed to support security objectives. TCSEC has also influenced the development of other documents both in the US and abroad, forming a foundation of second-generation requirements. In 1991, the European Community adopted the Information Technology Security Evaluation Criteria (ITSEC) for a two year trial period. The ITSEC approach uses "Security Targets" for expressing security functionality profiles. ITSEC was builtin upon various national initiatives, including the TCSEC, and represents a /harmonized/ effort among Franfce, Germany, the Netherlands, and the United Kingdom. ------------------------> A quick search of INSPEC (described below) turned up some useful results, as well. INSP (INSPEC) Citations and abstracts of articles in physics, electronics, engineering, computer and information technology journals. A keyword search for ITSEC revealed 30+ documents related to IT and systems security measures. The citation below seemed the most useful: Sizer, R. "Information technology security evaluation criteria (ITSEC)." _Computer_Bulletin_, vol.5, pt.5, p.7. Oct. 1993. ISSN: 00104531 ;;gtec. Keywords: data integrity. data privacy. security of data. Class codes: C0310D. C6130S. Date indexed: 12/93. Abstract: The insecurity of IT systems (typified by unauthorised access) is a complex and increasingly aggravating social problem. All sectors of society-commerce, industry, government (local and national) and domestic are at risk. People who have the responsibility for choosing, installing or using IT systems have faced considerable difficulty in choosing IT security products purporting to provide a 'secure environment' employing technical security mechanisms in hardware and software. The problem has, in the main, been the highly subjective claims for, and interpretation of, those security mechanisms. The ITSEC criteria involve the independent evaluation of IT products and systems (hardware and software) which claim security features. Security includes confidentiality, integrity and availability ------------------------> This citation may also be useful, but the text of the paper is in German. Peleska, J. and Reichel, H. of Deutsche Syst.-Tech. GmbH, Kiel, Germany. "Formal specification of generic ITSEC functionality classes." _Informatik_-_Wirtschaft_-_Gesellschaft_ (Informatics - Economy - Society). p.354-64, 1993. ISSN: 3540571922;;gtec. Conference: Informatik Wirtschaft Gesellschaft (Informatics, Economy, Society), Dresden, Germany, 27 Sept.-1 Oct. 1993. Keywords: formal specification. software quality. standards. Class. Codes: C6110B. Date Indexed: 10/94. Abstract: On the basis of the formal specification, the consistency of specification of a concrete product to the ITSEC standards is not only informally motivatable, but also mathematically provable. In this way, the objective visability, quality and efficiency of the evaluation process are increased. For the evaluation of products at Stage E6, use of the described concepts (or of comparable ones) is indispensable ------------------------> I have access via my local library to the first document (the actual ITSEC specification) but not to the second. You should be able to find the _Computer_Bulletin_ at most universities with CS majors. Hope this helps, Jeremy --- Jeremy Mineweaser | GCS/E d->-- s:- a--- C++(+++)$ ULC++(++++)>$ P+>++$ j.mineweaser(a)ieee.org | L+>++ E-(---) W++ N+ !o-- K+>++ w+(++++) O- M-- | V-(--) PS+(--) PE++ Y++>$ PGP++>+++$ t+() 5 X+ R+() *ai*vr*vx*crypto* | tv(+) b++>+++ DI+(++) D+ G++ e>+++ h-() r-@ !y-

1 0

Re: noise levels
by R. J. Harvey 17 Dec '03

17 Dec '03

At 10:20 AM 1/18/96 -0500, Perry wrote: > >The noise levels around here are getting astounding. > >Posts on windows registration wizards, gun control, unemployment, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >Kevin Mitnick's underwear, and all the rest are most certainly NOT >doing us any good. >... >, and YOU DUNDERHEADS >ARE MAKING IT IMPOSSIBLE TO CARRY OUT IMPORTANT DISCUSSIONS. > Well, I'm sure you're correct on most of those, but the post on Microsoft using ENCRYPTED databases of competitor programs as part of its plan to surreptitiously collect information from unsuspecting users when they allow their "wizard" to violate their PRIVACY seems to be quite germane to this lists's topics (which include encryption and privacy, as I recall). I found the reference it pointed to very interesting reading indeed. rj

2 1

Re: CryptoAPI and export question
by James A. Donald 17 Dec '03

17 Dec '03

At 07:36 PM 1/17/96 -0800, Lucky Green wrote: >So the main thing that the new MS CSP accomplishes is to establish a >standard that will prevent foreigners at the OS level from using real >crypto with popular applications. Way to go Microsoft. It seems to me that Microsofts plan is carefully and ingeniously designed to fail: They will do their best to restrain the export of real crypto, but alas, in the end, they will regretfully admit that they failed. Some evil person will have illegally exported real crypto after they signed it. Too bad. How sad. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Random Number Generators
by James A. Donald 17 Dec '03

17 Dec '03

"Timothy L. Nali" writes: > The most promising design I've seen so far (that I can actually > do) is based on clocking a D flip-flop in the following way: > > [Shifts the output of a clock that he hopes will be sloppy into > a shift register] If you want noise, your circuit needs a known noise source, with known good properties Your circuit has no known noise source, you are just hoping that there will be noise in it somewhere. Johnson noise is amplified thermal noise thus it is known to be good: Amplify johnson noise to signal levels, and then shift this random analog output into a long shift register. (You will need a long shift register to suppress metastable states.) You should set up your low frequency analog feedback to get near equality of ones and zeros, and you should have digital feedback (similar to a CRC generator) to get perfect equality of ones and zeros. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Ozzie Apes Jim Clark, Fix Is In to Cave and Cry
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Wall Street Journal, Jan 18, 1996 IBM Compromises on Encryption Keys, U.S. Allows Export of More-Secure Notes By Thomas E. Weber New York -- International Business Machines Corp., caving in to intense government pressure, agreed to include a special key that helps investigators tap into data messages in return for permission to export a more-secure version of its Lotus Notes software. The U.S. has prevented software makers from exporting sophisticated encryption technology for fear that terrorists and other criminals would gain access to a snoop-proof communications system. Industry observers said IBM's move marked the first time a supplier agreed to give the government special access to its software's security code. Encryption keys have stirred the concern of privacy experts in the past. While IBM's Lotus Development Corp. software unit defended the move as a stopgap compromise until a broader agreement on data security can be reached, Notes creator Ray Ozzie clearly found the controversial plan somewhat distasteful. "We were desperate enough to try to negotiate a short-term, pragmatic solution," Mr. Ozzie said. "But we do not believe this is the right long-term solution." One privacy advocate would agree. "The irreducible fact is that foreign customers are reluctant to rely on security products that have been compromised in some way" by federal intelligence agencies, said Mike Godwin, staff counsel for the Electronic Frontier Foundation. Several years ago the government proposed the "Clipper" computer chip that was programmed to let investigators tap into phone calls and data messages transmitted digitally. While that plan died after privacy advocates accused the government of trying to spy on users, the idea of leaving a back door open for government agents has remained alive. Under the Lotus plan, government investigators would still need to employ sophisticated code breaking to read messages sent via Notes software, which lets users at different computers collaborate. Security software encrypts information by using a unique key of software code. The length of a key is measured in computer bits, and longer keys are better -- they're more complex and more difficult for would-be spies, not to mention government agents, to unravel. Until now, to obtain an export license for Notes, Lotus has been restricted to an encryption system of 40 bits in its international version. Domestic users have been permitted to use a higher-level, more-secure 64-bit system. The new overseas version of Notes, tagged Release 4, will give foreign users 64-bit security. But to get permission to export the software, Lotus agreed to give the government access to 24 of those bits by using a special 24-bit key supplied by the National Security Agency. The plan effectively gives the government a headstart in trying to break the encryption scheme. With 24 bits of the key already in hand, the government need only crack the remaining 40 bits -- a task considered trivial for the code-masters at the NSA. As far as the U.S. government is concerned, this version of Notes is no more difficult to crack than the previous one. The advantage to customers, Mr. Ozzie said, is that anyone other than the U.S. government -- say, a malevolent criminal or computer hacker -- would face the more daunting task of breaking the 64-bit key. Mr. Ozzie said the move was a response to complaints from foreign purchasers of Notes. "Our customers have been telling us that, unless we did something about the security, we could no longer call it a secure system," Mr. Ozzie said. It remains to be seen whether Lotus's move will allow it to sell more software. "The idea is a good stopgap measure," said Stephen Franco, an analyst at Yankee Group in Boston. "But the most important thing is pushing the U.S. government to relax some of its restrictions" on exports. --

1 0

(fwd) Crypto SmartDisk(tm)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: Postmaster(a)thumper.vmeng.com Reply-To: e$(a)thumper.vmeng.com Mime-Version: 1.0 From: rah(a)shipwright.com (Robert Hettinga) Date: Thu, 18 Jan 1996 08:02:46 -0500 Precedence: Bulk To: Multiple recipients of e$pam - Sent by <rah(a)shipwright.com> Subject: Crypto SmartDisk(tm) --- begin forwarded text `Computer Within a Floppy Disk` puts secure electronic commerce in the palm of your hand SAN FRANCISCO--(BUSINESS WIRE)--Jan. 17, 1996--Fischer International Systems Corp. (FISC) announced Wednesday the availability of Crypto SmartDisk(tm), the world's first intelligent security token housed in a floppy disk-sized device. The announcement was made at the annual conference of RSA Data Security Inc., a leading encryption algorithm vendor. Addison M. Fischer, founder and chairman of FISC and a world-recognized leader in systems and data security, attended the meeting with fellow experts in cryptography. Crypto SmartDisk is a self-contained computer, complete with crypto coprocessor, memory, real time clock, and resident operating system. It fits in any of the 150 million installed standard 3.5 inch floppy disk drives; no additional hardware is required. Crypto SmartDisk supports RSA, DSA and DES algorithms for encryption and digital signatures. The RSA public key cryptographic system is the de facto standard and is commonly used to create digital envelopes for secure electronic commerce. DSA is a standard for digital signatures that is endorsed by the U.S. government, and DES is the most widely used and tested encryption algorithm available. `Crypto SmartDisk breaks barriers in the world of secure electronic commerce,` said Michael S. Battaglia, FISC president and CEO. `It literally puts in any user's hands the power to use any PC with a 3.5 inch floppy drive as a secure electronic transaction station. Businesses, government agencies, even private citizens can use Crypto SmartDisk to engage in secure electronic commerce with complete confidence that their transactions will be read only by those people the users intend.` Crypto SmartDisk is positioned to gain rapid acceptance among agencies of the U.S. federal government, particularly those that manage civilian applications. It offers the benefits of hardware-based encryption without the expense of retrofitting PCs that don't have card readers. By using a Crypto SmartDisk, for example, private citizens could conduct secure electronic transactions with agencies like the U.S. Postal Service (USPS), Social Security Administration (SSA), and IRS from their home computers. The General Services Administration Security Infrastructure Program Management Office is planning just such a pilot project, with hundreds to thousands of participants including private citizens. Using Crypto SmartDisk, participants may conduct electronic transactions such as requesting SSA benefit information, inquiring about the availability of federal loans, and potentially even filing on-line tax returns with the IRS. Crypto SmartDisk also offers a developer's toolkit so users can create their own applications featuring encryption capabilities. The toolkit provides both software tools and libraries and is fully compliant with the PKCS No. 11 standard and the ISO 7816 standard. Fischer International Systems Corp. is a leading worldwide supplier of software solutions for secure Electronic Commerce. Founded in 1982, it is one of the largest privately held software companies in the United States. Its products include Watchdog(r) and SmartDisk(tm) for PC data security, TAO(tm) (Totally Automated Office) for cross-platform, multilingual messaging and office automation; EDI/comm(tm) for Electronic Data Interchange; and WorkFlow.2000(tm) for cross-platform automated forms and process management. Crypto SmartDisk and the Crypto SmartDisk toolkit are available for immediate shipment. -0- NOTE TO EDITORS: In the Internet/email address noted in the contact information in this news release, there is an `at` symbol between Chamberlain and fisc.com. This symbol may not appear properly in some systems. --30--jd/mi.. CONTACT: Fischer International Systems Corp., Naples, Fla. Katharen Chamberlain Phone: 941/436-2678; Fax: 941/436-2586 Internet: Kathy.Chamberlain(a)fisc.com ============================================================================ --- end forwarded text -------------------------------------------------- The e$ lists are brought to you by: Making Commerce Convenient (tm) - Oki Advanced Products - Marlboro, MA Value-Checker(tm) smart card reader= http://www.oki.com/products/vc.html Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk See your name here. Be a charter sponsor for e$pam, e$, and Ne$ws! See http://thumper.vmeng.com/pub/rah/ or e-mail rah(a)shipwright.com for details... ------------------------------------------------- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

2 1

Re: Crypto on private files
by Sean Donelan 17 Dec '03

17 Dec '03

>According to the newscaster, the NY state court decision should be a >first in this type of case. Prosecutors argue it is no different from >being forced to turn over a diary. No, its the same as being forced to translate or interpret a diary entry. Prosecutor: Please turn over the name you have 'encrypted' as "Mr. X" in your diary. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

FW: CrytoAPI on Cypherpunks
by Tom Johnston 17 Dec '03

17 Dec '03

General comments: please take a look at our web page: http://www.microsoft.com/intdev/inttech/cryptapi.htm, and e-mail cryptapi.com with questions. Comments in-line >>> below. >From: Matt Blaze <mab(a)research.att.com> To: cypherpunks(a)toad.com Subject: Microsoft's CAPI Date: Wed, 17 Jan 1996 10:02:27 -0500 I attended a meeting at Microsoft the other day at which they described their Crypto API project. As CAPIs go, it's reasonable enough; nothing particularly exciting about it or especially wrong with it (though they don't yet support nonblocking calls to crypto modules). >>> We received several requests at the design review to add >>> non-blocking calls. We're looking to add this. ... They have (or will have soon) an application development kit to allow you to write code that uses the API, and a CSP development kit to let you write the crypto functions. >>> Doc's and sample code from the SDK are available now on >>> our web page: http://www.microsoft.com/intdev/inttech/cryptapi.htm. >>> Please e-mail cryptapi(a)microsoft.com if you're interested in a >>> CSP development kit. ...One important issue is whether MS will really sign anyone's CSP or whether they will start charging high fees or making business-based decisions on who's CSPs they will allow (with they sign Netscape's CSP, for example). They say they won't even look or keep a copy of your CSP (at my suggestion, they are probably going to change the process so that you send them a hash of your CSP instead of your CSP code when you get the signature). For now they promise to sign CSPs for anyone who returns the export certificate, at no charge. >>> We won't charge high fees (right now, it's free!). Our policy is >>> simple: we'll sign the CSP of anyone who follows the rules. >>> Yes, we would sign a CSP from Netscape if they follow the rules. >>>We won't look at or keep a copy of the CSP, and >>> we won't tell your competitors about it (unless you ask us to). ... They say that the API kit will not be export-controlled but the CSP kit will be. >>> The SDK is not export-controlled. The CSP development >>> kit is export-controlled.

1 0