December 2003 - cypherpunks-legacy

Sci-Atlanta Uses RSA
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Scientific-Atlanta Announces Development of PowerKEY Conditional Access System Using RSA 'Public Key' Encryption Techniques PowerKEY System Will Provide Sophisticated Security For Signal Content, Interactive Messaging and Electronic Commerce S-A Becomes First Digital Set-Top Terminal Provider To Use Patented RSA Algorithms Atlanta, Jan. 9 -- Scientific-Atlanta, Inc. announced today that it has licensed advanced encryption technology from RSA Data Security, Inc. to be included in its PowerKEY(TM) digital conditional access system, which is being developed for use in set-top terminals, headend components, cable modems and network element management software. The system will combine public key and secret key cryptographic methods in physically secure implementations to provide a high-performance security solution for broadband networks. Sophisticated conditional access systems allow cable and other broadband network operators to be more flexible in implementing new services that employ easy-to-use security. For example, both content providers and network operators can have their own secure way to protect content and communicate interactively with subscribers. Theft of services, falsified orders, and vandalism of software and databases can be curtailed. Sensitive information, such as credit card numbers, can be encrypted and exchanged. In addition, the identity of the sender and the message content can be authenticated -- an important capability for multi-provider authorization environments and for validation of orders from subscribers. The PowerKEY system, which is designed to be a licensable access control and security system, will combine robust security and encryption techniques with physically secure implementation and sophisticated control systems. The PowerKEY system will be available on a variety of interactive and broadcast networks, including CATV broadcast, data, broadband multimedia, switched and terrestrial wireless. Its key functions will include: -- message authentication to reject altered content and prevent downloading computer viruses to digital terminals -- RSA's method of digital signature to provide unambiguous confirmation of sender's identity -- public key encryption for secure transfer of entitlements, authorizations and consumer orders -- high-speed secret key encryption to protect against theft of services -- physically secure logic with renewable and replaceable security modules to thwart pirate tampering -- seamless operation in support of both analog and digital services -- multi-provider authenticated key management -- forward and reverse path protection -- messaging with guaranteed non-repudiation without need for trusted third parties RSA's products are considered a de facto standard for data encryption and authentication all over the world. The license to Scientific-Atlanta is the first that RSA has granted to a set-top terminal manufacturer of its widely adopted, patented technique for private messaging and digital signature authentication. The agreement provides for the licensing of RSA technology, including the algorithms that enable RSA's public key-private key cryptography. No other terms of the agreement were disclosed. With the PowerKEY system, Scientific-Atlanta plans to use RSA cryptography algorithms in its end-to-end digital systems -- set-top terminals, headend equipment and control systems -- to improve communications security for digital pay-per-view, cable modems and other broadcast and interactive applications. Scientific-Atlanta also plans to license the PowerKEY system for use by other manufacturers. The widespread deployment of RSA encryption methods supports the move to open standards of interactivity. "RSA's public key technology is one of the most advanced forms of commercial cryptography available today," said Michael P. Harney, Scientific-Atlanta's vice president and general manager of broadband systems and technology. For the first time, this highly sophisticated encryption technology will be bundled in a conditional access system for both broadcast and interactive applications. This means carriers and MSOs will have a much better way to manage conditional access issues." The PowerKEY system's implementation of RSA algorithms and Cylink Corporation's "Stanford patents" (licensing of which was also announced today by Scientific-Atlanta) is designed to be compatible with global open standards, such as MPEG, DVB and DAVIC. RSA developed and patented a method of exchanging authenticated secret messages without exchanging secret keys. Most encryption systems rely on the sender of a message or document to know the receiver's "secret key." The more parties a secret key is distributed to, the more vulnerable it becomes to unauthorized use. With RSA's "public key" approach, a person's public key can be made available to any interested party to send that person a private message. There is no need to privately exchange secret keys. For other parts of the electronic network services application, such as digital video transmission, the PowerKEY system will employ proven private key algorithms that provide high-speed operation and excellent signal security. RSA Data Security is a leading cryptographic research and development firm. Its products focus on the secure creation, transmission and storage of data, as well as authenticating the author of data. RSA provides software developers with its BSAFE(TM) cryptography engine, which includes multiple algorithms and modules for adding encryption and authentication features to any application. Scientific-Atlanta plans to use RSA's engines for development of some elements of the PowerKEY system. Scientific-Atlanta is a leader in providing conditional access systems for broadband and satellite communications networks. Its Vari-Axis(TM) analog descrambling systems are deployed in millions of analog set-tops, and a robust, secret-key digital conditional access system, based on proven BMAC technology, is part of the PowerVu(TM) system family of products. The PowerKEY system will expand Scientific-Atlanta's product line to include the industry's first conditional access system to utilize public key cryptography. Scientific-Atlanta, Inc. (http://www.sciatl.com) is a leading supplier of broadband communications systems, satellite-based video, voice and data communications networks and worldwide customer service and support. The company is the Official Broadband Video Distribution Sponsor of the 1996 Olympic Games in Atlanta, Georgia.

1 0

Sci-Atlanta Uses Cylink
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Scientific-Atlanta Licenses Cylink's Security Techniques for Digital Broadband Application First Use of Patented Cylink Public Key Methods by a Digital Set-Top Terminal Supplier for Two-Way Message Encryption, Decryption and Authentication Atlanta, Jan. 9 -- Scientific-Atlanta, Inc. announced today the licensing from Cylink Corporation of communications security techniques for use by cable and other broadband television systems. Cylink, a provider of enterprise-wide network information security products and wireless communications, has licensed to Scientific-Atlanta what are known as the "Stanford patents," which cover the field of public key cryptography, a security technique that ensures privacy, authentication and integrity of electronic information. The license gives Scientific-Atlanta the right to practice public key cryptography methods, as defined in certain intellectual property holdings of Cylink. These include methods for generation, authentication and exchange of "public keys" used in securely communicating point-to-point network messages. Scientific-Atlanta plans to use these cryptography techniques in its development of a conditional access system for digital networks -- including set-top terminals, headend components, and network element management software -- to improve communications security for digital pay-per-view, cable modems and other broadcast and interactive applications. The license is the first that Cylink has granted to a set-top terminal manufacturer of its patented cryptographic techniques. No other terms were disclosed. With sophisticated encryption systems, cable and other broadband network operators can be more flexible in implementing new services that employ easy-to-use security. For example, both content providers and the network operator can have a secure way of interactive communications with subscribers. Sensitive information, such as credit card numbers, can be encrypted and exchanged. The identity of the sender and the message content can be authenticated -- an important capability for multi-provider authorization environments and for validation of orders from subscribers. A public key-based cryptography system controls the encryption and decryption of messages. Each user is assigned two unique mathematically-related keys: a published public key, and a secret private key. In a cable TV environment, the public key for each subscriber's set-top terminal can be distributed or "published" while keeping the private key in secure memory. "We're excited about the opportunities this license opens for content providers and network operators," said Bob Van Orden, Scientific-Atlanta's product line director of digital subscriber systems. "With Cylink's innovations, we have the foundation necessary for designing very advanced security into any digital broadband application, including pay-per-view, cable modems and electronic shopping." "Through the use of public key technologies, Scientific- Atlanta will help network operators to protect the value of their services," said David Morris, vice president of marketing for Cylink. "This is a vitally important step for operators as they migrate to digital networks." Scientific-Atlanta, Inc. (http://www.sciatl.com) is a leading supplier of broadband communications systems, satellite-based video, voice and data communications networks and worldwide customer service and support. The company is the Official Broadband Video Distribution Sponsor of the 1996 Olympic Games in Atlanta, Georgia.

1 0

Re: E-cash and Interest
by jim bell 17 Dec '03

17 Dec '03

At 08:20 AM 1/10/96 -0500, you wrote: > >I think that you have hit the nail on the head. Money could still 'earn' >interest until it is spent. The 'bank' still has the 'real' money. In >fact, it is an improvement over cash, in that you could still earn >interest on the money on your hard drive. >Thanks for the clarification. I think there is another way of looking at the ecash/interest situation: >From upside down, so to speak. If the USE of Ecash avoids (legally or illegally) income or sales taxes, that constitutes an "interest," in an odd sort of way. Not "real" interest, of course, but the next best thing.

2 1

Why Companies are Poor at Finding Bugs
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:37 AM 1/9/96, Lucky Green wrote: >Very true. But why does it always seem to take an exploitable crack before >companies pay attention to security flaws? Is it because they are unable to >admit that they have made a mistake? Everybody makes mistakes. What's the >big deal? I really don't understand it. Any psychologists on this list? I'm not a psychologist, though I doubt that would help. (Having had a girlfriend who was one, she had no special knowledge about corporate motivations...) Companies are pyramids, with a flood of signals flowing up and down the pyramid. Few of the signals are truly important, most are just noise. Hence the difficulty with corporations responding to crises. When a confirmation of a serious problem is made--a building collapses, a floating point bug is found in a chip, a random number generator is found to be flawed, etc.--then there is little doubt that a real problem exists, or at least that a public relations problem must be dealt with. Therefore, a flurry of corporate activity ensues, task forces are created, press releases issued, etc. I'm neither surprised nor disheartened by this. It often takes hitting a company over the head with a two-by-four..."to get their attention." (I saw this many times at Intel, and they were ahead of most of their rivals in spotting problems early on. The "Pentium debacle" is a perfect example of what Lucky is decrying, as internal memos on the problem had been basically pooh-poohed and ignored, until a major public relations disaster hit.) And this has always been a major role of extra-corporate agents: safety inspectors, insurance companies, independent testing laboratories, and so on. The in-house testing departments are frequently inclined to overstate concerns (known universally as "CYA," for "cover your ass"), so it is not surprising that their concerns are often treated as a non-urgent matter. Until a crisis happens, then they are lambasted for not having spoken up more loudly and more forcefully. This was true in ancient Sumeria, in the early factories in Europe, on the communes in China, and in the high-tech labs of today. An easily understandable mixture of psychology, systems analysis, group dynamics, economics, and evolutionary game theory. The Cypherpunks group is, to some extent, helping in this process by trying to break or cripple new software. (As several of us have noted, the NSA's second official role, that of securing commercial cryptography, COMSEC, seems to have been ignored. We are thus left to fill in for these slackers.) --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

IRS/FBI story re Internet
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 9-JAN-1996 20:19:54.25 To: IN%"edupage(a)elanor.oit.unc.edu" "EDUCOM Edupage Mailing List" IRS, FBI EYE INTERNET WITH SUSPICION The Clinton administration's reluctance to ease up on export controls for encryption software stems in part from pressure from U.S. law enforcement agencies, and the owner of a New York-based software company sees heavy lobbying behind the government's desire to regulate content on the Internet: "I think the Internal Revenue Service and the FBI are watching this one very carefully. They wouldn't mind seeing the government set a precedent for deciding what can and cannot go on the Internet." The IRS fears that easy access to cheap and sophisticated encryption software will make income- and sales-tax evasion too easy, and the FBI worries about criminal and terrorist plots hatched in cyberspace, but some observers say government control tactics are too little, too late. A Hudson Institute economist says, "Electronic money gets really interesting when you realize how impossible it is to put national walls around it, mandate the use of national currencies, or require that transactions go through banks... The country will have no practical choice but to rely more than ever on voluntary tax compliance. That means tax rates will have to be kept as low as possible on people and on businesses." (Investor's Business Daily 9 Jan 96 B1) [...] EDUPAGE is what you've just finished reading. (Please note that it's "Edupage" and not "EduPage.") To subscribe to Edupage: send a message to: listproc(a)educom.unc.edu and in the body of the message type: subscribe edupage Warren Buffett (assuming that your name is Warren Buffett; if it's not, substitute your own name). ... To cancel, send a message to: listproc(a)educom.unc.edu and in the body of the message type: unsubscribe edupage. (Subscription problems? Send mail to educom(a)educom.unc.edu.)

1 0

RISC not everything
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:24 PM 1/9/96, Kent Dahlgren wrote: >better way to tell them? Maybe I'm just paranoid. Its just that I kind >of feel sorry for DEC; its not easy being burdened with the worst >marketing staff in the world, having the world's fastest RISC processor, >and having the media go wild over the P6. I'm also a fan of Alta Vista, and use it daily. And I'd love to have a DEC Alpha workstation. However, there's more to success than being "the world's fastest RISC processor," as history has shown for the past decade or so. (Amongst other things, the SPECInts for the Alpha are actually lower than for the P6, though SPECfps are higher. And some of the MIPS/SGI processors are about as powerful as either.) The various high-end Alphas have a high per-chip cost. Very high. (Low-end Alphas are cheaper, but mainly for good reasons...a low-end Alpha is not compelling.) The high per-chip cost is associated with the large die size, DEC's lack of volume in making chips (which largely determines chip yields), the "mostly clock" layout (the 300 MHz clock is hard to distribute across the entire die area, and DEC uses a considerable fraction of the chip area and metallization in distributing the clock without significant skew), and the architecture. I'm not a P6 expert (nor do I even own or use any Intel processor machines, save for an old laptop, a first-generatino IBM PC, and a 1978-era Sol), but my friend John Wharton has written glowingly of the P6 architectural innovations in the P6. In any case, Intel has the manufacturing machine able to make Pentiums in large enough volume for low enough cost to be a major market force. DEC does not have the same advantages. There are of course lots of issues to consider. If NT is as successful as I think it will be (see, I'm not _only_ a basher of Microsoft!), and if the versions of software for NT will not require extensive tuning for various platforms, then I think Intel's dominance will be slightly weakened. However, Intel is not standing still--it's busy building several new fabs that each cost more than a billion dollars (including one that will cost $2 B). Its "P7" processor is far along in development, and reportedly will merge today's features with "very long instruction word" (VLIW) techniques. DEC is back to making profits, but it sure wasn't for several years while it coasted on the work done earlier on the VAX. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: WIRE TAP ON NET
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: "Michael S. Fischer" <mfischer(a)nsi.edu> >Well, I can't exactly say I feel sorry for the guys, even if cellular companies are ripping us off. Anyone who commits crimes while using email without encryption are idiots. ---------- While I can't really approve of stealing from the cellular companies, I do like a lot of the uses of such stolen numbers. Specifically, that they're being used in ways (such as by drug dealers) that the government doesn't like at all. -Allen

1 0

Scenario: Digital Telephony Leads to GAK
by tcmay＠got.net 17 Dec '03

17 Dec '03

Thanks, Leo, for providing this, and the translation into English. At 7:45 PM 1/9/96, Leo Van Hove wrote: >I looked up the law mentioned in the newspaper article and it goes like >this (non french speaking cypherpunks, please see comments below <grin>): ... >Art. 202 stipulates that Belgacom (= Belgium's leading telephone company) >and other telecom companies have to cooperate with law enforcement when it >wants to tap telephone lines - no, sorry, make that telecom lines (!). >Note that tapping is only allowed under certain circumstances stipulated in >the so-called Privacy Law (see also my previous posting to this list). This is almost exactly the same provision that Digital Telephony established in the U.S., namely, that switch providers (phone companies, loosely speaking, but possibly more, including packet switches....). More on this in a moment. >Art. 203 is the most important as far as key escrow is concerned. It >completes Art. 95 of the 1991 Law which stipulated 4 conditions in which >telecom equipment may be seized. These initial conditions are rather >harmless (equipment does no longer conform to the initial specifications, >it hinders public broadcasts, presents health risks for the users,...). >Art. 203 adds a 5th and stingy one: equipment that makes tapping impossible >may be disconnected from the network and seized ... On the face of it - >I'm not a lawyer, so don't pin me down on this - this means no crypto (or ^^^^^^^^^^^^^^^^^^^^^^^^ >only with key escrow) ... ^^^^^^^^^^^^^^^^^^^^^ I think this ties in closely with the European meetings on key escrow (recall that our earliest indications of a move to get "software key escrow" came from the Karlsruhe meeting in the spring of 1994, and various international forums on key escrow began soon thereafter). This fits with several trends I and others here have discussed: * getting corporations to do as much of the enforcment work as possible. * using the civil forfeiture and penalty provisions to terrify the corporations, ISPs, switch providers, etc., to cooperate (I referred to this as "deputizing" the corporations as soldiers in the government's wars). * having Europe launch the crackdowns, then pleading that the U.S. must "conform" to international treaties and law enforcement agreements. (Some have argued that the Bavarian version of Exon was a step in this direction....) So, we need to be alert for the following scenario: 1. Telephone companies, telecom providers, ISPs, etc., must conform to the Digital Telephony wiretapping provisions, or variants thereof (not just the language of Digital Telephony, but also language in pending and future bills). 1a. If Exon passes, ISPs may also have to verify ages of users. This would necessitate a form of "Internet ID card," with all that this implies for the use of cryptography, anonymity, etc. 2. European companies (private, and PTTs) set the precedent. 3. An exception is made for key escrow. That is, one of the companies in #1 can be held harmless if it has taken major steps to ensure that users are not using encryption that is not properly escrowed. That is, they can escape the Title 18 fines and seizure of their equipment if they "cooperate" with "valid investigations." 4. A few prosecutions will likely have to made, just to make sure the message is properly received. (Like the two-by-four over the head I mentioned in my last message.) 5. A panic sets in. Just as CompuServe dumped 200 newsgroups on the whiff that a prosecution and seizure might happen, many ISPs will ignorantly send out warnings to users that all encrypted messages must use GAK. (To be sure, not all will. Some will ignore the warnings, some will contemptuously flout the law, etc.) 6. The government gets a large fraction of messages into a GAK format. Once again, corporations and ISPs become the deputies. (Note: Sure, superencryption still works, and no GAK system will be universally successful. Maybe not even successful in a majority of cases. But probably enough to cripple large-scale usage and, especially, commercial payment usage. This may be enough for the IRS, FinCen, etc.) We really need to be looking to what the nations of Europe are doing (as we have been of course, as the crypto laws of Europe have always been interesting to us, even if the machinations of the U.S. get most of the attention, for obvious reasons). --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

NOISE.SYS for DOS v0.3.5 (NEW!)
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

The latest version of NOISE.SYS (v0.3.5-Beta) can be gotten via anonymous ftp at ftp.funet.fi/pub/crypt/random/noise035.zip NOISE.SYS is a /dev/random driver for DOS systems running on 386 or later processors. It will sample fast timings between keystrokes and disk access, as well as changes in mouse position and CPU-clock drift, mixing with SHA-2 message digest to generate crypto-quality random numbers. Added in this version: Added documentation!!! Fixed timer sampling bug Fixed clock drift sampling (better entropy too) Added mouse position sampling Different accumulation function Lots of other changes

1 0

Re: Why Companies are Poor at Finding Bugs
by Alan Olsen 17 Dec '03

17 Dec '03

At 06:53 PM 1/9/96 -0800, Tim May wrote: >And this has always been a major role of extra-corporate agents: safety >inspectors, insurance companies, independent testing laboratories, and so >on. The in-house testing departments are frequently inclined to overstate >concerns (known universally as "CYA," for "cover your ass"), so it is not >surprising that their concerns are often treated as a non-urgent matter. >Until a crisis happens, then they are lambasted for not having spoken up >more loudly and more forcefully. I have seen this before in a number of companies... I think it is becuase alot of management is trained to think of things in the positive. To try and put the best spin on any situation... On the other hand, people of a technical bent tend to think of things as problems to be solved. Such an outlook is seen as negative. The two outlooks seem to conflict on many levels. Such outlooks from management tend to delay resolution of problems until it is too late... >This was true in ancient Sumeria, in the early factories in Europe, on the >communes in China, and in the high-tech labs of today. An easily >understandable mixture of psychology, systems analysis, group dynamics, >economics, and evolutionary game theory. You forgot the works of Machivelli... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Governments are potholes on the Information Superhighway." - Not TCMay

2 1